Josh Twist
CEO & Co-FounderSpent years building developer platforms and API infrastructure. Focuses on the intersection of API architecture and developer experience.
About
Built by engineers who saw the gap
Every team we spoke with was building its own rate limiter, key validation, and LLM failover logic. We built Zuplo as that layer, so they would not have to rebuild it.
Why we exist
LLMs turned every application into an API consumer. The patterns are new: one request can cost far more than a traditional API call, provider outages are routine, and the auth model of an API key tied to a token budget was absent from most gateway products.
We started Zuplo in 2023 after seeing teams stitch together custom middleware, cron-based budget resets, and brittle failover scripts when adding an LLM. That code was plumbing, not product. It belonged in config.
Our position: every policy governing API traffic should be readable, version-controlled, and deployable without a rewrite. That is config-as-code, and it keeps this layer maintainable as LLM and MCP surfaces expand.
Founded
2023
Location
Bellevue, WA
Model
Bootstrapped
Focus
LLM and MCP API gateway
The team
Marcus Chen
CTOBuilt high-throughput proxy systems and LLM gateway infrastructure. Brings deep Rust and Go expertise to the Zuplo runtime layer.
Niall Brennan
Head of EngineeringWorked in platform reliability for a large edge network company. Designed the rate limiting algorithms and policy chain architecture at Zuplo's gateway core.
Sara Oluwafemi
Developer AdvocateComes from technical writing and developer education. Owns Zuplo's documentation, quickstart guides, and LLM integration pattern library.
How we approach this problem
Config, not code
Every policy, route, and environment variable in Zuplo is a JSON declaration in routes.json. It lives in Git, gets reviewed in PRs, and rolls back with a revert. No YAML sprawl or hidden UI state.
Latency matters
Sub-5ms gateway overhead is an engineering target, not a marketing number. We keep the gateway overhead low for LLM traffic and focus relentlessly on the hot path.
Policies compose
Multiple policies on one route run in a declared chain. Auth runs before rate limiting, and rate limiting before routing. The order is explicit in config and deterministic at runtime.