---
title: "Ship Your API to AI Agents"
description:
  "Turn your OpenAPI spec into MCP tools with a bundled OAuth authorization
  server, developer portal docs, and full gateway policy control — on the same
  gateway that runs your API."
canonicalUrl: "https://zuplo.com/solutions/ship-mcp"
sourceUrl: "https://zuplo.com/solutions/ship-mcp"
pageType: "use-case"
generatedAt: "2026-09-04"
---

# Your API, in every agent — secured, documented, governed.

> Behind every AI agent is a team that needs keys, docs, and guardrails. Zuplo
> turns your OpenAPI spec into MCP tools — with OAuth, portal docs, and audit
> built in — on the gateway you already run.

## Agents are already consuming APIs.

Agents reach APIs through MCP — ship it, and yours is the one they find and use.

- **Invisible APIs don't get used** — If your API isn't MCP, Claude, ChatGPT,
  and Cursor can't find it.
- **Agents don't fill out forms** — They sign in, discover your tools, and read
  your docs — all on their own.
- **Agent traffic is API traffic** — It runs through the same auth, rate limits,
  and audit trail as the rest of your API.

## The full loop, on one gateway

Expose, secure, document, and bill — all on the gateway you already run.

1. **Turn your OpenAPI spec into MCP tools** — Tag the operations agents should
   use and deploy — no second codebase, no drift.
   ([MCP Server](/features/mcp-servers))
2. **Let any agent sign in** — OAuth is built into the gateway. Agents onboard
   themselves; users keep their login. ([MCP Gateway](/mcp-gateway))
3. **Docs humans and agents both read** — Your portal documents MCP next to your
   REST reference — one place to point anyone.
   ([Developer Portal](/features/developer-portal))
4. **Bill MCP usage through Stripe** — Gate access by plan; the teams behind
   agents subscribe like any other customer.
   ([Monetization](/features/api-monetization))

## Your spec is the MCP server

Pick the operations agents should use, tag them, deploy. Every tool call runs
through the same policy pipeline — auth, rate limits, monetization — as the
underlying route.

```json
# routes.oas.json (excerpt)
"/forecast/{location}": {
  "get": {
    "operationId": "getForecast",
    "summary": "Get the forecast for a location",
    "x-zuplo-route": {
      "mcp": { "type": "tool" }
    }
  }
},
"/alerts": {
  "get": {
    "operationId": "listAlerts",
    "summary": "List active weather alerts",
    "x-zuplo-route": {
      "mcp": { "type": "tool" }
    }
  }
}

# Register on the MCP handler:
"/mcp" route → mcpServerHandler({
  operations: [
    { file: "routes.oas.json", id: "getForecast" },
    { file: "routes.oas.json", id: "listAlerts" }
  ]
})
```

## Your customers click Connect. That's it.

The MCP spec demands real sign-in. Zuplo ships it — no tokens to paste, no auth
code to write.

- **Nothing to build** — The full OAuth server ships with the gateway, on every
  plan.
- **No onboarding queue** — Agents register themselves — nobody files a ticket
  to connect.
- **A leak stops at one server** — A token for one MCP server is rejected at
  every other.
- **Cut off anyone, instantly** — Revoke a client or a user in one step — no
  redeploy.

**Sign in with what you already run**: Okta, Microsoft Entra ID, Auth0, Google,
Clerk, WorkOS, Amazon Cognito, Keycloak, Logto, OneLogin, PingOne, and any OIDC
provider.

**For your security review**: OAuth 2.1, PKCE S256, DCR · RFC 7591, CIMD, RFC
8414, RFC 9728, RFC 8707, RFC 7009.

## In production

> AccuWeather serves a billion people through Zuplo — and now serves AI agents
> over MCP, on the same gateway.

[Read the AccuWeather story](/customers/accuweather)

## The road ahead

The agent ecosystem is still taking shape. Standards like x402 are working out
how agents pay for what they use. It's early — but if you're already metering
and attributing agent traffic, the groundwork is done.

[Our take on x402 and API payments](/blog/mcp-api-payments-with-x402.md)

## Frequently Asked Questions

Common questions from API teams shipping MCP to their customers.

**How do I turn an existing API into an MCP server?**

Mark the operations you want to expose with the x-zuplo-route.mcp extension in
your OpenAPI document and deploy. Zuplo derives tool names, descriptions, and
schemas from the spec you already maintain — no second codebase, no schema
drift. GraphQL operations and custom TypeScript tools work the same way.

**Do AI agents need special accounts to use my API?**

No. The gateway bundles a spec-compliant OAuth authorization server, so agents
onboard themselves through Dynamic Client Registration (RFC 7591) or Client ID
Metadata Documents, and your users sign in with the identity provider you
already run — Auth0, Okta, Microsoft Entra ID, and other first-class
integrations, plus any OIDC provider. API-key auth is also supported for simpler
integrations.

**Can I charge for API usage over MCP?**

Yes. Gate MCP access by plan entitlement so only subscribers reach your tools,
and meter usage at the request level through Zuplo's Stripe-backed monetization
— the same plans and invoices as your REST traffic. The developers behind agents
subscribe through your developer portal like any other API consumer.

**Which AI clients can connect to my MCP server?**

Any spec-compliant MCP client. Zuplo implements the 2025-11-25 revision of the
MCP specification, with documented connect guides for Claude, ChatGPT, Cursor,
VS Code with GitHub Copilot, and more.

**Do I need separate infrastructure to ship MCP?**

No. MCP runs on the same gateway and the same policy engine as your REST and
GraphQL traffic — auth, rate limiting, and monetization policies apply to tool
calls the same way they apply to API requests. The MCP Gateway, AI Gateway, and
developer portal are included in every plan.

## Next steps

- Get an MCP demo: [/schedule-call](/schedule-call)
- Start for free:
  [https://portal.zuplo.com/signup](https://portal.zuplo.com/signup)