Zuplo
Model Context Protocol Meet the MCP Gateway →

Secure, govern, and monetize every API, LLM, and MCP call.

Zuplo is the unified gateway for APIs and AI — one programmable policy engine for the models your apps call and the agents that call you. Live in minutes, spend under control, every agent call accounted for.

  • Live in minutes
  • 99.99% uptime SLA
  • 1B+ end users
  • SOC 2 Type II
The shift

Your API has two new kinds of traffic

Your applications call models, and AI agents call you. Both are API traffic — and both belong behind one gateway.

Outbound

Your product calls LLMs

Every AI feature you ship adds model calls to your traffic — and to your bill. Those calls need routing, spend caps, and guardrails, the same way any critical dependency does.

Inbound

AI agents call your API

MCP made every agent an API consumer. Agents need identity, scoped access, quotas, and docs — real consumers to serve well, not just load to absorb.

Both directions

One gateway in the middle

Auth, rate limits, spend caps, and audit — written once on one programmable policy engine and enforced on every API, LLM, and MCP call, in both directions.

The platform

One policy engine. Four products.

Zuplo is the unified gateway for APIs, AI, and MCP. Auth, rate limits, spend caps, and audit run on one programmable policy engine — turn on the surfaces you need without adding a vendor.

Scoped, audited access for AI agents via MCP.

Learn more

API keys, JWT & OAuth with per-key rate limits.

Learn more

REST, GraphQL & MCP servers behind one gateway.

Learn more

Route providers with budgets, caching & guardrails.

Learn more

Every call authenticated as a verified identity — API keys, your IdP, or OAuth tokens the gateway issues itself.

See every agent, every call, every dollar.

Claude, Cursor, Codex, and ChatGPT already connect through Zuplo. Explore what one gateway shows you — costs, budgets, security, and every tool call attributed.

Agent traffic

Every MCP tool call, attributed to an agent

Each session authenticates with OAuth 2.1 and PKCE, and each tool call is logged with the client, the user behind it, and the policy the gateway applied — scopes, rate limits, metering.

Agents connecting through Zuplo gateways

  • Claude
  • Cursor
  • Codex
  • ChatGPT
MCP tool calls
OAuth 2.1 · PKCE
Claudesearch_docs200
Cursororders.lookup200
ChatGPTtools/list200
Codexrepo.search200
Claudeinvoices.create403
Cursorquotes.generate429
ChatGPTweather.today200
Codexdb.query200
  • MCP spec 2025-11-25 at GA — OAuth 2.1, PKCE, DCR + CIMD
  • 1B+ end users via AccuWeather
  • 300+ edge locations, ~20s deploys
In code

Both directions, in code

The models your apps call and the agents that call you — a base-URL swap on one side, an OpenAPI extension on the other.

Outbound — your app calls LLMs

Keep the OpenAI SDK and point it at your gateway. Provider routing, spend caps, and guardrails apply to every call.

TypeScriptOpenAI SDK → Zuplo AI Gateway
// Keep your existing OpenAI SDK — just swap the base URL
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://your-org.zuplo.app/v1",
  apiKey: process.env.ZUPLO_AI_KEY, // your Zuplo key, not OpenAI's
});

const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Summarize our Q1 sales data." }],
});
Explore the AI Gateway →

Inbound — agents call your API

Mark OpenAPI operations as MCP tools. Deploy, and agents connect at /mcp — through the same policies as the rest of your API.

JSONroutes.oas.json — OpenAPI → MCP tools
{
  "paths": {
    "/orders/{id}": {
      "get": {
        "operationId": "getOrder",
        "summary": "Fetch order by ID",
        "x-zuplo-route": {
          "mcp": { "type": "resource" }
        }
      }
    },
    "/tickets": {
      "post": {
        "operationId": "createTicket",
        "summary": "Open a support ticket",
        "x-zuplo-route": {
          "mcp": { "type": "tool" }
        }
      }
    }
  }
}
Explore MCP Server →

Same gateway. Same policies. Both directions.

Monetization

When you're ready to charge for it, billing is built in.

The same plans, metering, and Stripe billing that run your API cover MCP traffic too — no second billing stack for agent-facing endpoints.

Gate by plan

Check plan entitlement at the gateway before a request — API or MCP — ever reaches your backend.

Meter and bill

Request-level usage flows into Stripe invoices — by request, token, or any unit that costs you money.

Publish a portal

Plans, self-service keys, and documented MCP endpoints — one developer portal for all of it.

The bottom line

Value you can measure in the first month

Lower cost, a smaller attack surface, faster resolution, and new revenue — real results, not a feature checklist.

Cut runaway cost

Dynamic rate limiting absorbs traffic spikes before they hit your origin; token budgets stop AI overspend with a hard cap, not a surprise overage.

Shrink the attack surface

Auth, schema validation, and bot controls reject bad traffic before it reaches your systems — the same policies across every API, model, and MCP server.

Prove what's happening

Every API, LLM, and MCP call is logged and attributed to a consumer, then exported to the SIEM you already run.

Turn traffic into revenue

Meter, price, and bill APIs and AI by request, token, or any unit that costs you — with no billing infrastructure to build.

Resolve issues faster

Request-level tracing pinpoints the slow hop from client to origin, so problems get fixed before they become escalations.

Govern AI for the CISO

Scoped access, audit logs, secret masking, and prompt-injection defense — the answers security teams actually ask for.

Frequently Asked Questions

Straight answers on unified gateways, AI gateways, and MCP — and what's included in every plan.

Want a demo of Zuplo? Talk to an API expert

One gateway for every API, LLM, and MCP call. Live in minutes.

Free tier includes 100K requests/month. No credit card. No sales call.