MCP Management

Turn any API into a hosted MCP server your security team will approve

Start from an OpenAPI spec or your source code. Evlio generates curated MCP tools, hosts the server, puts every call behind an authorization gateway and logs who did what. One hosted server and 1,000 tool calls a month on Free. No card.

Deploy your first serverPlatform or security team? Talk to us

Works withClaudeCursorChatGPTWindsurfany MCP client

Free: 1 hosted server · 1,000 tool calls/moSOC 2 Type IIOAuth2 + per-tool scopesFull call logsSSO / SAMLOn-prem available

Claude

Cursor

Partner bot

Authorization gatewaymcp.evlio.xyz/acme-paymentsActive

auth OAuth2scopes per-toolrate 600/minlogs on

✓get_payment_statusClaudescope ok · 98ms

✓create_invoiceCursorscope ok · 145ms

✕delete_accountPartner botdenied · out of scope

Your API · payments-api v2.4.123 tools exposed of 214 endpoints

99.9%UPTIME SLA

138P95 GATEWAY LATENCY (MS)

EveryCALL LOGGED, NO SAMPLING

0UNSCOPED TOOLS ALLOWED

How it works

From an API to a hosted MCP server in three steps

01
Connect a repo or upload an OpenAPI spec
Evlio discovers the endpoints, whether they come from your source code or a spec file.
02
Pick the tools and set scopes per audience
23 tools from 214 endpoints is the right shape, not 214 tools. Each one gets a scope, so a key only reaches what it was granted.
03
Connect Claude, Cursor or ChatGPT
Paste the server URL and a scoped key into the client. Evlio hosts the server and logs every call it takes.

Client config~/.cursor/mcp.json

{
  "mcpServers": {
    "acme-payments": {
      "url": "https://mcp.evlio.xyz/acme-payments",
      "headers": { "Authorization": "Bearer evlio_live_..." }
    }
  }
}

01MCP generation

Governed MCP servers, built from contracts and not hand-written glue

A contract already says which endpoints an audience can see and which fields they get. Evlio turns that into a typed MCP server: curated tools, rich descriptions, output schemas, and an install page you can hand to a partner.

Tools exposedcurated from 214 endpoints23 of 214

✓get_payment_statustyped outputread:payments

✓create_invoiceidempotentwrite:billing

✓list_transactionspaginatedread:payments

!refund_chargeheld back: missing output schema

-191 endpoints not exposedout of contract scope

https://mcp.evlio.xyz/acme-payments

Curated, not dumpedAgents choose tools by reading descriptions. A 214-tool server makes every choice worse. Evlio exposes only what the contract allows and what scores well enough to be understood.

Schema changes are gatedA tool schema is a promise agents take literally. Remove a field an agent depends on and the publish is blocked until someone approves it.

Hosted or your own cloudRun on Evlio with a custom domain, or deploy inside your VPC on Enterprise. Same contracts, same logs, your perimeter.

02Authorization gateway

No agent gets a raw key to your API

Every tool call passes through the gateway: identity checked, scope enforced, rate limited, logged. Keys are issued per agent and revoked in one click, and your upstream credentials never leave Evlio.

Keys and scopesIssue key

evlio_live_...8f2aClaude Desktop

read:paymentsread:invoices600 req/min

evlio_live_...c91dCursor IDE

read:payments120 req/min

evlio_test_...44b0Revoked 2m ago

Elevated error rate, 5.8% · scope escalation attempt blocked

Policy checks per callin order, fail closed

01IdentityOAuth2 token or managed key, mapped to an agent

02Tool scopeIs this key allowed to call this specific tool

03Field redactionPII stripped from responses per contract

04Rate and quotaPer key and per tool, retry storms contained

05Audit recordAgent, key, tool, arguments hash, latency, outcome

03MCP Playground

Test your MCP server in the Playground, not in production

Chat with an agent against your own server and watch every tool call land in a live log: the arguments it sent, what came back, and how long it took. Playground calls do not count against your quota.

MCP Playgroundacme-payments v2 · 23 toolsPlayground calls do not count against your quota

Refund the duplicate charge on order 4821 and confirm it went through.

get_payment_status{ "orderId": "4821" }ok · 98ms

list_transactions{ "orderId": "4821", "limit": 20 }ok · 172ms

refund_charge{ "txnId": "txn_9f21" }denied · missing an output schema

Order 4821 was captured twice for $240.00. The duplicate is txn_9f21. I cannot refund it from this server: refund_charge is held back until its output schema verifies, so the gateway denied the call.

Ask the agent to use your MCP tools…

Claude Sonnet 4.6

LogsLive

get_payment_status98ms · 820 tokok

list_transactions172ms · 1,140 tokok

refund_charge4ms · 0 tokdenied · missing an output schema

A tool list is not a testA server can expose exactly the right tools and still fail, because the agent cannot tell which one to pick. The only test that settles it is whether a model reaches the answer.

The gateway is in the loopPlayground calls go through the same gateway your agents will. A tool the contract holds back is denied here too, so you find the gap before a partner does.

Run it as often as you likePlayground calls do not count against your tool-call quota, on any plan. Re-run the same prompt while you tighten a description and watch the picks change.

04MCP logs

Answer “which agent did this” in one query

Every call, not a sample. Filter by agent, key, tool, or outcome, export to your SIEM, and set retention to match your policy. When an auditor asks, the answer takes a minute.

Live call logstreaming

Export

TIMEAGENTTOOLKEYLATENCYTOKENSOUTCOME

14:32:12Claude Desktopget_payment_status...8f2a98ms820ok

14:32:10Cursor IDEcreate_invoice...c91d145ms1,340ok

14:32:08Partner botdelete_account...44b04ms-denied · out of scope

14:32:06Claude Desktoplist_transactions...8f2a172ms4,100ok

14:32:03Windsurfrefund_charge...7e15210ms960error · schema mismatch

14:32:01Partner botsync_ledger...44b02410ms2,200ok · slow

14:31:59Cursor IDEget_customer...c91d88ms640ok

retention 30 days on Business · custom on Enterpriseexport: JSON, CSV, webhook to SIEM

05MCP insights

See cost, latency, and blast radius per agent

One agent doing most of your traffic is either your best integration or a retry loop. Insights separate the two, surface the tools that are slow or failing, and show what tokens are actually costing you.

Tool calls (24h)847↑ 6.7% from yesterday

p95 latency138msstreaming included

Denied calls129 scope, 3 rate limit

Token spend (24h)124kavg 1,240 per call

Traffic by agent

Claude Desktop412 calls · 98ms

Cursor IDE233 calls · 145ms

Partner bot147 calls · 210ms

Windsurf55 calls · 132ms

Needs attention3 tools

!refund_charge14% errors · missing output schema

↑list_transactions4,100 tokens avg · unpaginated

◷sync_ledgerp95 2.4s · agents timing out

Each of these becomes a fix suggestion in your catalog, with the error rate, token count, and p95 that found it attached.

06Agent feedback

Agent feedback tells you why a call failed, not just that it did

A log says a call failed. Agent feedback says why: an unclear description, too many parameters, a server that timed out. Claude, ChatGPT, Cursor, and Windsurf file each one against the endpoint it came from.

Agent feedbackSummarize with AI

Filter by date5 open · 1 critical

ClaudeCritical2h ago

The tool description does not clearly explain when it should be used.

GET/customers/{customerId}

ChatGPT4h ago

The tool failed to return a response after multiple attempts. I could not complete the request because the MCP server kept timing out.

POST/orders

Cursor4h ago

The tool requires too many parameters for a simple request.

GET/products/{productId}

Claude7h ago

Two tools have almost the same description, so I picked the wrong one twice before it worked.

GET/orders/{orderId}

Windsurf9h ago

The response has no pagination cursor, so reading the whole list costs 4,100 tokens every call.

GET/transactions

filed by the agents calling acme-payments v2scored into the catalog

Filed against the tool, not a mailboxEach item carries the client that hit it, the endpoint it came from, and when. Nobody has to work out which of 214 endpoints the complaint was about.

Wording is a bug reportAn agent that cannot tell two tools apart is describing a defect in your descriptions, not a bad day for the model. Evlio treats it as one and ranks it by how often it blocks a call.

It ends up in the catalogFeedback lands on the endpoint next to its AI readiness score and the suggested fix, so the next contract version ships with the description rewritten and the parameters trimmed.

Enterprise readiness

Secure MCP servers, built for the review your platform team runs

Servers run on SOC 2 Type II and ISO 27001 certified infrastructure. Every control a security team asks about before approving an MCP server is covered in full on the MCP server security page.

Least privilege by defaultTools ship scoped or they do not ship. No wildcard keys, no ambient access to endpoints outside the contract.

Your credentials stay putUpstream API secrets live in the gateway, never in an agent config or a partner’s machine. Rotate without redistributing anything.

Revoke in secondsOne click kills a key, an agent, or a whole server. The log keeps everything it did up to that moment.

SSO, SAML, SCIMYour identity provider owns who can publish and approve. Deprovisioning a person removes their access everywhere.

Audit trail and approvalsWho changed which contract, who approved the breaking change, and when the server picked it up. Exportable.

Private cloud or on-premRun the gateway inside your network with a custom domain, keep logs in your account, and satisfy data residency.

What is an MCP server?

MCP (Model Context Protocol) is how AI clients like Claude and Cursor call external tools. An MCP server exposes your API as typed tools an agent can call safely. The long version.

FAQ

Does the Free plan include a hosted MCP server?

Yes: one hosted server and 1,000 tool calls a month, unlimited members, no card. Startup has 3 servers and 25,000 calls, Business 20 servers and 250,000 calls.

Can I generate an MCP server from an OpenAPI spec without connecting a repo?

Yes. Upload an OpenAPI 3.x or 2.0 file and Evlio builds the catalog from it, then generates the MCP server from the tools you choose. Connect the repo later if you want the spec kept in sync with the code.

How long does it take?

Less than a minute from spec upload or repo connect to a hosted MCP server you can point Claude, Cursor or ChatGPT at.

What is the Evlio MCP gateway?

The hosted layer agents connect to. Every tool call passes five checks in order: identity, tool scope, field redaction per contract, rate and quota, and an audit record with actor, tool, arguments hash, latency, and outcome.

Can Evlio generate an MCP server from my API?

Yes. MCP servers are generated from a contract view of your catalog, so agents only see the tools an audience was deliberately granted. Servers are hosted by Evlio, or self-hosted on Enterprise.

Which AI clients can connect?

Any MCP client, including Claude, Cursor, and ChatGPT, plus partner agents using scoped keys through the same gateway.

How many tool calls are included?

1,000 per month on Free, 25,000 on Startup, 250,000 on Business, and custom on Enterprise. Paid plans continue past the limit with metered overage at $10 per 10,000 calls.

How do I test an MCP server before agents use it?

In the MCP Playground. Point an agent at your own server, watch every tool call it makes with the arguments, the response, and the latency, and see which calls the gateway allows. Playground calls do not count against your tool-call quota.

How do agents report problems with my API?

Through agent feedback. When a tool is hard to use, the agent files a report against the endpoint it came from: an unclear description, too many parameters, or a response that timed out. Evlio scores it and turns it into a fix in your catalog.

From top startups to Fortune 500 companies, trusting Evlio