OpenAPI
Import a contract
Upload OpenAPI 3.x or Swagger 2.0 as JSON or YAML, or paste the address of a Scalar or Swagger UI documentation page.
P01Platform overview
Your API,
agent-ready.
AlltoMCP handles the translation layer between existing APIs and MCP clients: from contract import and tool curation to toolkits, access control, and call visibility.
Build a connector01Define
Start from the API artifact you already have.
Use structured contracts for broad discovery, bring real requests, or define a narrow set of operations manually.
REST
Bring real requests
Paste cURL, import Postman, Insomnia, Bruno, or a HAR recording, or describe methods and paths directly.
GraphQL
Choose operations
Upload introspection JSON or provide the approved queries and mutations yourself.
gRPC
Load a .proto file
Methods with HTTP annotations call their REST routes; the rest use the Connect protocol.
SOAP
Load a WSDL
Each operation becomes a tool that takes and returns JSON, with the envelope built for you.
Templates
Start from a popular API
28 templates, from OpenAI, Slack, and Jira to PubMed, import the published contract with a starter set of tools selected.
02Curate
Publish the useful surface, not the whole API.
- Select endpoints
- Choose exactly which candidate operations become MCP tools.
- Edit descriptions
- Give agents specific guidance and side-effect warnings, or start from an AI-suggested description.
- Shape responses
- Keep only the fields agents need and cap long lists, to save tokens.
- Ask before risky calls
- Tools that change data can require the user’s approval before they run.
- Test before agents do
- Run any tool against the live API and see the request, the response, and what the agent receives.
- Stay in sync
- Re-read an updated contract, review what changed, and apply it while keeping your edits.
03Combine
One endpoint for everything a task needs.
Toolkits serve tools from several of your servers together, so an agent connects and signs in once.
- Pick across servers
- Search your servers’ published tools and choose the ones a task needs.
- Names that never clash
- Each tool is named after its API, such as zendesk_ListTickets, and any name can be changed.
- Each call through its own server
- Credentials, limits, and call logs stay with the server each tool comes from.
- Access of its own
- Its own endpoint, tokens, and OAuth sign-in, with the same install links as a server.
04Secure
Control who connects, and what they reach.
MCP access and upstream API access are separate layers, each with its own controls.
Clients
OAuth 2.1 with PKCE
ChatGPT, Claude, and other clients register, sign in, and get access bound to one server or toolkit.
Tokens
Scoped, expiring tokens
Named static tokens for developer tools, limited to read-only or chosen tools, rotated or revoked one at a time.
Credentials
Shared or per person
Store one upstream credential, or have each person use their own. APIs that use OAuth connect through the provider’s consent screen.
Environments
Staging and more
Point the same tools at another deployment, with its own address and optionally its own credential.
Limits
Rates, quotas, and networks
Cap requests a minute and tool calls a day, and accept calls only from your networks.
Teams
Roles for everyone
Owners, admins, editors, and viewers. Viewers who connect get only read-only tools.
05Operate
See every call after launch.
One workspace covers activity, alerts, and the record of every change.
- Call logs
- Status, latency, and redacted details
- Usage
- Volume and failures by server
- Alerts
- Slack, Discord, or any webhook when failures pile up
- Export
- Call logs as CSV
- Audit log
- Every change to servers, toolkits, access, and your team, with who made it and how.
- API keys
- Automate imports, tools, and tokens from scripts and CI with the management API.
Ready to map your API?