---
title: "The Unified Gateway for APIs, AI, and MCP"
description:
  "Secure, govern, and observe every API, LLM, and MCP call on one programmable policy engine. AI Gateway, MCP Gateway, MCP Server, and API management — fully managed, live in minutes."
canonicalUrl: "https://zuplo.com/"
sourceUrl: "https://zuplo.com/"
pageType: "homepage"
generatedAt: "2026-10-21"
---

# Secure, govern, and observe every API, LLM, and MCP call.

> Zuplo is the unified gateway for APIs and AI — one programmable policy engine for the models your apps call and the agents that call you. Live in minutes, spend under control, every agent call accounted for.

Announcement: [Meet the MCP Gateway](https://zuplo.com/blog/introducing-zuplo-mcp-gateway.md).

Highlights: Live in minutes · 99.99% uptime SLA · 1B+ end users · SOC 2 Type II

Customer stories: [AccuWeather](/customers/accuweather), [Blockdaemon](/customers/blockdaemon), [Lake Michigan Credit Union](/customers/lake-michigan-credit-union), [Finsolutia](/customers/finsolutia), [Mews](/customers/mews), [Yext](/customers/yext), [Zumiez](/customers/zumiez).

## Your API has two new kinds of traffic

Your applications call models, and AI agents call you. Both are API traffic — and both belong behind one gateway.

- **Outbound — Your product calls LLMs.** Every AI feature you ship adds model calls to your traffic — and to your bill. Those calls need routing, spend caps, and guardrails, the same way any critical dependency does.
- **Inbound — AI agents call your API.** MCP made every agent an API consumer. Agents need identity, scoped access, quotas, and docs — real consumers to serve well, not just load to absorb.
- **Both directions — One gateway in the middle.** Auth, rate limits, spend caps, and audit — written once on one programmable policy engine and enforced on every API, LLM, and MCP call, in both directions.

## One policy engine. Four capabilities.

Zuplo is the unified gateway for APIs, AI, and MCP. Auth, rate limits, spend caps, and audit run on one programmable policy engine — turn on the surfaces you need without adding a vendor.

- **Agents** — Scoped, audited access for AI agents via MCP. ([Learn more](https://zuplo.com/docs/mcp-gateway/introduction))
- **Users** — API keys, JWT & OAuth with per-key rate limits. ([Learn more](https://zuplo.com/docs/articles/api-key-authentication))
- **APIs & MCPs** — REST, GraphQL & MCP servers behind one gateway. ([Learn more](https://zuplo.com/docs/mcp-server/introduction))
- **LLMs** — Route providers with budgets, caching & guardrails. ([Learn more](https://zuplo.com/docs/ai-gateway/introduction))

Products:

- [AI Gateway](/ai-gateway) — Route LLM traffic, cap spend per team
- [MCP Gateway](/mcp-gateway) — Ship MCP to customers; govern the MCP your teams use
- [MCP Server](/features/mcp-servers) — Your OpenAPI, as MCP tools
- [API Management](/api-management) — Portal, keys, rate limits, GitOps

Every call is authenticated as a verified identity — API keys, your IdP, or OAuth tokens the gateway issues itself.

## See every agent, every call, every token

Claude, Cursor, Codex, and ChatGPT already connect through Zuplo. Explore what one gateway shows you — costs, budgets, security, and every tool call attributed.

- **Agent traffic — Every MCP tool call, attributed to an agent.** Each session authenticates with OAuth 2.1 and PKCE, and each tool call is logged with the client, the user behind it, and the policy the gateway applied — scopes, rate limits, metering.
- **Cost control — Dynamic rate limiting stops origin cost spikes.** A traffic surge sends unmetered origin spend through the roof. Zuplo caps it automatically — before the bill lands. ($42.9k saved over 14 days; 41% lower total spend.)
- **AI spend visibility — Every token, attributed to a team — under one budget.** See which workload drives LLM cost. Zuplo caps spend per team and halts requests at the ceiling, so a runaway agent can't blow the budget.
- **Security & governance — Bad traffic stops at the gateway.** Auth, schema validation, rate limits, and prompt-injection defense reject abuse before it reaches your systems — the same policies for every API, model, and MCP server. (12.4k requests blocked this week, 0 reached your origin: auth failures 5.2k, rate limit exceeded 4.1k, invalid schema 2.3k, prompt injection 800.)
- **Visibility — Understand what every agent is doing.** Per-user and per-client attribution turns raw MCP traffic into answers: which agents call which tools, where denials cluster, and how latency trends. Explore it in real-time dashboards — or export everything to Datadog or your SIEM.
- **Monetization — API traffic, metered and billed.** Plans, quotas, and usage-based billing built into the gateway — wired to Stripe, with no billing infrastructure to build. ($30k metered revenue in June, +12% month over month.)

Proof points: MCP spec 2025-11-25 at GA — OAuth 2.1, PKCE, DCR + CIMD · 1B+ end users via AccuWeather · 300+ edge locations, ~20s deploys

## Both directions, in code

The models your apps call and the agents that call you — a base-URL swap on one side, an OpenAPI extension on the other.

### Outbound — your app calls LLMs

Keep the OpenAI SDK and point it at your gateway. Provider routing, spend caps, and guardrails apply to every call.

```ts
// Keep your existing OpenAI SDK — just swap the base URL
import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://your-org.zuplo.app/v1",
  apiKey: process.env.ZUPLO_AI_KEY, // your Zuplo key, not OpenAI's
});

const response = await client.chat.completions.create({
  model: "gpt-4o",
  messages: [{ role: "user", content: "Summarize our Q1 sales data." }],
});
```

[Explore the AI Gateway](/ai-gateway)

### Inbound — agents call your API

Mark OpenAPI operations as MCP tools. Deploy, and agents connect at `/mcp` — through the same policies as the rest of your API.

```json
{
  "paths": {
    "/orders/{id}": {
      "get": {
        "operationId": "getOrder",
        "summary": "Fetch order by ID",
        "x-zuplo-route": {
          "mcp": { "type": "resource" }
        }
      }
    },
    "/tickets": {
      "post": {
        "operationId": "createTicket",
        "summary": "Open a support ticket",
        "x-zuplo-route": {
          "mcp": { "type": "tool" }
        }
      }
    }
  }
}
```

[Explore MCP Server](/features/mcp-servers)

Same gateway. Same policies. Both directions.

## Value you can measure in the first month

Lower cost, a smaller attack surface, faster resolution, and new revenue — real results, not a feature checklist.

- **Cut runaway cost** — Dynamic rate limiting absorbs traffic spikes before they hit your origin; token budgets stop AI overspend with a hard cap, not a surprise overage.
- **Shrink the attack surface** — Auth, schema validation, and bot controls reject bad traffic before it reaches your systems — the same policies across every API, model, and MCP server.
- **Prove what's happening** — Every API, LLM, and MCP call is logged and attributed to a consumer, then exported to the SIEM you already run.
- **Turn traffic into revenue** — Meter, price, and bill APIs and AI by request, token, or any unit that costs you — with no billing infrastructure to build.
- **Resolve issues faster** — Request-level tracing pinpoints the slow hop from client to origin, so problems get fixed before they become escalations.
- **Govern AI for the CISO** — Scoped access, audit logs, secret masking, and prompt-injection defense — the answers security teams actually ask for.

## Teams ship real results on Zuplo

- **90%** hardware footprint reduction at scale ([Blockdaemon](/customers/blockdaemon))
- **1B+** end users served via Zuplo APIs ([AccuWeather](/customers/accuweather))
- **Hours** to launch an MCP server on regulated APIs ([Finsolutia](/customers/finsolutia))

> The move to Zuplo from our existing API Management vendor was easy, taking just over 2 months to switch mission critical systems, and we're saving over 70% on costs.
>
> — Ryan Waites, Senior Director, Blockdaemon ([case study](/customers/blockdaemon))

> Zuplo gives us the flexibility to scale efficiently, ensures security and compliance, and reduces operational complexity so we can focus on building new capabilities.
>
> — Daryl Benzel, Staff Software Engineer, Yext ([case study](/customers/yext))

> We didn't touch a line of code, it's just plug and play. The results were very surprising, in just a couple of hours we had a fully working MCP Server.
>
> — Miguel Madeira, CTO & Co-Founder, Finsolutia ([case study](/customers/finsolutia))

## Frequently Asked Questions

Straight answers on unified gateways, AI gateways, and MCP — and what's included in every plan.

### What is a unified gateway?

A unified gateway puts every kind of traffic your business runs — API requests from users, LLM calls from your own applications, and MCP tool calls from AI agents — behind one programmable policy engine. Authentication, rate limiting, spend caps, and audit logging are written once and enforced on every API, LLM, and MCP call, instead of being split across an API gateway, an LLM proxy, and an MCP experiment on the side.

### What's the difference between an AI gateway and an API gateway?

An API gateway sits in front of the APIs you serve — handling authentication, rate limits, and routing for the requests coming in. An AI gateway sits in front of the LLM providers your applications call — routing traffic across models, capping spend per team, and applying guardrails to the requests going out. With Zuplo both run on the same policy engine, so the rules that protect your APIs also govern your AI traffic.

### What is an MCP gateway?

An MCP gateway is the control point between AI agents and MCP servers. It authenticates agents with OAuth, controls which tools each user can see and invoke, brokers credentials to upstream servers, and logs every tool call. Zuplo's MCP Gateway includes a spec-compliant OAuth authorization server — Dynamic Client Registration, PKCE, implementing MCP spec revision 2025-11-25 — so you can ship MCP to customers and govern the MCP your teams use from the same gateway.

### Can Zuplo replace my existing gateway?

Yes — and you don't have to do it in one cutover. Teams have moved off Apigee, Kong, and Azure API Management; Blockdaemon switched mission-critical systems off Apigee in just over two months and cut gateway costs by 70%. Zuplo also works alongside the gateway you already run, so most teams start with the new traffic — routing LLM calls through the AI Gateway or publishing an MCP server in front of an existing API — and consolidate the rest onto one policy engine route by route, on their own schedule.

### What's included in every Zuplo plan?

The MCP Gateway, AI Gateway, and Developer Portal are included in every plan alongside the core API gateway. The Free plan comes with 100K requests and 1K MCP tool calls per month, no credit card required — enough to put a real API, an LLM route, and an MCP server into production before you pay anything.

## Next steps

One gateway for every API, LLM, and MCP call. Live in minutes. Free tier includes 100K requests/month. No credit card. No sales call.

- [Start for Free](https://portal.zuplo.com/signup)
- [Book a Demo](/schedule-call) / talk to an API expert
- [Pricing](/pricing)