API management, rebuilt for the agentic era
Elva discovers every API in your code, governs what each audience can access, and exposes it to developers and AI agents. Catalog, contracts, testing, and hosted MCP servers in one pipeline. No spec required.
❯ npx elva sync acme/payments-api
▸ Scanning repo.................. 1,204 files
▸ Endpoints discovered........... 214
▸ Generating OpenAPI 3.1 specs... done
▸ Building catalog
payments 38 endpoints A · 92%
identity 24 endpoints B · 84%
billing 17 endpoints D · 61% ← weakest, fix first
▸ Flagging issues
⚠ 2 breaking changes DELETE /builds/{id}
⚠ 4 endpoints missing auth billing/*
⚠ 12 untyped fields legacy schemas
▸ Improving with AI agent
✓ 31 descriptions written ✓ 12 schemas typed
✓ auth documented billing/*
billing rescored D · 61% → B · 83% agent-ready ↑
▸ Deploying MCP server........... live
✓ mcp.elva.dev/acme-payments · 23 tools · OAuth2 · done in 42s
01 · DISCOVERAutomatic API discovery
Turn any repo into a complete API catalog, even without specs
done
Connect the repogit · 1,204 files scanneddone
Specs generatedOpenAPI 3.1 · 214 endpointsdone
Scored & flaggedagent-ready 73% · 2 breakinglive
MCP server livehosted · auth · loggingagent-ready in 42s · rescan armed on every commit42.0s
02 · UNDERSTANDAPI scoring and insights
Know how agent-ready your APIs really are
Every endpoint scored on design, security, and AI readiness. One-click AI fixes. Test the traditional way too.
Your API results by categoryScores per 12 API collections
100%75%50%25%0
Design92%
Developer experience84%
AI readiness71%
Security64%
Performance59%
BEFOREC · 71%
AI readiness · payments-api31 endpoints missing descriptions
12 untyped response fields
4 endpoints with undocumented auth
Fix all with AI
AFTERB · 89%
Rescored in 42 seconds31 descriptions written from code
12 response schemas typed
auth documented on billing routes
API contractsOnly in Elva
API contracts decide what ships
Pick the audience, the endpoints, the fields they get, and where it ships. Elva then diffs every commit against that promise and tells you the moment the source drifts away from it.
Build the contract once.Elva keeps five outputs and every consumer in sync with it.Create API contract
01STEP 1 · WHO IS THIS CONTRACT FOR?
Partner IntegrationExternal company consuming your API. Strict versioning, approval before publish.Partner visibility · Requires approval
Internal ServiceAnother team or microservice. Lighter governance, faster iteration.Internal visibility · No approval
Public APIOpen to any developer. Rate limits, sandbox, full documentation.Public visibility · Full publishing
AI Agent / MCPAgents consuming via MCP tools. Rich descriptions, stable schemas.MCP server + spec · Requires approval
all repos · all tags2 collections · 32 endpoints selected
Payments API38 endpointspaymentspartner
GET/v2/payments/{id}
POST/v2/payments/refund
GET/v2/payments/methods
DELETE/v2/payments/{id}/void
Identity & Auth24 endpoints
Include allRequired onlyExclude PIIExclude internalGET · 14 of 18 fields exposed
idStringPayment identifier
amountIntegerAmount in minor units
customer_emailPIIStringCustomer's email address
internal_notesInternalStringOps annotations, never external
49 of 58 fields exposed18 PII fields excluded
one contract, five outputs
OpenAPI spec fileHosted JSON/YAML, the canonical contract
Theneo docsPublish to your documentation portal
MCP serverAuto-generated tools, contract endpoints only
Postman collectionImport-ready, with environments and auth
TSTypeScript SDKType-safe npm package
Payments × Partnerv1.0.0Source drift detected
PUBLISHED TO
OpenAPI specv1.0.0
Theneo docsv1.0.0
MCP server14 tools
Postman collectionv1.0.0
TypeScript SDKv1.0.0
SOURCE COLLECTIONS
Payments API31 endpoints in contractSynced
Identity & Auth9 endpoints in contractSynced
All endpoints exist in sourcesContract schemas validApprover assignedNo breaking changes
Someone shipped5changes today.Twowould have broken a partner. Elva stopped them.payouts-partner · v1.4
DELETE/builds/{id}BREAKINGResponse field removed from schema+2−9a91f2c42h
SCHEMA DIFFopenapi.yaml · Build
Build:
properties:
id: { type: string }
status: { type: string }
- buildLog:
- type: string
- description: Full build output
+ logUrl:
+ type: string, format: uri
IMPACT
Consumers reading buildLog2 services
Partner builds affected1 partner
MCP tools referencing field1 tool
Publish blocked by policyReview
GET/billing/plansBREAKINGAuth scope tightened on billing routes+3−17e15b024h
SCHEMA DIFFopenapi.yaml · security
security:
- - bearerAuth: []
+ - oauth2:
+ - read:billing
+ - read:plans
IMPACT
Keys missing read:billing3 keys
Acknowledgements pending2 of 4
Grace period set14 days
Awaiting 2 acksRemind
Click any change to see the exact schema diff and who it breaks.How contracts work →
04 · PUBLISHMCP server generation and hosting
Run your MCP servers like real infrastructure
Generate an MCP server from any API. Hosted, authed through Elva's MCP gateway, fully logged. Not weekend demos.
Claude Desktop129 calls today
Cursor IDE89 calls today
ChatGPT34 calls today
Claude, Cursor, or any MCP client. The contract decides which tools each audience sees, auth and logging come standard.
Agents install it in one line
npx elva mcp add paymentsHosted or self-hostedPer-tool auth scopesFull call logs
05 · IMPROVEPlayground and agent feedback
Try the MCP Playground, then read the agent feedback
Test the server with a real agent in the Playground. Once it is live, the agents calling it tell you which tools confused them.
MCP Playgroundacme-payments v2 · 23 tools
Refund the duplicate charge on order 4821 and confirm it went through.
get_payment_status{ "orderId": "4821" }ok · 98ms
list_transactions{ "orderId": "4821", "limit": 20 }ok · 172ms
refund_charge{ "txnId": "txn_9f21" }denied · missing an output schema
Order 4821 was captured twice for $240.00. The duplicate is txn_9f21. I cannot refund it from this server: refund_charge is held back until its output schema verifies, so the gateway denied the call.
Ask the agent to use your MCP tools…
Claude Sonnet 4.6
Agent feedbackSummarize with AI
Filter by date3 open · 1 critical
ClaudeCritical2h ago
The tool description does not clearly explain when it should be used.GET/customers/{customerId}
ChatGPT4h ago
The tool failed to return a response after multiple attempts. I could not complete the request because the MCP server kept timing out.POST/orders
Cursor4h ago
The tool requires too many parameters for a simple request.GET/products/{productId}
filed by the agents calling acme-payments v2scored into the catalog
The MCP gateway your agents call
Claude, Cursor, and your partners connect to a hosted server with scoped keys. Every call is checked and logged, and your credentials never leave Elva.
847agent calls in the last 24 hours.27failed. Here is who, with which key, at what cost.mcp.elva.dev/acme-payments
TOTAL REQUESTS847↑ 6.7% from yesterday
AVG RESPONSE138msP95 412ms
ERROR RATE3.2%27 failed · 847 total
TOKEN USAGE124kavg 1,240 per call
AGENT ACTIVITY
Claude DesktopLast seen 2 min ago129 calls today6 tools used
Cursor IDELast seen 5 min ago89 calls today4 tools used
PPartner Integration BotLast seen 12 min ago34 calls today3 tools used
API KEY USAGE · 24H
Production Key****7f2amost used: elva_get_users4,120 calls6 agents12 errors
Development Key****3e1bmost used: elva_auth_login204 calls2 agents9 errors
CI Pipeline Key****a4c0most used: elva_get_analytics861 calls1 agent3 errors
Every call logged with agent, key, tool, latency, and outcome. Export to your SIEM.MCP Management →
Elva agent
Tell the Elva agent what to ship
Contract generated, MCP updated, changelog drafted, stakeholders notified.
Hi Natia, I’m Elva 👋 What would you like to ship today?
Suggestions to get started with:Ship a new endpoint to partnersUpdate the MCP serverOther
Ship the /payouts endpoint and tell the partners team.
Contract generated for the partner audiencepayouts-partner · v1
Added to the acme-payments MCP server2 new tools
Changelog drafted for review1 breaking note
3 stakeholders notifiedpartners-team@acme.com
IN PRACTICEFrom production
Numbers from teams running Elva
Three write-ups from real deployments: what governed MCP servers, structured errors, and per-audience contracts change in practice.
Across 1.2 million tool calls, one vague error message drove a third of retry traffic. Structured errors naming the field fixed it.
Read the numbers →One team, first quarter on contracts: for the first time they could prove no active consumer referenced the endpoints they deleted.
Read the numbers →ENTERPRISEFor the security review
Answers the security review before it asks
SOC 2 Type II, ISO 27001 and GDPR on the infrastructure Elva runs on. SSO and SCIM from the identity provider you already run. Hosted, in your own cloud, or on-prem.
Certified infrastructure
- SOC 2 Type IIcertified
- ISO 27001 / 27701certified
- GDPRcompliant
Runs where your perimeter ends
- Hosted SaaSManaged upgrades, 99.9% SLA
- Private cloudYour VPC, your KMS keys
- On-premAir-gapped, no egress
Works with every identity provider
Identity providers were built for people signing in to apps. Elva extends the one you already run to AI agents, so access follows your existing teams and roles.
OktaMicrosoft Entra IDAuth0WorkOSGoogle WorkspacePing IdentityAny SAML / OIDC
- SAML 2.0 and OIDC single sign-on, enforced across every workspace
- SCIM keeps groups, roles, and deprovisioning in sync
- Every agent gets its own identity in the audit trail
FAQ
What is Elva?
Elva is the system that discovers every API in your codebase, understands and scores them, governs what each audience can access, and exposes them to developers, applications, and AI agents through documentation, SDKs, and hosted MCP servers. Elva sits between your codebase and everything that consumes your APIs. It is built by Theneo and used by teams from startups to Fortune 500 companies.
Is Elva an API gateway?
No. Elva sits above your repositories and existing gateways. It discovers, governs, and exposes APIs while your gateway keeps handling runtime traffic. The exception is MCP: Elva hosts and gates MCP servers itself, with scoped keys, per-tool authorization, and full call logs.
How is Elva different from Postman?
Postman is where developers work with individual requests. Elva is the system of record for an organization's entire API estate: what exists, who owns it, what each audience can access, and what agents are calling.
Does Elva need an OpenAPI spec to start?
No. Elva derives the catalog from your code by reading route registrations, validators, and serializers, then emits OpenAPI 3.1 as an output. Existing specs are imported and kept in sync with the code on every commit.
How does Elva work with AI agents?
Elva generates MCP servers from your API contracts and hosts them behind an auth gateway with scoped keys, per-tool authorization, and full call logs, so Claude, Cursor, ChatGPT, and partner agents can use your APIs safely.
How much does Elva cost?
The Free plan covers 1 repo and 1,000 tool calls a month, forever. Startup is $100 per month flat, Business is $600 per month billed annually, and Enterprise is custom. Every plan includes unlimited members.
Is Elva ready for an enterprise security review?
SOC 2 Type II and ISO 27001/27701 are certified and GDPR is covered by a DPA, all held by Theneo and covering the infrastructure Elva runs on. SSO, SAML, OIDC, and SCIM work with the identity provider you already run, and Elva deploys as hosted SaaS, in your private cloud, or on-prem.
Who builds Elva?
Elva is built by Theneo, the API documentation company whose platform is used by 20,000 companies.
Ship APIs any agent can call
Humans, tests, partners, agents. One catalog, one contract, one place.
npx elva init