DOC Product guide

From API to MCP server.

Create a controlled tool surface over an API you already own. AlltoMCP handles discovery, schemas, authentication, MCP transport, and client authorization.

Use the agent prompt library →

01 · Quickstart

Publish your first connector

  1. Open the workspace.Create an account or sign in, then select OpenAPI, REST API, or GraphQL.
  2. Define the upstream API.Upload a JSON contract, import a documentation URL, or enter operations manually.
  3. Review the tool surface.Expose only the operations an AI client needs and rewrite descriptions to be specific.
  4. Publish and connect.Copy the generated MCP URL into your client and complete authorization.
Create a connector →
02 · Connector types

Choose the narrowest useful source

OpenAPI

Best when a complete OpenAPI 3.x or Swagger 2.0 contract already exists. AlltoMCP discovers operation names, inputs, descriptions, and authentication schemes.

REST API

Paste cURL for one endpoint, upload a Postman collection for a full API, or define methods, paths, inputs, and authentication manually.

GraphQL

Upload an introspection JSON schema to generate candidate tools from root fields, or define approved queries and mutations manually for tighter control.

03 · Tool design

Descriptions are part of the safety boundary

Tool names and descriptions guide the model when deciding whether to call an endpoint. Keep tools narrow, remove destructive operations unless required, and state side effects explicitly.

Better descriptionCancel an unpaid invoice. This action cannot be undone. Requires invoice ID.
  • Expose only operations required by the intended workflow.
  • Describe required identifiers and important constraints.
  • Call out writes, deletions, notifications, and financial actions.
  • Test tools with non-production data before wider access.
04 · Authentication

Two separate trust boundaries

Client → MCPOAuth or static token

Controls who may discover and invoke connector tools.

MCP → APIUpstream credential

Authorizes AlltoMCP when forwarding a tool call to your API.

Stored upstream credentials are encrypted at rest. Use a stable CREDENTIAL_ENCRYPTION_KEY in production and rotate upstream credentials whenever access changes.

05 · Connect clients

ChatGPT and Claude

Copy the connector’s MCP endpoint from the workspace and add it as a remote MCP server in your client. The client reads the OAuth discovery metadata, opens the AlltoMCP authorization flow, and receives scoped access after you approve it.

Remote MCP URLhttps://your-domain.example/mcp/your-connector-slug

Use the production domain. Do not connect clients to a branch-preview URL because OAuth issuer and callback validation depend on a stable public origin.

06 · Static tokens

Developer and automation access

Each connector can have multiple named tokens. A secret is shown once when created or rotated; only its hash and display prefix are retained.

{
  "mcpServers": {
    "my-api": {
      "type": "http",
      "url": "https://your-domain.example/mcp/connector-slug",
      "headers": { "X-MCP-Token": "s2m_TOKEN" }
    }
  }
}
07 · Troubleshooting

Common connection failures

Invalid Host

Add the production hostname to ALLOWED_HOSTS, set PUBLIC_BASE_URL to the same HTTPS origin, then redeploy.

Unable to authenticate encrypted data

Ensure every deployment uses the same CREDENTIAL_ENCRYPTION_KEY. Then save the upstream credential again so it is encrypted with the active key.

Tool call returns HTTP 400

Open connector Calls to inspect the method, status, latency, and error. Verify the upstream base URL, credential, required inputs, and selected operation.

Connector disappeared after deployment

Vercel storage is ephemeral. Configure Supabase and run supabase/schema.sql before relying on durable records.