---
title: "Ship Your API to AI Agents | Zuplo"
description:
  "Turn your OpenAPI spec into MCP tools with a bundled OAuth authorization
  server, developer portal docs, and Stripe-backed usage billing — on the same
  gateway that runs your API."
canonicalUrl: "https://zuplo.com/solutions/ship-mcp"
sourceUrl: "https://zuplo.com/solutions/ship-mcp"
pageType: "use-case"
generatedAt: "2026-07-22"
---

# Your API, in every agent — secured, governed, billed.

> Behind every AI agent is a team that needs keys, docs, and a plan. Zuplo turns
> the OpenAPI spec you already have into MCP tools — with a real OAuth
> authorization server, developer portal docs, and usage-based billing on the
> same policy engine that runs your APIs.

## Agents are already consuming APIs.

Claude, ChatGPT, Cursor, and the agents built on them reach APIs through MCP.
Ship a first-class MCP experience and yours is the API agents can actually
discover and use.

**A new class of consumer** AI agents discover and call APIs through MCP tools.
If your API isn't exposed as MCP, it's invisible to Claude, ChatGPT, Cursor, and
every agent built on them.

**They onboard differently** Agents don't fill out signup forms. They register
through OAuth, discover your capabilities from published metadata, and read
documentation programmatically.

**Usage you can meter and bill** Authenticated, metered MCP traffic rides the
same plans and Stripe billing as the rest of your API — billed to the team
behind the agent, like any other consumer.

## The full loop, on one gateway

Expose, secure, document, and bill — each step is a capability of the gateway
you already deploy, not a separate product to integrate.

### 01 — Turn your OpenAPI spec into MCP tools

Mark the operations you want agents to use with `x-zuplo-route.mcp` and deploy.
Tool names, parameters, and schemas come straight from the spec you already
maintain — no second codebase, no drift.

→ [MCP Server](/features/mcp-servers)

### 02 — Let any agent sign in

The gateway bundles the OAuth authorization server the MCP spec defines. Agents
self-register via Dynamic Client Registration or CIMD, and your users
authenticate against the IdP you already run — any client, any IdP, any auth
method.

→ [MCP Gateway](/mcp-gateway)

### 03 — Publish docs humans and agents both read

Your developer portal ships with the gateway and documents MCP endpoints
alongside your REST reference. One place for a developer to evaluate your API —
and for an agent to be pointed at it.

→ [Developer Portal](/features/developer-portal)

### 04 — Bill MCP usage through Stripe

Gate MCP access by plan entitlement and meter usage at the request level with
the same Stripe-backed monetization that runs your API plans. The teams behind
agents subscribe like any other customer.

→ [Monetization](/features/api-monetization)

## Your spec is the MCP server

Pick the operations agents should use, tag them, deploy. Every tool call runs
through the same policy pipeline — auth, rate limits, monetization — as the
underlying route.

```json
# routes.oas.json (excerpt)
"/forecast/{location}": {
  "get": {
    "operationId": "getForecast",
    "summary": "Get the forecast for a location",
    "x-zuplo-route": {
      "mcp": { "type": "tool" }
    }
  }
},
"/alerts": {
  "get": {
    "operationId": "listAlerts",
    "summary": "List active weather alerts",
    "x-zuplo-route": {
      "mcp": { "type": "tool" }
    }
  }
}

# Register on the MCP handler:
"/mcp" route → mcpServerHandler({
  operations: [
    { file: "routes.oas.json", id: "getForecast" },
    { file: "routes.oas.json", id: "listAlerts" }
  ]
})
```

## Any client, any IdP, any auth method

Shipping a secured MCP server means standing up the OAuth the spec defines.
Zuplo is the only fully-managed gateway that bundles a spec-compliant OAuth
authorization server, so you never have to build it. Your customers click
**Connect**; they don't paste tokens.

**OAuth 2.1 with PKCE** A complete authorization server written to the
2025-11-25 MCP spec. PKCE S256 is required on every flow, so no client secrets
ship to the desktop.

**Self-service client registration** Agents onboard themselves through Dynamic
Client Registration (RFC 7591) or Client ID Metadata Documents — no manual app
registration per client.

**Spec-compliant discovery** Authorization-server metadata (RFC 8414) and
protected-resource metadata (RFC 9728) are published automatically, so clients
negotiate auth correctly the first time.

**Audience-bound tokens** Every token carries an RFC 8707 resource indicator
scoped to one route. A token minted for one MCP server is rejected at another,
closing confused-deputy attacks by construction.

**Revocation built in** RFC 7009 token revocation and rotating refresh tokens
with reuse detection. Cut off a client or a user without redeploying anything.

**Bring your own IdP** Eleven first-class identity provider integrations —
Auth0, Okta, Microsoft Entra ID, Clerk, WorkOS, Amazon Cognito, Google,
Keycloak, Logto, OneLogin, PingOne — plus any OIDC provider.

## In production: AccuWeather

AccuWeather delivers weather data to more than a billion people through Zuplo —
and runs a public MCP so agents can use it too.

The same gateway that serves AccuWeather's API business — developer portal,
monetization, edge caching — now serves its weather data to AI agents over MCP.

→ [Read the AccuWeather story](/customers/accuweather)

## Agentic payments are coming into view.

Stripe is building for agentic commerce, and open protocols like x402 are
exploring how agents pay for what they use without a human in the loop. It's
early, the standards are still settling, and none of it is turnkey yet — but the
groundwork is the same either way: agent traffic that's authenticated, metered,
and attributed to an account.

→ [Our take on x402 and API payments](/blog/mcp-api-payments-with-x402)

## Frequently asked questions

**How do I turn an existing API into an MCP server?** Mark the operations you
want to expose with the `x-zuplo-route.mcp` extension in your OpenAPI document
and deploy. Zuplo derives tool names, descriptions, and schemas from the spec
you already maintain — no second codebase, no schema drift. GraphQL operations
and custom TypeScript tools work the same way.

**Do AI agents need special accounts to use my API?** No. The gateway bundles a
spec-compliant OAuth authorization server, so agents onboard themselves through
Dynamic Client Registration (RFC 7591) or Client ID Metadata Documents, and your
users sign in with the identity provider you already run — Auth0, Okta,
Microsoft Entra ID, and eight more first-class integrations, plus any OIDC
provider. API-key auth is also supported for simpler integrations.

**Can I charge for API usage over MCP?** Yes. Gate MCP access by plan
entitlement so only subscribers reach your tools, and meter usage at the request
level through Zuplo's Stripe-backed monetization — the same plans and invoices
as your REST traffic. The developers behind agents subscribe through your
developer portal like any other API consumer.

**Which AI clients can connect to my MCP server?** Any spec-compliant MCP
client. Zuplo implements the 2025-11-25 revision of the MCP specification, with
documented connect guides for Claude, ChatGPT, Cursor, VS Code with GitHub
Copilot, and more.

**Do I need separate infrastructure to ship MCP?** No. MCP runs on the same
gateway and the same policy engine as your REST and GraphQL traffic — auth, rate
limiting, and monetization policies apply to tool calls the same way they apply
to API requests. The MCP Gateway, AI Gateway, and developer portal are included
in every plan.

## Next steps

- [Get an MCP Demo](/schedule-call) — walkthrough of the OpenAPI → MCP → OAuth →
  billing loop on your own API
- [Start for free](https://portal.zuplo.com/signup) — build on the free tier
  today
- [MCP Server feature overview](/features/mcp-servers)
- [MCP Gateway](/mcp-gateway)