Zuplo

Zuplo's API gateway helps you ship APIs you're proud of from day 1.

🌐

[Zuplo @Zuplo]

We're running a survey on MCP adoption and would love your input. Takes ~5 minutes, and we'll share the full results with all respondents.

https://t.co/wkv66BmWpb

Whether you're building servers, integrating MCP, or just exploring it, your perspective matters.

@MCP_Community

[Zuplo @Zuplo]

A token minted for one MCP server should be worthless at the next. Usually it isn't.

Two servers behind one identity provider. A token for one is accepted by the other: the signature checks out, nobody reads the aud claim.

Bind it to one server: https://t.co/VTvFlwUojJ

[Zuplo @Zuplo]

A developer's editor config has a GitHub PAT, a Stripe key, and a Notion secret. Plaintext, broad scope, and nobody on security knows they exist.

That's shadow MCP. Don't ban it. Put it behind an MCP gateway:

https://t.co/otUAZLeygR

[Zuplo @Zuplo]

One agent. Four requesters. Eight people's files. Under a minute.

RBAC can't express "this agent, for Alice, may read document 42." Agent authorization has to be per-resource.

https://t.co/NF9vsEk6wy

[Zuplo @Zuplo]

MCP gateways went from concept to 10-vendor category in a year. PANW just acquired Portkey. Anthropic made the containment case without ever saying "gateway." Full week of deep dives on the Zuplo blog:

https://t.co/RhihAG9qO4

[Zuplo @Zuplo]

To celebrate the launch of Zuplo's MCP Gateway, we sat down with Alex Nahas, inventor of WebMCP and collaborator on the Gateway, for a whiteboard breakdown of what WebMCP actually is.

Watch it in full: https://t.co/c48w4DTHkK

[Zuplo @Zuplo]

Anthropic found users approve 93% of agent permission prompts. Rubber-stamping starts within weeks. Their fix: a deterministic boundary that cut prompts 84%. Sounds a lot like the functionality you'd get from an MCP Gateway 😉 .

https://t.co/bmVcIAAqyj

[Zuplo @Zuplo]

Zuplo's MCP Gateway launched this week! It makes it easy to add your own IdP in front of the MCP servers you and your team use daily.

You can also curate those tools, downstream from the official MCP server and reduce the risk surface area, or save on context by stripping out tools you don't use: https://t.co/v2xh3kvqur

[Zuplo @Zuplo]

@tinkerlog We very much enjoy helping people not have that feeling!

[Zuplo @Zuplo]

Launching the MCP Gateway. Public beta, open today.

One gateway in front of every MCP server your agents touch, yours and third-party.

✅ Full OAuth 2.0, spec-compliant
✅ Expose only the tools you pick
✅ Analytics on every call

Get started for free: https://t.co/RhihAG9qO4

[Zuplo @Zuplo]

Your agent needs API keys from fifteen services. Every one requires a human to sign up first.

auth.md standardises how agents register for credentials on a user's behalf: https://t.co/SiEzhysiSg

[Zuplo @Zuplo]

Your agent needs three APIs to finish one task. It can't sign up for any of them without you manually creating a key for it to use.

auth.md standardises how agents register for API credentials on your behalf:

https://t.co/SiEzhysiSg

[Zuplo @Zuplo]

Arazzo 1.0 only understood OpenAPI. If your workflow crossed into event-driven territory, the spec couldn't follow.

1.1 adds AsyncAPI as a first-class source, workflow chaining, and a Selector Object for pulling values from responses.

https://t.co/8wfmkHgoEs

[Zuplo @Zuplo]

The Zuplo MCP server is live.

Add it to Claude Code, Cursor, or any MCP client and your agent can drive your gateway: projects, deployments, keys, domains, logs, config.

Pair with our Agent Skills for maximum effect.

https://t.co/JBN98DqNMa

[Zuplo @Zuplo]

Your error rate spikes at 3am and your dashboard can't tell you it's Claude Code hammering an endpoint.

Zuplo Analytics now breaks out AI agent traffic by agent, error rate, and latency:

https://t.co/v4MnYKgOFB

[Zuplo @Zuplo]

You connect Claude to GitHub's MCP server and hit a 403 two minutes later. 5,000 req/hour, gone.

Most public MCP servers have no limit, the wrong limit, or one so tight it breaks the protocol handshake.

https://t.co/F53AGhGvBM

[Zuplo @Zuplo]

Instructure had to rotate every API key across 7,000 schools at once after the Canvas breach. That plus token-based LLM rate limiting, why IP rate limits punish the wrong people, and more on the Zuplo blog this week.

https://t.co/bWzpXknWlI

[Zuplo @Zuplo]

Your customer has no idea how close they are to the rate limit until a 429 hits. Wire rate limits, billing, and keys into a developer portal so they never have to guess:

https://t.co/R0nalFH9uX

[Zuplo @Zuplo]

Your customer hits 80% of their API quota and the gateway counted the request that tipped it. Fire the warning email right there. One fetch call, no queue, no worker.

https://t.co/SnQiyRUULI

[Zuplo @Zuplo]

A new user signs into your developer portal, opens the API playground, and there's no API key. Yet more clicks before "Hello, World."

Fortunately, most auth providers expose a hook that you can use to auto-provision an API key for new developers by the time the portal loads.

In our final #APIKeyWeek tutorial, we walk through creating this seamless first API call experience using Auth0 and the Zuplo Developer Portal: https://t.co/FNSxB7ceGo

[Zuplo @Zuplo]

Your API needs to accept JWTs from logged-in users and API keys from services. Same endpoint, two credential types.

Zuplo handles it with built-in policies that you chain together, check out how it works: https://t.co/iogdpIwEfi