01 The translation layer for agent tools

Any API.
Every agent.

Import OpenAPI, define REST endpoints, or add GraphQL operations. Choose exactly which actions become tools and publish a secure remote MCP server.

Build an MCP server →See how it works

OpenAPI 3.xRESTGraphQLOAuth + PKCE

openapi.jsonREADY

paths:
  /customers/{id}:
    get:
      operationId: getCustomer
  /invoices:
    post:
      operationId: createInvoice

↓ MAP

GETgetCustomertool

POSTcreateInvoicetool

02 Bring the API you already have

Three ways in.
One MCP endpoint.

Use a formal contract when you have one. Define only the actions you need when you do not. Every path ends with a curated, authenticated tool server.

01 / ContractOPENAPI

Import the whole surface.

Upload an OpenAPI JSON contract or point to existing Scalar or Swagger documentation.

OpenAPI 3.x and Swagger 2.0
Automatic parameter and body schemas
Local reference resolution

openapi.json → 42 candidate tools

02 / ManualREST

Define only what matters.

Paste cURL, upload a Postman collection, or define methods and paths directly.

cURL and Postman v2.x import
JSON and form request bodies
Bearer, Basic, or API-key auth

PATCH /orders/{id} → update_order

03 / OperationGRAPHQL

Expose precise operations.

Upload an introspection JSON schema or define approved queries and mutations manually.

Root field tool generation
Typed variable schemas
Mutation-aware annotations

mutation RenameCustomer → tool

OpenAPIRESTGraphQL→https://your-host/mcp/connector

03 From API to live tools

Ship the integration, not a new backend.

AlltoMCP maps your existing API into the MCP tool model, then gives you a workspace to control what gets published.

⇧

Define

Import OpenAPI or GraphQL schemas, or manually define only the operations you need.

⌘

Curate

Select safe endpoints and rewrite tool descriptions so models know exactly when to use them.

↗

Connect

Paste one MCP URL into ChatGPT or Claude and complete the standards-based OAuth flow.

04 A workspace, not a generator

You decide what agents can touch.

Imported operations stay private until you select them. Tool names, descriptions, upstream credentials, and access tokens remain under workspace control.

Curate the tool surfacePublish one endpoint or one hundred without exposing the rest of the API.

Write model-facing descriptionsExplain when a tool should run and what an agent must know before calling it.

Edit without rebuildingChange connector names, base URLs, credentials, selections, and descriptions in place.

Rotate access independentlyCreate named connector tokens for each environment or developer and revoke them one at a time.

Workspace / Customer APILIVE

TOOLS03

AUTHOAuth

TYPEREST

GETget_customerON

POSTcreate_invoiceON

DELETEdelete_customerOFF

STAGING CLIs2m_7Jd2Kp…

PRODUCTIONs2m_9Lm4Qs…

05 Built for real credentials

Access stays in the right hands.

MCP access and upstream API access are separate layers, so you can rotate one without breaking the other.

OAuth 2.1 + PKCE

Dynamic client registration, consent, audience-bound access tokens, and refresh rotation.

Tenant isolation

Every connector belongs to one workspace account and is checked on every management request.

Encrypted providers

Optional upstream API keys use AES-256-GCM encryption and never appear in connector responses.

Network guardrails

Private and reserved network destinations are blocked by default for imports and tool execution.

Hashed connector tokens

Static secrets are shown once, stored as hashes, and managed separately for each connector.

06 One endpoint for every client

Connect with OAuth or a static token.

ChatGPT and Claude can discover authorization metadata and open the hosted consent flow. Developer tools can use a named static token instead.

Streamable HTTP transportOAuth discovery metadataDynamic client registrationPer-connector audience binding

mcp.config.json

{
  "mcpServers": {
    "customer-api": {
      "type": "http",
      "url": "https://host/mcp/customer-api",
      "headers": {
        "X-MCP-Token": "s2m_..."
      }
    }
  }
}

07 Before you connect

Questions,
answered.

Everything important about the generated server, credentials, and supported APIs.

Do I need an OpenAPI file?

No. You can define REST endpoints manually, upload GraphQL introspection JSON, or paste exact GraphQL operations.

Can I choose which operations become tools?

Yes. Preview the candidate tools, select only the operations you want, and edit every description before publishing.

Where are upstream credentials stored?

Optional saved credentials are encrypted at rest. You can also provide credentials per MCP request instead of storing them.

Can multiple developers use one connector?

Yes. Create separately named static tokens for users or environments, or let compatible clients authenticate through OAuth.

Does AlltoMCP host the upstream API?

No. It is a controlled translation and proxy layer. Your API remains the source of truth and receives the tool requests.

OpenAPI, REST, or GraphQL.

Give your API an agent interface.

Build your connector →

Any API.Every agent.

Three ways in.One MCP endpoint.