Gateway

The gateway your API needs before the LLM

Rate limits, auth, LLM routing, and MCP session guards in routes.json. Deploy in under 15 minutes, configure in JSON, update through git push.

Start free Read the docs

Rate Limiting

Block abuse before it reaches your upstream

Set per-consumer limits and LLM token budgets from responses in the inbound policy chain. Pick sliding-window, fixed-window, or token-bucket per route. Limits run after auth, giving each consumer its own counter.

Sliding-window, fixed-window, and token-bucket algorithms
Per-consumer, per-IP, or global rate limits
Daily token budgets reading from upstream LLM response
Standard X-RateLimit-* headers on every response

Rate limiting docs

{
  "name": "rate-limit",
  "policyType": "rate-limit-inbound",
  "options": {
    "rateLimitBy": "consumer",
    "algorithm": "token-bucket",
    "tokenBucketCapacity": 20,
    "refillRate": 10,    // per second
    "keySelector": "consumer.id"
  }
}

{
  "policyType": "llm-routing-inbound",
  "options": {
    "providers": [
      {
        "name": "openai-primary",
        "upstream": "https://api.openai.com/v1/...",
        "weight": 1.0,
        "priority": 1
      },
      {
        "name": "anthropic-fallback",
        "upstream": "https://api.anthropic.com/v1/...",
        "weight": 0.0,
        "priority": 2  // failover only
      }
    ]
  }
}

LLM Routing

Route across providers without changing application code

Set prioritized provider chains in routes.json. Fail over on 429, 5xx, or timeout. Balance by weight, route by rolling P50 latency, and normalize requests from OpenAI format to Anthropic.

Automatic failover on 429, 500, 502, 503, 504
Weighted load balancing for A/B testing models
Latency-aware routing using rolling P50 measurements
Request normalization: send OpenAI format, route to Anthropic

LLM routing docs

MCP Gateway

Secure every tool call from every agent

The Model Context Protocol lets LLM agents invoke tools. Zuplo sits before your MCP server and enforces auth, rate limits, and session lifecycle controls.

API key or JWT auth

Authenticate MCP sessions with API keys or JWT tokens. No changes to your MCP server code.

Per-session tool-call limits

Limit tool calls per session, not HTTP request. Bursts are capped, while compliant sessions continue.

Session lifecycle

Set timeout and concurrent session limits per consumer. Idle sessions expire; active sessions stay open.

MCP gateway docs

Developer Experience

Ship, don't configure

Gateway config lives in version control. Deploy changes through git push, with routes defined as code.

OpenAPI docs auto-generated

Zuplo reads routes.json and creates an OpenAPI spec. Consumers get interactive docs without extra tooling or maintenance.

Live test console

Test authenticated requests against your gateway in the browser. Inspect X-RateLimit-* headers, check counters, and verify routing decisions in real time.

Changelog from route diffs

Changes to routes.json are tracked by version. Zuplo computes a changelog from route diffs, showing your team and API consumers what changed and when.

Start with the free tier

Deploy your first gateway in under 15 minutes. The free tier includes up to 3 routes, 1 consumer group, and full access to rate limiting and auth policies.

Start free Compare plans