---
title: "The Unified Gateway for APIs, AI, and MCP"
description:
  "Secure, govern, and observe every API, LLM, and MCP call on one programmable
  policy engine. AI Gateway, MCP Gateway, MCP Server, and API management — fully
  managed, live in minutes."
canonicalUrl: "https://zuplo.com/"
sourceUrl: "https://zuplo.com/"
pageType: "homepage"
generatedAt: "2026-08-27"
---

# Secure, govern, and observe every API, LLM, and MCP call.

> Zuplo is the unified gateway for APIs and AI — one programmable policy engine
> for the models your apps call and the agents that call you. Live in minutes,
> spend under control, every agent call accounted for.

[Meet the MCP Gateway →](https://zuplo.com/blog/introducing-zuplo-mcp-gateway.md?utm_campaign=mcp-gateway&utm_source=zuplo_home&utm_content=homepage_pill)

**Live in minutes · 99.99% uptime SLA · 1B+ end users · SOC 2 Type II**

[Start for Free](https://portal.zuplo.com/signup) ·
[Book a Demo](/schedule-call)

**Customers:** [AccuWeather](/customers/accuweather) ·
[Blockdaemon](/customers/blockdaemon) ·
[Lake Michigan Credit Union](/customers/lake-michigan-credit-union) ·
[Finsolutia](/customers/finsolutia) · VNDR · [Mews](/customers/mews) ·
[Yext](/customers/yext) · [Zumiez](/customers/zumiez)

## The shift: your API has two new kinds of traffic

Your applications call models, and AI agents call you. Both are API traffic —
and both belong behind one gateway.

- **Outbound — Your product calls LLMs.** Every AI feature you ship adds model
  calls to your traffic — and to your bill. Those calls need routing, spend
  caps, and guardrails, the same way any critical dependency does.
- **Inbound — AI agents call your API.** MCP made every agent an API consumer.
  Agents need identity, scoped access, quotas, and docs — real consumers to
  serve well, not just load to absorb.
- **Both directions — One gateway in the middle.** Auth, rate limits, spend
  caps, and audit — written once on one programmable policy engine and enforced
  on every API, LLM, and MCP call, in both directions.

## The platform: one policy engine, four capabilities

Zuplo is the unified gateway for APIs, AI, and MCP. Auth, rate limits, spend
caps, and audit run on one programmable policy engine — turn on the surfaces you
need without adding a vendor.

An interactive hub diagram on the page shows Zuplo's policy engine at the
center, connected to four kinds of traffic: Users, Agents, APIs & MCPs, and
LLMs. Below it, four capability tiles mirror the core product menu:

- **[AI Gateway](/ai-gateway)** — Route LLM traffic, cap spend per team
- **[MCP Gateway](/mcp-gateway)** — Ship MCP to customers; govern the MCP your
  teams use
- **[MCP Server](/features/mcp-servers)** — Your OpenAPI, as MCP tools
- **[API Management](/api-management)** — Portal, keys, rate limits, GitOps

Every call is authenticated as a verified identity — API keys, your IdP, or
OAuth tokens the gateway issues itself.

## See every agent, every call, every token

Claude, Cursor, Codex, and ChatGPT already connect through Zuplo. An interactive
explorer on the page tabs through six views of what one gateway shows you:

- **Agents** — "Every MCP tool call, attributed to an agent." Each session
  authenticates with OAuth 2.1 and PKCE; every tool call is logged with the
  client, the user behind it, and the policy applied (scopes, rate limits,
  metering). Agents shown connecting through Zuplo gateways: Claude, Cursor,
  Codex, ChatGPT.
- **Cut costs** — "Dynamic rate limiting stops origin cost spikes." A traffic
  surge sends unmetered origin spend through the roof; Zuplo caps it
  automatically before the bill lands. Example: $42.9k saved over 14 days, 41%
  lower total spend, comparing origin spend with and without Zuplo's rate
  limiting.
- **AI budgets** — "Every token, attributed to a team — under one budget."
  Per-team LLM spend (Engineering, Support, Data, Product) tracked against a
  shared budget ceiling that triggers a hard 429 so a runaway agent can't blow
  the budget.
- **Security** — "Bad traffic stops at the gateway." Example: 12.4k requests
  blocked this week, 0 reached origin — broken down by auth failures (5.2k, 42%
  share), rate limit exceeded, invalid schema, and prompt injection. Auth,
  schema validation, rate limits, and prompt-injection defense apply the same
  policies to every API, model, and MCP server.
- **Visibility** — "Understand what every agent is doing." Per-user and
  per-client attribution (Claude, Cursor, Codex, ChatGPT) shows which agents
  call which tools, where denials cluster, and how latency trends — example
  dashboard shows 142ms p95 latency and 96.4% success rate — exportable to
  Datadog or your SIEM.
- **Monetization** — "API traffic, metered and billed." Example: $30k metered
  revenue in June, up 12% month over month across plan tiers (Enterprise, Pro) —
  plans, quotas, and usage-based billing wired to Stripe with no billing
  infrastructure to build.

Receipts:

- MCP spec 2025-11-25 at GA — OAuth 2.1, PKCE, DCR + CIMD
- 1B+ end users via AccuWeather
- 300+ edge locations, ~20s deploys

## Both directions, in code

The models your apps call and the agents that call you — a base-URL swap on one
side, an OpenAPI extension on the other.

**Outbound — your app calls LLMs.** Keep the OpenAI SDK and point it at your
gateway. Provider routing, spend caps, and guardrails apply to every call.

```typescript
// Keep your existing OpenAI SDK — just swap the base URL
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://your-org.zuplo.app/v1",
  apiKey: process.env.ZUPLO_AI_KEY, // your Zuplo key, not OpenAI's
});

const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Summarize our Q1 sales data." }],
});
```

[Explore the AI Gateway →](/ai-gateway)

**Inbound — agents call your API.** Mark OpenAPI operations as MCP tools.
Deploy, and agents connect at `/mcp` — through the same policies as the rest of
your API.

```json
{
  "paths": {
    "/orders/{id}": {
      "get": {
        "operationId": "getOrder",
        "summary": "Fetch order by ID",
        "x-zuplo-route": {
          "mcp": { "type": "resource" }
        }
      }
    },
    "/tickets": {
      "post": {
        "operationId": "createTicket",
        "summary": "Open a support ticket",
        "x-zuplo-route": {
          "mcp": { "type": "tool" }
        }
      }
    }
  }
}
```

[Explore MCP Server →](/features/mcp-servers)

Same gateway. Same policies. Both directions.

## The bottom line: value you can measure in the first month

Lower cost, a smaller attack surface, faster resolution, and new revenue — real
results, not a feature checklist.

- **Cut runaway cost** — Dynamic rate limiting absorbs traffic spikes before
  they hit your origin; token budgets stop AI overspend with a hard cap, not a
  surprise overage.
- **Shrink the attack surface** — Auth, schema validation, and bot controls
  reject bad traffic before it reaches your systems — the same policies across
  every API, model, and MCP server.
- **Prove what's happening** — Every API, LLM, and MCP call is logged and
  attributed to a consumer, then exported to the SIEM you already run.
- **Turn traffic into revenue** — Meter, price, and bill APIs and AI by request,
  token, or any unit that costs you — with no billing infrastructure to build.
- **Resolve issues faster** — Request-level tracing pinpoints the slow hop from
  client to origin, so problems get fixed before they become escalations.
- **Govern AI for the CISO** — Scoped access, audit logs, secret masking, and
  prompt-injection defense — the answers security teams actually ask for.

## Teams ship real results on Zuplo

**Blockdaemon:** 90% hardware footprint reduction at scale.

> The move to Zuplo from our existing API Management vendor was easy, taking
> just over 2 months to switch mission critical systems, and we're saving over
> 70% on costs.
>
> — Ryan Waites, Senior Director, Blockdaemon ·
> [Case study](/customers/blockdaemon)

> Zuplo gives us the flexibility to scale efficiently, ensures security and
> compliance, and reduces operational complexity so we can focus on building new
> capabilities.
>
> — Daryl Benzel, Staff Software Engineer, Yext · [Case study](/customers/yext)

**AccuWeather:** 1B+ end users served via Zuplo APIs.
[Case study](/customers/accuweather)

**Finsolutia:** Hours to launch MCP server on regulated APIs.

> We didn't touch a line of code, it's just plug and play. The results were very
> surprising, in just a couple of hours we had a fully working MCP Server.
>
> — Miguel Madeira, CTO & Co-Founder, Finsolutia ·
> [Case study](/customers/finsolutia)

## FAQ

**What is a unified gateway?** A unified gateway puts every kind of traffic your
business runs — API requests from users, LLM calls from your own applications,
and MCP tool calls from AI agents — behind one programmable policy engine.
Authentication, rate limiting, spend caps, and audit logging are written once
and enforced on every API, LLM, and MCP call, instead of being split across an
API gateway, an LLM proxy, and an MCP experiment on the side.

**What's the difference between an AI gateway and an API gateway?** An API
gateway sits in front of the APIs you serve — handling authentication, rate
limits, and routing for the requests coming in. An AI gateway sits in front of
the LLM providers your applications call — routing traffic across models,
capping spend per team, and applying guardrails to the requests going out. With
Zuplo both run on the same policy engine, so the rules that protect your APIs
also govern your AI traffic.

**What is an MCP gateway?** An MCP gateway is the control point between AI
agents and MCP servers. It authenticates agents with OAuth, controls which tools
each user can see and invoke, brokers credentials to upstream servers, and logs
every tool call. Zuplo's MCP Gateway includes a spec-compliant OAuth
authorization server — Dynamic Client Registration, PKCE, implementing MCP spec
revision 2025-11-25 — so you can ship MCP to customers and govern the MCP your
teams use from the same gateway.

**Can Zuplo replace my existing gateway?** Yes — and you don't have to do it in
one cutover. Teams have moved off Apigee, Kong, and Azure API Management;
Blockdaemon switched mission-critical systems off Apigee in just over two months
and cut gateway costs by 70%. Zuplo also works alongside the gateway you already
run, so most teams start with the new traffic — routing LLM calls through the AI
Gateway or publishing an MCP server in front of an existing API — and
consolidate the rest onto one policy engine route by route, on their own
schedule.

**What's included in every Zuplo plan?** The MCP Gateway, AI Gateway, and
Developer Portal are included in every plan alongside the core API gateway. The
Free plan comes with 100K requests and 1K MCP tool calls per month, no credit
card required — enough to put a real API, an LLM route, and an MCP server into
production before you pay anything.

## Next steps

- [Start for free](https://portal.zuplo.com/signup) — 100K requests/month, no
  credit card, no sales call
- [Book a demo](/schedule-call)
- [Explore the AI Gateway](/ai-gateway)
- [Explore the MCP Gateway](/mcp-gateway)
- [Explore MCP Server](/features/mcp-servers)
- [Explore API Management](/api-management)
- [Read customer stories](/customers)