Skip to content
AlltoMCPOpen workspace
Menu

01The translation layer for agent tools

Any API.
Every agent.

Import OpenAPI, REST, GraphQL, gRPC, or SOAP, or start from a template. Choose exactly which actions become tools, combine APIs into toolkits, and publish secure remote MCP servers.

Build an MCP serverSee how it works
  • OpenAPI 3.x
  • REST
  • GraphQL
  • gRPC
  • SOAP
  • 28 templates
  • OAuth + PKCE
openapi.jsonReady
  • GETgetCustomertool
  • POSTcreateInvoicetool

02Bring the API you already have

Every API style.
One MCP endpoint.

Use a formal contract when you have one, bring real requests when you don’t, or start from one of 28 templates for popular APIs. Every path ends with a curated, authenticated tool server.

01 / ContractOpenAPI

Import the whole surface.

Upload an OpenAPI or Swagger contract as JSON or YAML, or point to existing Scalar or Swagger UI documentation.

  • OpenAPI 3.x and Swagger 2.0
  • Automatic parameter and body schemas
  • Local reference resolution
openapi.json → 42 candidate tools
02 / ManualREST

Define only what matters.

Paste cURL, import a collection or browser recording, or define methods and paths directly.

  • cURL, Postman, Insomnia, Bruno, and HAR import
  • JSON and form request bodies
  • Bearer, Basic, or API-key auth
PATCH /orders/{id} → update_order
03 / ServicesGraphQL · gRPC · SOAP

Expose precise operations.

Upload a GraphQL schema, a .proto file, or a WSDL, or define the approved operations yourself.

  • GraphQL introspection or chosen operations
  • gRPC from .proto, over HTTP or Connect
  • SOAP from WSDL 1.1, JSON in and out
mutation RenameCustomer → tool
OpenAPIRESTGraphQLgRPCSOAPhttps://alltomcp.com/mcp/connector

03From API to live tools

Ship the integration, not a new backend.

AlltoMCP maps your existing API into the MCP tool model, then gives you a workspace to control what gets published.

01

Define

Import a contract or real requests, start from a template, or define only the operations you need.

02

Curate

Select safe endpoints and rewrite tool descriptions so models know exactly when to use them.

03

Connect

Paste one MCP URL into ChatGPT or Claude, or install in Cursor and VS Code with one click, and sign in with OAuth.

04A workspace, not a generator

You decide what agents can touch.

Imported operations stay private until you select them. Tool names, descriptions, upstream credentials, and access tokens remain under workspace control.

Curate the tool surface
Publish one endpoint or one hundred without exposing the rest of the API.
Write model-facing descriptions
Explain when a tool should run, or let AI suggest a description to start from.
Test before agents do
Run any tool against the live API and see exactly what an agent receives.
Ask before risky calls
Tools that change data can require the user’s approval before they run.
Work as a team
Share servers in team workspaces, with roles and an audit log of every change.
Workspace / Customer APILive
Tools
03
Auth
OAuth
Type
REST
  • GETget_customerOn
  • POSTcreate_invoiceOn
  • DELETEdelete_customerOff
  • Staging CLIs2m_7Jd2Kp…Rotate
  • Productions2m_9Lm4Qs…Revoke

05Toolkits

One endpoint.
Many APIs.

Pick tools from several of your servers and serve them together. An agent connects and signs in once, and gets exactly the tools a task needs.

Names that never clash
Each tool is named after its API, and any name can be changed.
Every call through its own server
Credentials, limits, and call logs stay with the server each tool comes from.
Its own access
A toolkit has its own tokens and OAuth sign-in, so you can hand it out on its own.
tools/list · /mcp/kit/support-desk
zendesk_ListSearchResults     Search tickets and people
zendesk_UpdateTicket          Update a ticket
intercom_replyConversation    Reply to a customer
pipedrive_searchDeals         Find the customer's deals
slack_chat_postMessage        Post to #support

06Built for real credentials

Access stays in the right hands.

MCP access and upstream API access are separate layers, so you can rotate one without breaking the other.

Read the security model
OAuth 2.1 + PKCE
Dynamic client registration, consent, audience-bound access tokens, and refresh rotation.
Workspace isolation
Every server and toolkit belongs to one workspace, checked on every request, with roles for each member.
Encrypted providers
Upstream credentials use AES-256-GCM encryption, shared or per person, and never appear in responses.
Network guardrails
Private and reserved destinations are blocked for imports and tool calls, and servers can allow only your networks.
Scoped, expiring tokens
Static secrets are shown once, stored as hashes, and can be limited to read-only or chosen tools.
An audit log
Every change to servers, toolkits, access, and your team is recorded with who made it.

07One endpoint for every client

Connect with OAuth, one click, or a token.

ChatGPT and Claude discover the authorization metadata and open the hosted consent flow. Cursor and VS Code install with one click, Claude Code with one command, and developer tools can use a named static token.

  • Streamable HTTP transport
  • OAuth discovery metadata
  • Dynamic client registration
  • One-click install links
  • Audience-bound access per server
mcp.config.json
{
  "mcpServers": {
    "customer-api": {
      "type": "http",
      "url": "https://alltomcp.com/mcp/customer-api",
      "headers": {
        "X-MCP-Token": "s2m_..."
      }
    }
  }
}

08Before you connect

Questions,
answered.

Everything important about the generated servers, toolkits, credentials, and plans.

Do I need an OpenAPI file?
No. Paste cURL, import a Postman, Insomnia, Bruno, or HAR file, use GraphQL, a gRPC .proto, or a SOAP WSDL, or start from one of 28 templates for popular APIs.
Can I choose which operations become tools?
Yes. Preview the candidate tools, select only the operations you want, and edit every description before publishing.
Where are upstream credentials stored?
Saved credentials are encrypted at rest. A server can share one credential, or use each person’s own, and APIs that use OAuth connect through the provider’s consent screen.
Can one agent use several APIs?
Yes. A toolkit puts tools from several of your servers behind one MCP endpoint, so an agent connects and signs in once. Each call still runs through its own server.
Can my team share servers?
Yes. Team workspaces have owner, admin, editor, and viewer roles, and an audit log of every change. Viewers who connect get only read-only tools.
Is it free?
Every workspace starts on the free plan, with no credit card. Paid plans raise the limits on servers, toolkits, tool calls, and team members.
Does AlltoMCP host the upstream API?
No. It is a controlled translation and proxy layer. Your API remains the source of truth and receives the tool requests.

OpenAPI, REST, GraphQL, gRPC, or SOAP.

Give your API an agent interface.

Build your connector