"LLM API rate limiting is hard to get right: token buckets, sliding windows, consumer quotas, and token-budget edge cases. Zuplo handles it declaratively, so I stopped writing custom middleware for it."
Customers
Teams shipping APIs with Zuplo
Engineering teams use Zuplo to secure LLM traffic and MCP sessions with config-as-code.
HP
Harbex Payments
Fintech / LLM-powered reconciliation
Harbex Payments secured LLM APIs in 72 hours
Harbex Payments runs an internal AI reconciliation service querying multiple LLM providers to match transaction records at scale. Before Zuplo, upstream API keys lived in service code and were shared across teams, risking a leak across all providers.
With Zuplo in front of its LLM endpoints, the team moved all provider keys to gateway environment variables. Per-consumer rate limits stop runaway model calls from one service account. JWT-inbound authentication maps each internal service identity to a consumer record, making usage attribution and key rotation auditable.
"We finished the auth overhaul in one weekend. routes.json was the only file we touched."
- Provider credentials removed from source code
- Per-service rate limits applied across 4 internal teams
- Key rotation time reduced from 2 hours to under 5 minutes
SL
Stackridge Labs
Dev tooling / MCP-based coding assistant
Stackridge Labs runs an MCP gateway on Zuplo
Stackridge Labs builds a coding assistant connecting to customer code repositories through MCP tool calls. Its early MCP proxy was a custom Node.js service with handwritten session management. As usage grew, session timeouts became unreliable, and there was no per-tenant rate limiting.
Replacing the custom proxy with Zuplo's mcp-session-guard-inbound policy removed the maintenance layer entirely. Each tenant customer gets a consumer identity derived from the JWT sub claim. Tool call rate limits are declared in routes.json with the session timeout value. MCP config changes ship like any code change, as a pull request.
"We deleted about 800 lines of session management code and replaced them with 40 lines of routes.json."
- Custom MCP session proxy retired
- Per-tenant rate limiting across 30+ customer accounts
- Config changes deployable in under 2 minutes via CI
What developers say
"We evaluated three gateways for our MCP product. Zuplo was the only one treating MCP as a first-class concept. Its session-guard policy saved us about two sprints of custom proxy work."
"Config-as-code is the scalable pattern across an engineering org. When gateway config lives in a JSON file in version control, reviews, rollbacks, and audits are just Git operations. That's the right model."
12
Pilot teams in production
50+
LLM operations secured
3 days
Avg. time to first secured route
Secure your LLM APIs today
Ship API products with Zuplo. Free forever, no credit card, 3 routes included.