---
title: "The Unified Gateway for APIs, AI, and MCP"
description:
  "Secure, govern, and observe every API, LLM, and MCP call on one programmable
  policy engine. AI Gateway, MCP Gateway, MCP Server, and API management — fully
  managed, live in minutes."
canonicalUrl: "https://zuplo.com/"
sourceUrl: "https://zuplo.com/"
pageType: "homepage"
generatedAt: "2026-10-08"
---

# Secure, govern, and observe every API, LLM, and MCP call.

> Zuplo is the unified gateway for APIs and AI — one programmable policy engine
> for the models your apps call and the agents that call you. Live in minutes,
> spend under control, every agent call accounted for.

[Meet the MCP Gateway →](https://zuplo.com/blog/introducing-zuplo-mcp-gateway)

- Live in minutes
- 99.99% uptime SLA
- 1B+ end users
- SOC 2 Type II

Customers: AccuWeather, Blockdaemon, Lake Michigan Credit Union, Finsolutia,
VNDR, Mews, Yext, Zumiez.

## Your API has two new kinds of traffic

Your applications call models, and AI agents call you. Both are API traffic —
and both belong behind one gateway.

- **Outbound — your product calls LLMs.** Every AI feature you ship adds model
  calls to your traffic — and to your bill. Those calls need routing, spend
  caps, and guardrails, the same way any critical dependency does.
- **Inbound — AI agents call your API.** MCP made every agent an API consumer.
  Agents need identity, scoped access, quotas, and docs — real consumers to
  serve well, not just load to absorb.
- **Both directions — one gateway in the middle.** Auth, rate limits, spend
  caps, and audit — written once on one programmable policy engine and enforced
  on every API, LLM, and MCP call, in both directions.

## One policy engine. Four capabilities.

Zuplo is the unified gateway for APIs, AI, and MCP. Auth, rate limits, spend
caps, and audit run on one programmable policy engine — turn on the surfaces you
need without adding a vendor.

- **Agents** — Scoped, audited access for AI agents via MCP.
- **Users** — API keys, JWT & OAuth with per-key rate limits.
- **APIs & MCPs** — REST, GraphQL & MCP servers behind one gateway.
- **LLMs** — Route providers with budgets, caching & guardrails.

Products:

- [AI Gateway](/ai-gateway) — Route LLM traffic, cap spend per team
- [MCP Gateway](/mcp-gateway) — Ship MCP to customers; govern the MCP your teams
  use
- [MCP Server](/features/mcp-servers) — Your OpenAPI, as MCP tools
- [API Management](/api-management) — Portal, keys, rate limits, GitOps

Every call is authenticated as a verified identity — API keys, your IdP, or
OAuth tokens the gateway issues itself.

## See every agent, every call, every token

Claude, Cursor, Codex, and ChatGPT already connect through Zuplo. Explore what
one gateway shows you — costs, budgets, security, and every tool call
attributed.

### Agent traffic: every MCP tool call, attributed to an agent

Each session authenticates with OAuth 2.1 and PKCE, and each tool call is logged
with the client, the user behind it, and the policy the gateway applied —
scopes, rate limits, metering.

### Cost control: dynamic rate limiting stops origin cost spikes

A traffic surge sends unmetered origin spend through the roof. Zuplo caps it
automatically — before the bill lands. (Illustrated: $42.9k saved over 14 days,
41% lower total spend.)

### AI budgets: every token, attributed to a team — under one budget

See which workload drives LLM cost. Zuplo caps spend per team and halts requests
at the ceiling, so a runaway agent can't blow the budget.

### Security & governance: bad traffic stops at the gateway

Auth, schema validation, rate limits, and prompt-injection defense reject abuse
before it reaches your systems — the same policies for every API, model, and MCP
server. (Illustrated: 12.4k requests blocked this week, 0 reached your origin —
auth failures 5.2k, rate limit exceeded 4.1k, invalid schema 2.3k, prompt
injection 800.)

### Visibility: understand what every agent is doing

Per-user and per-client attribution turns raw MCP traffic into answers: which
agents call which tools, where denials cluster, and how latency trends. Explore
it in real-time dashboards — or export everything to Datadog or your SIEM.

### Monetization: API traffic, metered and billed

Plans, quotas, and usage-based billing built into the gateway — wired to Stripe,
with no billing infrastructure to build.

Facts:

- MCP spec 2025-11-25 at GA — OAuth 2.1, PKCE, DCR + CIMD
- 1B+ end users via AccuWeather
- 300+ edge locations, ~20s deploys

## Both directions, in code

The models your apps call and the agents that call you — a base-URL swap on one
side, an OpenAPI extension on the other.

### Outbound — your app calls LLMs

Keep the OpenAI SDK and point it at your gateway. Provider routing, spend caps,
and guardrails apply to every call.

```ts
// Keep your existing OpenAI SDK — just swap the base URL
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://your-org.zuplo.app/v1",
  apiKey: process.env.ZUPLO_AI_KEY, // your Zuplo key, not OpenAI's
});

const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Summarize our Q1 sales data." }],
});
```

[Explore the AI Gateway →](/ai-gateway)

### Inbound — agents call your API

Mark OpenAPI operations as MCP tools. Deploy, and agents connect at `/mcp` —
through the same policies as the rest of your API.

```json
{
  "paths": {
    "/orders/{id}": {
      "get": {
        "operationId": "getOrder",
        "summary": "Fetch order by ID",
        "x-zuplo-route": {
          "mcp": { "type": "resource" }
        }
      }
    },
    "/tickets": {
      "post": {
        "operationId": "createTicket",
        "summary": "Open a support ticket",
        "x-zuplo-route": {
          "mcp": { "type": "tool" }
        }
      }
    }
  }
}
```

[Explore MCP Server →](/features/mcp-servers)

Same gateway. Same policies. Both directions.

## Value you can measure in the first month

Lower cost, a smaller attack surface, faster resolution, and new revenue — real
results, not a feature checklist.

- **Cut runaway cost** — Dynamic rate limiting absorbs traffic spikes before
  they hit your origin; token budgets stop AI overspend with a hard cap, not a
  surprise overage.
- **Shrink the attack surface** — Auth, schema validation, and bot controls
  reject bad traffic before it reaches your systems — the same policies across
  every API, model, and MCP server.
- **Prove what's happening** — Every API, LLM, and MCP call is logged and
  attributed to a consumer, then exported to the SIEM you already run.
- **Turn traffic into revenue** — Meter, price, and bill APIs and AI by request,
  token, or any unit that costs you — with no billing infrastructure to build.
- **Resolve issues faster** — Request-level tracing pinpoints the slow hop from
  client to origin, so problems get fixed before they become escalations.
- **Govern AI for the CISO** — Scoped access, audit logs, secret masking, and
  prompt-injection defense — the answers security teams actually ask for.

## Teams ship real results on Zuplo

> The move to Zuplo from our existing API Management vendor was easy, taking
> just over 2 months to switch mission critical systems, and we're saving over
> 70% on costs.
>
> — Ryan Waites, Senior Director, Blockdaemon
> ([case study](/customers/blockdaemon)) — 90% hardware footprint reduction at
> scale

> Zuplo gives us the flexibility to scale efficiently, ensures security and
> compliance, and reduces operational complexity so we can focus on building new
> capabilities.
>
> — Daryl Benzel, Staff Software Engineer, Yext ([case study](/customers/yext))

- [AccuWeather](/customers/accuweather): 1B+ end users served via Zuplo APIs

> We didn't touch a line of code, it's just plug and play. The results were very
> surprising, in just a couple of hours we had a fully working MCP Server.
>
> — Miguel Madeira, CTO & Co-Founder, Finsolutia
> ([case study](/customers/finsolutia)) — hours to launch an MCP server on
> regulated APIs

## Frequently asked questions

### What is a unified gateway?

A unified gateway puts every kind of traffic your business runs — API requests
from users, LLM calls from your own applications, and MCP tool calls from AI
agents — behind one programmable policy engine. Authentication, rate limiting,
spend caps, and audit logging are written once and enforced on every API, LLM,
and MCP call, instead of being split across an API gateway, an LLM proxy, and an
MCP experiment on the side.

### What's the difference between an AI gateway and an API gateway?

An API gateway sits in front of the APIs you serve — handling authentication,
rate limits, and routing for the requests coming in. An AI gateway sits in front
of the LLM providers your applications call — routing traffic across models,
capping spend per team, and applying guardrails to the requests going out. With
Zuplo both run on the same policy engine, so the rules that protect your APIs
also govern your AI traffic.

### What is an MCP gateway?

An MCP gateway is the control point between AI agents and MCP servers. It
authenticates agents with OAuth, controls which tools each user can see and
invoke, brokers credentials to upstream servers, and logs every tool call.
Zuplo's MCP Gateway includes a spec-compliant OAuth authorization server —
Dynamic Client Registration, PKCE, implementing MCP spec revision 2025-11-25 —
so you can ship MCP to customers and govern the MCP your teams use from the same
gateway.

### Can Zuplo replace my existing gateway?

Yes — and you don't have to do it in one cutover. Teams have moved off Apigee,
Kong, and Azure API Management; Blockdaemon switched mission-critical systems
off Apigee in just over two months and cut gateway costs by 70%. Zuplo also
works alongside the gateway you already run, so most teams start with the new
traffic — routing LLM calls through the AI Gateway or publishing an MCP server
in front of an existing API — and consolidate the rest onto one policy engine
route by route, on their own schedule.

### What's included in every Zuplo plan?

The MCP Gateway, AI Gateway, and Developer Portal are included in every plan
alongside the core API gateway. The Free plan comes with 100K requests and 1K
MCP tool calls per month, no credit card required — enough to put a real API, an
LLM route, and an MCP server into production before you pay anything.

## Next steps

One gateway for every API, LLM, and MCP call. Live in minutes. Free tier
includes 100K requests/month. No credit card. No sales call.

- [Start for Free](https://portal.zuplo.com/signup)
- Book a demo / talk to an API expert
- Docs: [AI Gateway](https://zuplo.com/docs/ai-gateway/introduction),
  [MCP Gateway](https://zuplo.com/docs/mcp-gateway/introduction),
  [MCP Server](https://zuplo.com/docs/mcp-server/introduction)