This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Zuplo is an API gateway company. Its MCP Server handler turns routes in your OpenAPI file into MCP tools. Its MCP Gateway puts one OAuth-protected endpoint in front of other MCP servers.
Checked against: Zuplo's MCP Server documentation on 28 October 2026. eSEOspace did not test Zuplo's products.
Key Takeaways
- Zuplo's MCP Server handler exposes API operations from your OpenAPI definitions as MCP tools, prompts and resources.
- Every MCP call still runs through the route's gateway policies, such as authentication and rate limits.
- The MCP Gateway federates remote MCP servers behind one URL with a built-in OAuth server.
- Zuplo says MCP Gateway is included on every plan, from Free up to Enterprise.
- Zuplo runs as a managed edge service, a dedicated deployment or self-hosted.
At a glance
| Item | Details |
|---|---|
| Company | Zuplo |
| What it offers for MCP | MCP Server handler (OpenAPI to MCP), MCP Gateway, custom tools |
| Who it's for | API teams that want to ship MCP to customers; IT teams governing employee MCP use |
| Open source? | Not stated on the pages we checked |
| Pricing | Free $0; Builder $25/mo; Enterprise from $1,000/mo (annual) |
What Zuplo offers for MCP
MCP Server handler
Zuplo's MCP Server docs say the handler "exposes your API routes to AI clients through the Model Context Protocol." It reads your OpenAPI definitions to describe each operation.
You choose which operations become:
- Tools, which call an API operation to fetch data or take an action.
- Prompts, which are reusable templates with parameters.
- Resources, which are read-only data at a resource URI.
For workflows that span several calls, Zuplo supports custom tools. The handler calls the configured route "including that route's policies." So the authentication, rate limiting and logging you already set up still apply.
MCP Gateway
The MCP Gateway docs describe a single OAuth-protected endpoint in front of one or more remote MCP servers. Users sign in once through your identity provider. The gateway then "mints an independent upstream credential" for each server, so raw tokens never reach the AI client.
The docs list five jobs the gateway handles: discovery, authentication, authorization, observability and guardrails. Guardrails include PII redaction and prompt injection detection policies.
Zuplo's gateway page adds "virtual MCP servers," which curate the tools each upstream exposes. It can also "auto-generate a dynamic MCP server from any OpenAPI definition." For per-user rules, it supports OpenFGA, AuthZEN and Okta FGA, or rules written in TypeScript.
Who it's for
Zuplo's gateway page names two uses. API companies can "ship MCP to customer agents" with real sign-in and an audit trail. Internal IT teams can put Linear, GitHub and internal servers "behind one URL."
It fits best if you already run, or plan to run, your API through Zuplo. For the bigger picture on gateways, read MCP gateways explained.
Pricing
Zuplo's pricing page says "MCP Gateway, AI Gateway, and the developer portal are included in every plan." Plans as of October 2026:
| Plan | Price | Notes |
|---|---|---|
| Free | $0 | 100K requests a month, 1 day of analytics and logs, up to 2 developer seats |
| Builder | $25/mo | 100K requests included, then $100 per 100K; "not for teams" |
| Enterprise | From $1,000/mo, annual contract | Custom volume with discounts; SSO and RBAC marked "enterprise"; SLA up to 99.999% |
The comparison table also lists separate limits for MCP users, upstream MCP servers and monthly tool invocations. Check those rows for your tier before you roll out.
Security and trust
The MCP Server docs advise exposing "only the operations your clients need." They also warn that each exposed operation is still a normal REST route. To serve it only through MCP, add the Internal Only policy with "status": 404.
Zuplo's gateway page says "a token for one MCP server is rejected at every other." The pricing table lists "SOC 2 Type 2 Compliance" and a Business Associate Agreement (BAA) as add-ons. Ask Zuplo what each tier includes. Our MCP security hub covers what to check.
Alternatives
- Apollo GraphQL turns GraphQL operations into MCP tools.
- Cequence converts OpenAPI specs into MCP tools inside a security gateway.
- Speakeasy generates MCP servers from OpenAPI and sells an MCP gateway.
For more options, see our MCP gateways roundup or all MCP company spotlights.
Next step
Before you switch an API to MCP, decide which operations agents should see and which must stay hidden. Our MCP development team can help design that tool list.
Frequently asked questions
Do I need to write code to expose my API over MCP with Zuplo?
Not for basic tools. The MCP Server handler reads your OpenAPI definitions. Custom tools are available for multi-step workflows.
Is the MCP Gateway a paid add-on?
No. Zuplo's pricing page says MCP Gateway is included on every plan. Usage limits differ by tier.
Can Zuplo host the gateway in my own cloud?
Zuplo's docs list three hosting options: Managed Edge, Managed Dedicated and Self-Hosted. Ask Zuplo which plans include the dedicated and self-hosted options.
Can clients call my API directly, bypassing MCP?
Yes, unless you block it. The docs recommend the Internal Only policy on routes that should only be reached through the MCP server.
