Zuplo

About Zuplo

Zuplo is an API gateway that unifies management of REST and GraphQL APIs, LLM traffic, and MCP (Model Context Protocol) servers behind a single programmable policy engine. It handles authentication (API keys, JWT, OAuth), rate limiting, spend caps, and audit logging for both outbound traffic (an application's own calls to LLM providers) and inbound traffic (AI agents calling an organization's APIs via MCP). Requests are routed through the gateway with a base-URL swap for existing SDKs, or by marking OpenAPI operations as MCP tools for agent access.

The product includes dedicated capabilities for AI agent governance (scoped, audited access via MCP with OAuth 2.1 and PKCE), user authentication, API and MCP management, and LLM routing with budgets and caching. It provides per-team spend budgets with hard request limits, blocking of bad traffic (auth failures, invalid schema, rate limit violations, prompt injection) at the gateway, and analytics on tool calls, denials, and latency, with export to Datadog or a SIEM. Usage-based billing for APIs and AI is built in, integrated with Stripe.

Zuplo is aimed at engineering and security teams building or operating APIs that are consumed by AI agents (such as Claude, Cursor, Codex, and ChatGPT) or that themselves call LLM providers, including those needing to control AI spend, log and attribute agent activity for compliance, or monetize API and AI usage. The company states SOC 2 Type II compliance, a 99.99% uptime SLA, and support for the MCP spec dated 2025-11-25.

Key features

• Unified API gateway for REST, GraphQL, and MCP servers
• AI Gateway routes LLM provider traffic with per-team spend caps and budgets
• MCP Gateway secures agent access with OAuth 2.1, PKCE, and per-tool audit logging
• Converts OpenAPI operations into MCP tools for agent access
• Auth, schema validation, and rate limiting block bad traffic before it reaches origin servers
• Usage-based billing and metering wired to Stripe

Frequently asked questions