How do I turn an existing API into an MCP server?

Mark the operations you want to expose with the x-zuplo-route.mcp extension in your OpenAPI document and deploy. Zuplo derives tool names, descriptions, and schemas from the spec you already maintain — no second codebase, no schema drift. GraphQL operations and custom TypeScript tools work the same way.

Do AI agents need special accounts to use my API?

No. The gateway bundles a spec-compliant OAuth authorization server, so agents onboard themselves through Dynamic Client Registration (RFC 7591) or Client ID Metadata Documents, and your users sign in with the identity provider you already run — Auth0, Okta, Microsoft Entra ID, and eight more first-class integrations, plus any OIDC provider. API-key auth is also supported for simpler integrations.

Can I charge for API usage over MCP?

Yes. Gate MCP access by plan entitlement so only subscribers reach your tools, and meter usage at the request level through Zuplo's Stripe-backed monetization — the same plans and invoices as your REST traffic. The developers behind agents subscribe through your developer portal like any other API consumer.

Which AI clients can connect to my MCP server?

Any spec-compliant MCP client. Zuplo implements the 2025-11-25 revision of the MCP specification, with documented connect guides for Claude, ChatGPT, Cursor, VS Code with GitHub Copilot, and more.

Do I need separate infrastructure to ship MCP?

No. MCP runs on the same gateway and the same policy engine as your REST and GraphQL traffic — auth, rate limiting, and monetization policies apply to tool calls the same way they apply to API requests. The MCP Gateway, AI Gateway, and developer portal are included in every plan.

Ship Your API to Agents

Your API, in every agent — secured, governed, billed.

Behind every AI agent is a team that needs keys, docs, and a plan. Zuplo turns the OpenAPI spec you already have into MCP tools — with a real OAuth authorization server, developer portal docs, and usage-based billing on the same policy engine that runs your APIs.

Get an MCP Demo Start for Free

API Routes

GET/orders

POST/tickets

GET/users/{id}

Zuplo

MCP Tools

list_orders()

create_ticket()

get_user_status()

Claude

ChatGPT

Gemini

Agents as API consumers

Agents are already consuming APIs.

Claude, ChatGPT, Cursor, and the agents built on them reach APIs through MCP. Ship a first-class MCP experience and yours is the API agents can actually discover and use.

A new class of consumer

AI agents discover and call APIs through MCP tools. If your API isn't exposed as MCP, it's invisible to Claude, ChatGPT, Cursor, and every agent built on them.

They onboard differently

Agents don't fill out signup forms. They register through OAuth, discover your capabilities from published metadata, and read documentation programmatically.

Usage you can meter and bill

Authenticated, metered MCP traffic rides the same plans and Stripe billing as the rest of your API — billed to the team behind the agent, like any other consumer.

OpenAPI to production

The full loop, on one gateway

Expose, secure, document, and bill — each step is a capability of the gateway you already deploy, not a separate product to integrate.

01

Turn your OpenAPI spec into MCP tools

Mark the operations you want agents to use with x-zuplo-route.mcp and deploy. Tool names, parameters, and schemas come straight from the spec you already maintain — no second codebase, no drift.

MCP Server

02

Let any agent sign in

The gateway bundles the OAuth authorization server the MCP spec defines. Agents self-register via Dynamic Client Registration or CIMD, and your users authenticate against the IdP you already run — any client, any IdP, any auth method.

MCP Gateway

03

Publish docs humans and agents both read

Your developer portal ships with the gateway and documents MCP endpoints alongside your REST reference. One place for a developer to evaluate your API — and for an agent to be pointed at it.

Developer Portal

04

Bill MCP usage through Stripe

Gate MCP access by plan entitlement and meter usage at the request level with the same Stripe-backed monetization that runs your API plans. The teams behind agents subscribe like any other customer.

Monetization

How it works

Your spec is the MCP server

Pick the operations agents should use, tag them, deploy. Every tool call runs through the same policy pipeline — auth, rate limits, monetization — as the underlying route.

OpenAPI → MCP tools

  # routes.oas.json (excerpt)
"/forecast/{location}": {
  "get": {
    "operationId": "getForecast",
    "summary": "Get the forecast for a location",
    "x-zuplo-route": {
      "mcp": { "type": "tool" }
    }
  }
},
"/alerts": {
  "get": {
    "operationId": "listAlerts",
    "summary": "List active weather alerts",
    "x-zuplo-route": {
      "mcp": { "type": "tool" }
    }
  }
}

# Register on the MCP handler:
"/mcp" route → mcpServerHandler({
  operations: [
    { file: "routes.oas.json", id: "getForecast" },
    { file: "routes.oas.json", id: "listAlerts" }
  ]
})

Identity for agents

Any client, any IdP, any auth method

Shipping a secured MCP server means standing up the OAuth the spec defines. Zuplo is the only fully-managed gateway that bundles a spec-compliant OAuth authorization server, so you never have to build it. Your customers click Connect; they don't paste tokens.

OAuth 2.1 with PKCE

A complete authorization server written to the 2025-11-25 MCP spec. PKCE S256 is required on every flow, so no client secrets ship to the desktop.

Self-service client registration

Agents onboard themselves through Dynamic Client Registration (RFC 7591) or Client ID Metadata Documents — no manual app registration per client.

Spec-compliant discovery

Authorization-server metadata (RFC 8414) and protected-resource metadata (RFC 9728) are published automatically, so clients negotiate auth correctly the first time.

Audience-bound tokens

Every token carries an RFC 8707 resource indicator scoped to one route. A token minted for one MCP server is rejected at another, closing confused-deputy attacks by construction.

Revocation built in

RFC 7009 token revocation and rotating refresh tokens with reuse detection. Cut off a client or a user without redeploying anything.

Bring your own IdP

Eleven first-class identity provider integrations — Auth0, Okta, Microsoft Entra ID, Clerk, WorkOS, Amazon Cognito, Google, Keycloak, Logto, OneLogin, PingOne — plus any OIDC provider.

See the whole loop — OpenAPI to billable MCP — on your own API.

Get an MCP Demo

In production

AccuWeather delivers weather data to more than a billion people through Zuplo — and runs a public MCP so agents can use it too.

The same gateway that serves AccuWeather's API business — developer portal, monetization, edge caching — now serves its weather data to AI agents over MCP.

Read the AccuWeather story

The road ahead

Agentic payments are coming into view.

Stripe is building for agentic commerce, and open protocols like x402 are exploring how agents pay for what they use without a human in the loop. It's early, the standards are still settling, and none of it is turnkey yet — but the groundwork is the same either way: agent traffic that's authenticated, metered, and attributed to an account.

Our take on x402 and API payments