Evlio | Discover, govern, and expose your APIs to developers and AI agents

API
management,
rebuilt
for
the
agentic
era
Evlio discovers every API in your code, governs what each audience can access, and exposes it to developers and AI agents. Catalog, contracts, testing, and hosted MCP servers in one pipeline. No spec required.
Book a meeting
Sign up free
Free tier · No credit card · No OpenAPI spec needed
evlio sync acme/payments-api
live
❯
npx evlio sync acme/payments-api
▸
Scanning repo
..................
1,204 files
▸
Endpoints discovered
...........
214
▸
Generating OpenAPI 3.1 specs
...
done
▸
Building catalog
payments
38 endpoints
A · 92%
identity
24 endpoints
B · 84%
billing
17 endpoints
D · 61%
← weakest, fix first
▸
Flagging issues
⚠
2 breaking changes
DELETE /builds/{id}
⚠
4 endpoints missing auth
billing/*
⚠
12 untyped fields
legacy schemas
▸
Improving with AI agent
✓
31 descriptions written
✓
12 schemas typed
✓
auth documented
billing/*
billing rescored
D · 61%
→
B · 83%
agent-ready ↑
▸
Deploying MCP server
...........
live
✓
mcp.evlio.xyz/acme-payments
· 23 tools · OAuth2 · done in 42s
❯
From top startups to Fortune 500 companies, trusting Evlio
01 · DISCOVER
Automatic API discovery
Turn any repo into a complete API catalog, even without specs
done
Connect the repo
git · 1,204 files scanned
done
Specs generated
OpenAPI 3.1 · 214 endpoints
done
Scored & flagged
agent-ready 73% · 2 breaking
live
MCP server live
hosted · auth · logging
agent-ready in 42s · rescan armed on every commit
42.0s
214
ENDPOINTS DISCOVERED
89%
AUTH COVERAGE
23
TOOLS EXPOSED
73%
AGENT-READY
02 · UNDERSTAND
API scoring and insights
Know how agent-ready your APIs really are
Every endpoint scored on design, security, and AI readiness. One-click AI fixes. Test the traditional way too.
Your API results by category
Scores per 12 API collections
100%
75%
50%
25%
0
Design
92%
Developer experience
84%
AI readiness
71%
Security
64%
Performance
59%
BEFORE
C · 71%
AI readiness · payments-api
!
31 endpoints missing descriptions
!
12 untyped response fields
!
4 endpoints with undocumented auth
Fix all with AI
AFTER
B · 89%
Rescored in 42 seconds
✓
31 descriptions written from code
✓
12 response schemas typed
✓
auth documented on billing routes
API contracts
Only in Evlio
API contracts decide what ships
Pick the audience, the endpoints, the fields they get, and where it ships. Evlio then diffs every commit against that promise and tells you the moment the source drifts away from it.
Build the contract once.
Evlio keeps five outputs and every consumer in sync with it.
Create API contract
1
Define
2
Compose
3
Schema
4
Publishing
5
Live
01
STEP 1 · WHO IS THIS CONTRACT FOR?
Partner Integration
External company consuming your API. Strict versioning, approval before publish.
Partner visibility · Requires approval
Internal Service
Another team or microservice. Lighter governance, faster iteration.
Internal visibility · No approval
Public API
Open to any developer. Rate limits, sandbox, full documentation.
Public visibility · Full publishing
AI Agent / MCP
Agents consuming via MCP tools. Rich descriptions, stable schemas.
MCP server + spec · Requires approval
all repos · all tags
Payments API
38 endpoints
payments
partner
GET
/v2/payments/{id}
POST
/v2/payments/refund
GET
/v2/payments/methods
DELETE
/v2/payments/{id}/void
Identity & Auth
24 endpoints
2 collections · 32 endpoints selected
Include all
Required only
Exclude PII
Exclude internal
GET
· 14 of 18 fields exposed
id
String
Payment identifier
amount
Integer
Amount in minor units
customer_email
PII
String
Customer's email address
internal_notes
Internal
String
Ops annotations, never external
49 of 58 fields exposed
18 PII fields excluded
one contract, five outputs
OpenAPI spec file
Hosted JSON/YAML, the canonical contract
Evlio docs
Publish to your documentation portal
MCP server
Auto-generated tools, contract endpoints only
Postman collection
Import-ready, with environments and auth
TS
TypeScript SDK
Type-safe npm package
Payments × Partner
v1.0.0
Source drift detected
PUBLISHED TO
OpenAPI spec
v1.0.0
Evlio docs
v1.0.0
MCP server
14 tools
Postman collection
v1.0.0
TypeScript SDK
v1.0.0
SOURCE COLLECTIONS
Payments API
31 endpoints in contract
Synced
Identity & Auth
9 endpoints in contract
Synced
All endpoints exist in sources
Contract schemas valid
Approver assigned
No breaking changes
Someone shipped
5
changes today.
Two
would have broken a partner. Evlio stopped them.
payouts-partner · v1.4
DELETE
/builds/{id}
BREAKING
Response field removed from schema
+
2
−
9
a91f2c4
2h
SCHEMA DIFF
openapi.yaml · Build
Build:
properties:
id: { type: string }
status: { type: string }
-
buildLog:
-
type: string
-
description: Full build output
+
logUrl:
+
type: string, format: uri
IMPACT
!
Consumers reading buildLog
2 services
!
Partner builds affected
1 partner
~
MCP tools referencing field
1 tool
Publish blocked by policy
Review
GET
/billing/plans
BREAKING
Auth scope tightened on billing routes
+
3
−
1
7e15b02
4h
SCHEMA DIFF
openapi.yaml · security
security:
-
- bearerAuth: []
+
- oauth2:
+
- read:billing
+
- read:plans
IMPACT
!
Keys missing read:billing
3 keys
~
Acknowledgements pending
2 of 4
✓
Grace period set
14 days
Awaiting 2 acks
Remind
Click any change to see the exact schema diff and who it breaks.
How contracts work →
04 · PUBLISH
MCP server generation and hosting
Run your MCP servers like real infrastructure
Generate an MCP server from any API. Hosted, authed through Evlio's MCP gateway, fully logged. Not weekend demos.
Claude Desktop
129 calls today
Cursor IDE
89 calls today
ChatGPT
34 calls today
MCP GATEWAY
Claude Desktop
129 calls today
Cursor IDE
89 calls today
ChatGPT
34 calls today
MCP GATEWAY
Claude, Cursor, or any MCP client. The contract decides which tools each audience sees, auth and logging come standard.
Agents install it in one line
$
npx evlio mcp add payments
Copy
Hosted or self-hosted
Per-tool auth scopes
Full call logs
05 · IMPROVE
Playground and agent feedback
Try the MCP Playground, then read the agent feedback
Test the server with a real agent in the Playground. Once it is live, the agents calling it tell you which tools confused them.
MCP Playground
acme-payments v2
·
23
tools
Playground calls do not count against your quota
Test your MCP tools
Ask the agent to do something with your server. It picks the tools and shows you every call it made.
List the tools this server exposes
Show the schema for create_invoice
Run get_payment_status for order 4821
Refund the duplicate charge on order 4821 and confirm it went through.
✓
get_payment_status
{ "orderId": "4821" }
ok · 98ms
✓
list_transactions
{ "orderId": "4821", "limit": 20 }
ok · 172ms
✕
refund_charge
{ "txnId": "txn_9f21" }
denied · missing an output schema
Order 4821 was captured twice for $240.00. The duplicate is txn_9f21. I cannot refund it from this server: refund_charge is held back until its output schema verifies, so the gateway denied the call.
Ask the agent to use your MCP tools…
Claude Sonnet 4.6
Agent feedback
Summarize with AI
Filter by date
3
open ·
1
critical
Claude
Critical
2h ago
The tool description does not clearly explain when it should be used.
GET
/customers/{customerId}
ChatGPT
4h ago
The tool failed to return a response after multiple attempts. I could not complete the request because the MCP server kept timing out.
POST
/orders
Cursor
4h ago
The tool requires too many parameters for a simple request.
GET
/products/{productId}
filed by the agents calling
acme-payments v2
scored into the catalog
The MCP gateway your agents call
Claude, Cursor, and your partners connect to a hosted server with scoped keys. Every call is checked and logged, and your credentials never leave Evlio.
847
agent calls in the last 24 hours.
27
failed. Here is who, with which key, at what cost.
mcp.evlio.xyz/acme-payments
TOTAL REQUESTS
847
↑ 6.7% from yesterday
AVG RESPONSE
138ms
P95 412ms
ERROR RATE
3.2%
27 failed · 847 total
TOKEN USAGE
124k
avg 1,240 per call
AGENT ACTIVITY
Claude Desktop
Last seen 2 min ago
129 calls today
6 tools used
Cursor IDE
Last seen 5 min ago
89 calls today
4 tools used
P
Partner Integration Bot
Last seen 12 min ago
34 calls today
3 tools used
API KEY USAGE · 24H
Production Key
****7f2a
most used:
evlio_get_users
4,120 calls
6 agents
12 errors
Development Key
****3e1b
most used:
evlio_auth_login
204 calls
2 agents
9 errors
CI Pipeline Key
****a4c0
most used:
evlio_get_analytics
861 calls
1 agent
3 errors
Every call logged with agent, key, tool, latency, and outcome. Export to your SIEM.
MCP Management →
Evlio agent
Tell the Evlio agent what to ship
Contract generated, MCP updated, changelog drafted, stakeholders notified.
Hi Natia, I’m Evlio 👋 What would you like to ship today?
Suggestions to get started with:
Ship a new endpoint to partners
Update the MCP server
Other
Ship the /payouts endpoint and tell the partners team.
✓
Contract generated for the partner audience
payouts-partner · v1
✓
Added to the acme-payments MCP server
2 new tools
✓
Changelog drafted for review
1 breaking note
✓
3 stakeholders notified
partners-team@acme.com
Tell Evlio what to ship…
Need some help?
IN PRACTICE
From production
Numbers from teams running Evlio
Three write-ups from real deployments: what governed MCP servers, structured errors, and per-audience contracts change in practice.
489,000
tool calls, zero surprises
Ninety days of one production MCP server serving four agents. Every anomaly attributed to a specific agent and key within minutes.
Read the numbers →
71%
fewer retries in a week
Across 1.2 million tool calls, one vague error message drove a third of retry traffic. Structured errors naming the field fixed it.
Read the numbers →
31
zombie endpoints retired
One team, first quarter on contracts: for the first time they could prove no active consumer referenced the endpoints they deleted.
Read the numbers →
ENTERPRISE
For the security review
Answers the security review before it asks
SOC 2 Type II, ISO 27001 and GDPR on the infrastructure Evlio runs on. SSO and SCIM from the identity provider you already run. Hosted, in your own cloud, or on-prem.
Certified infrastructure
SOC 2 Type II
certified
ISO 27001 / 27701
certified
GDPR
compliant
Full security posture →
Runs where your perimeter ends
Hosted SaaS
Managed upgrades, 99.9% SLA
Private cloud
Your VPC, your KMS keys
On-prem
Air-gapped, no egress
Works with every identity provider
Identity providers were built for people signing in to apps. Evlio extends the one you already run to AI agents, so access follows your existing teams and roles.
Okta
Microsoft Entra ID
Auth0
WorkOS
Google Workspace
Ping Identity
Any SAML / OIDC
SAML 2.0 and OIDC single sign-on, enforced across every workspace
SCIM keeps groups, roles, and deprovisioning in sync
Every agent gets its own identity in the audit trail
See the enterprise platform →
FAQ
What is Evlio?
Evlio is the system that discovers every API in your codebase, understands and scores them, governs what each audience can access, and exposes them to developers, applications, and AI agents through documentation, SDKs, and hosted MCP servers. Evlio sits between your codebase and everything that consumes your APIs. It is built by Evlio and used by teams from startups to Fortune 500 companies.
Is Evlio an API gateway?
No. Evlio sits above your repositories and existing gateways. It discovers, governs, and exposes APIs while your gateway keeps handling runtime traffic. The exception is MCP: Evlio hosts and gates MCP servers itself, with scoped keys, per-tool authorization, and full call logs.
How is Evlio different from Postman?
Postman is where developers work with individual requests. Evlio is the system of record for an organization's entire API estate: what exists, who owns it, what each audience can access, and what agents are calling.
Does Evlio need an OpenAPI spec to start?
No. Evlio derives the catalog from your code by reading route registrations, validators, and serializers, then emits OpenAPI 3.1 as an output. Existing specs are imported and kept in sync with the code on every commit.
How does Evlio work with AI agents?
Evlio generates MCP servers from your API contracts and hosts them behind an auth gateway with scoped keys, per-tool authorization, and full call logs, so Claude, Cursor, ChatGPT, and partner agents can use your APIs safely.
How much does Evlio cost?
The Free plan covers 1 repo and 1,000 tool calls a month, forever. Startup is $100 per month flat, Business is $600 per month billed annually, and Enterprise is custom. Every plan includes unlimited members.
Is Evlio ready for an enterprise security review?
SOC 2 Type II and ISO 27001/27701 are certified and GDPR is covered by a DPA, all held by Evlio and covering the infrastructure Evlio runs on. SSO, SAML, OIDC, and SCIM work with the identity provider you already run, and Evlio deploys as hosted SaaS, in your private cloud, or on-prem.
Who builds Evlio?
Evlio is built by Evlio, the API documentation company whose platform is used by 20,000 companies.
Ship APIs any agent can call
Humans, tests, partners, agents. One catalog, one contract, one place.
$
npx evlio init
Copy
Sign up free
Evlio vs Postman