--- title: "Elva | Discover, govern, and expose your APIs to developers and AI agents" description: "Elva reads your repos to find every API you have, scores them, governs access with per-audience contracts, and exposes them to developers and AI agents through hosted MCP servers, docs, and SDKs. No OpenAPI spec required." canonical: "https://getelva.ai/" lastModified: "2026-09-14T09:43:18.317Z" --- # API management, rebuilt for the agentic era Elva discovers every API in your code, governs what each audience can access, and exposes it to developers and AI agents. Catalog, contracts, testing, and hosted MCP servers in one pipeline. No spec required. [Sign up free](https://app.getelva.ai/signup) [See how it works](#discover) Free tier · No credit card · No OpenAPI spec needed [![Elva - Goodbye, Postman. Your APIs have new consumers | Product Hunt](https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=1243798&theme=dark&t=1789376620683)](https://www.producthunt.com/products/elva?embed=true&utm_source=badge-featured&utm_medium=badge&utm_campaign=badge-elva) _Terminal demo: elva sync scans a repo, finds 214 endpoints, scores them, fixes the weakest with the AI agent, and deploys an MCP server with 23 tools in 42 seconds_ From top startups to Fortune 500 companies, trusting Theneo ![Ticketmaster](https://getelva.ai/assets/logos/ticketmaster-1.svg) ![Corpay](https://getelva.ai/assets/logos/corpay.svg) ![FIS](https://getelva.ai/assets/logos/fis.png) ![Corgi](https://getelva.ai/assets/logos/logo4.svg) ![SimilarWeb](https://getelva.ai/assets/logos/similarweb.svg) 01 · DISCOVER Automatic API discovery ## Turn any repo into a complete API catalog, even without specs done Connect the repo git · 1,204 files scanned done Specs generated OpenAPI 3.1 · 214 endpoints done Scored & flagged agent-ready 73% · 2 breaking live MCP server live hosted · auth · logging agent-ready in 42s · rescan armed on every commit 42.0s 214 ENDPOINTS DISCOVERED 89% AUTH COVERAGE 23 TOOLS EXPOSED 73% AGENT-READY 02 · UNDERSTAND API scoring and insights ## Know how agent-ready your APIs really are Every endpoint scored on design, security, and AI readiness. One-click AI fixes. Test the traditional way too. Your API results by category Scores per 12 API collections 100% 75% 50% 25% 0 Design 92% Developer experience 84% AI readiness 71% Security 64% Performance 59% BEFORE C · 71% AI readiness · payments-api 31 endpoints missing descriptions 12 untyped response fields 4 endpoints with undocumented auth Fix all with AI AFTER B · 89% Rescored in 42 seconds 31 descriptions written from code 12 response schemas typed auth documented on billing routes API contracts Only in Elva ## API contracts decide what ships Pick the audience, the endpoints, the fields they get, and where it ships. Elva then diffs every commit against that promise and tells you the moment the source drifts away from it. Build the contract once. Elva keeps five outputs and every consumer in sync with it. Create API contract 01 STEP 1 · WHO IS THIS CONTRACT FOR? Partner Integration External company consuming your API. Strict versioning, approval before publish. Partner visibility · Requires approval Internal Service Another team or microservice. Lighter governance, faster iteration. Internal visibility · No approval Public API Open to any developer. Rate limits, sandbox, full documentation. Public visibility · Full publishing AI Agent / MCP Agents consuming via MCP tools. Rich descriptions, stable schemas. MCP server + spec · Requires approval all repos · all tags Payments API 38 endpoints payments partner GET /v2/payments/{id} POST /v2/payments/refund GET /v2/payments/methods DELETE /v2/payments/{id}/void Identity & Auth 24 endpoints 2 collections · 32 endpoints selected Include all Required only Exclude PII Exclude internal GET · 14 of 18 fields exposed id String Payment identifier amount Integer Amount in minor units customer\_email PII String Customer's email address internal\_notes Internal String Ops annotations, never external 49 of 58 fields exposed 18 PII fields excluded one contract, five outputs OpenAPI spec file Hosted JSON/YAML, the canonical contract Theneo docs Publish to your documentation portal MCP server Auto-generated tools, contract endpoints only Postman collection Import-ready, with environments and auth TS TypeScript SDK Type-safe npm package Payments × Partner v1.0.0 Source drift detected PUBLISHED TO OpenAPI spec v1.0.0 Theneo docs v1.0.0 MCP server 14 tools Postman collection v1.0.0 TypeScript SDK v1.0.0 SOURCE COLLECTIONS Payments API 31 endpoints in contract Synced Identity & Auth 9 endpoints in contract Synced All endpoints exist in sources Contract schemas valid Approver assigned No breaking changes Someone shipped 5 changes today. Two would have broken a partner. Elva stopped them. payouts-partner · v1.4 DELETE /builds/{id} BREAKING Response field removed from schema +2 −9 a91f2c4 2h SCHEMA DIFF openapi.yaml · Build Build: properties: id: { type: string } status: { type: string } \- buildLog: \- type: string \- description: Full build output + logUrl: + type: string, format: uri IMPACT Consumers reading buildLog 2 services Partner builds affected 1 partner MCP tools referencing field 1 tool Publish blocked by policy Review GET /billing/plans BREAKING Auth scope tightened on billing routes +3 −1 7e15b02 4h SCHEMA DIFF openapi.yaml · security security: \- \- bearerAuth: \[\] + \- oauth2: + \- read:billing + \- read:plans IMPACT Keys missing read:billing 3 keys Acknowledgements pending 2 of 4 Grace period set 14 days Awaiting 2 acks Remind Click any change to see the exact schema diff and who it breaks. [How contracts work →](https://getelva.ai/contracts.md) 04 · PUBLISH MCP server generation and hosting ## Run your MCP servers like real infrastructure Generate an MCP server from any API. Hosted, authed through Elva's MCP gateway, fully logged. Not weekend demos. Claude Desktop 129 calls today Cursor IDE 89 calls today ChatGPT 34 calls today ![Elva MCP gateway](https://getelva.ai/uploads/logo-animation.png) MCP GATEWAY Claude Desktop 129 calls today Cursor IDE 89 calls today ChatGPT 34 calls today ![Elva MCP gateway](https://getelva.ai/uploads/logo-animation.png) MCP GATEWAY Claude, Cursor, or any MCP client. The contract decides which tools each audience sees, auth and logging come standard. Agents install it in one line `npx elva mcp add payments` Hosted or self-hosted Per-tool auth scopes Full call logs 05 · IMPROVE Playground and agent feedback ## Try the MCP Playground, then read the agent feedback Test the server with a real agent in the Playground. Once it is live, the agents calling it tell you which tools confused them. _MCP Playground demo: an agent is pointed at the acme-payments v2 server (23 tools) and asked, "Refund the duplicate charge on order 4821 and confirm it went through." It calls get\_payment\_status, list\_transactions, refund\_charge in that order, and the gateway denies the last one because it is missing an output schema. The agent then answers: Order 4821 was captured twice for $240.00. The duplicate is txn\_9f21. I cannot refund it from this server: refund\_charge is held back until its output schema verifies, so the gateway denied the call. Playground calls do not count against your quota._ Agent feedback Summarize with AI Filter by date 3 open · 1 critical Claude Critical 2h ago The tool description does not clearly explain when it should be used. GET /customers/{customerId} ChatGPT 4h ago The tool failed to return a response after multiple attempts. I could not complete the request because the MCP server kept timing out. POST /orders Cursor 4h ago The tool requires too many parameters for a simple request. GET /products/{productId} filed by the agents calling acme-payments v2 scored into the catalog ## The MCP gateway your agents call Claude, Cursor, and your partners connect to a hosted server with scoped keys. Every call is checked and logged, and your credentials never leave Elva. 847 agent calls in the last 24 hours. 27 failed. Here is who, with which key, at what cost. mcp.elva.dev/acme-payments TOTAL REQUESTS 847 ↑ 6.7% from yesterday AVG RESPONSE 138ms P95 412ms ERROR RATE 3.2% 27 failed · 847 total TOKEN USAGE 124k avg 1,240 per call AGENT ACTIVITY Claude Desktop Last seen 2 min ago 129 calls today 6 tools used Cursor IDE Last seen 5 min ago 89 calls today 4 tools used P Partner Integration Bot Last seen 12 min ago 34 calls today 3 tools used API KEY USAGE · 24H Production Key \*\*\*\*7f2a most used: elva\_get\_users 4,120 calls 6 agents 12 errors Development Key \*\*\*\*3e1b most used: elva\_auth\_login 204 calls 2 agents 9 errors CI Pipeline Key \*\*\*\*a4c0 most used: elva\_get\_analytics 861 calls 1 agent 3 errors Every call logged with agent, key, tool, latency, and outcome. Export to your SIEM. [MCP Management →](https://getelva.ai/mcp.md) Elva agent ## Tell the Elva agent what to ship Contract generated, MCP updated, changelog drafted, stakeholders notified. Hi Natia, I’m Elva 👋 What would you like to ship today? Suggestions to get started with: Ship a new endpoint to partners Update the MCP server Other Ship the /payouts endpoint and tell the partners team. Contract generated for the partner audience payouts-partner · v1 Added to the acme-payments MCP server 2 new tools Changelog drafted for review 1 breaking note 3 stakeholders notified partners-team@acme.com IN PRACTICE From production ## Numbers from teams running Elva Three write-ups from real deployments: what governed MCP servers, structured errors, and per-audience contracts change in practice. [ 489,000 tool calls, zero surprises ### Ninety days of one production MCP server serving four agents. Every anomaly attributed to a specific agent and key within minutes. Read the numbers → ](https://getelva.ai/blog/23-tools-4-agents-zero-surprises.md)[ 71% fewer retries in a week ### Across 1.2 million tool calls, one vague error message drove a third of retry traffic. Structured errors naming the field fixed it. Read the numbers → ](https://getelva.ai/blog/what-1-2-million-tool-calls-taught-us.md)[ 31 zombie endpoints retired ### One team, first quarter on contracts: for the first time they could prove no active consumer referenced the endpoints they deleted. Read the numbers → ](https://getelva.ai/blog/contracts-one-api-four-audiences.md) ENTERPRISE For the security review ## Answers the security review before it asks SOC 2 Type II, ISO 27001 and GDPR on the infrastructure Elva runs on. SSO and SCIM from the identity provider you already run. Hosted, in your own cloud, or on-prem. ### Certified infrastructure - SOC 2 Type II certified - ISO 27001 / 27701 certified - GDPR compliant [Full security posture →](https://getelva.ai/security.md) ### Runs where your perimeter ends - Hosted SaaS Managed upgrades, 99.9% SLA - Private cloud Your VPC, your KMS keys - On-prem Air-gapped, no egress ### Works with every identity provider Identity providers were built for people signing in to apps. Elva extends the one you already run to AI agents, so access follows your existing teams and roles. Okta Microsoft Entra ID Auth0 WorkOS Google Workspace Ping Identity Any SAML / OIDC - SAML 2.0 and OIDC single sign-on, enforced across every workspace - SCIM keeps groups, roles, and deprovisioning in sync - Every agent gets its own identity in the audit trail [See the enterprise platform →](https://getelva.ai/enterprise.md) ## FAQ ### What is Elva? Elva is the system that discovers every API in your codebase, understands and scores them, governs what each audience can access, and exposes them to developers, applications, and AI agents through documentation, SDKs, and hosted MCP servers. Elva sits between your codebase and everything that consumes your APIs. It is built by Theneo and used by teams from startups to Fortune 500 companies. ### Is Elva an API gateway? No. Elva sits above your repositories and existing gateways. It discovers, governs, and exposes APIs while your gateway keeps handling runtime traffic. The exception is MCP: Elva hosts and gates MCP servers itself, with scoped keys, per-tool authorization, and full call logs. ### How is Elva different from Postman? Postman is where developers work with individual requests. Elva is the system of record for an organization's entire API estate: what exists, who owns it, what each audience can access, and what agents are calling. ### Does Elva need an OpenAPI spec to start? No. Elva derives the catalog from your code by reading route registrations, validators, and serializers, then emits OpenAPI 3.1 as an output. Existing specs are imported and kept in sync with the code on every commit. ### How does Elva work with AI agents? Elva generates MCP servers from your API contracts and hosts them behind an auth gateway with scoped keys, per-tool authorization, and full call logs, so Claude, Cursor, ChatGPT, and partner agents can use your APIs safely. ### How much does Elva cost? The Free plan covers 1 repo and 1,000 tool calls a month, forever. Startup is $100 per month flat, Business is $600 per month billed annually, and Enterprise is custom. Every plan includes unlimited members. ### Is Elva ready for an enterprise security review? SOC 2 Type II and ISO 27001/27701 are certified and GDPR is covered by a DPA, all held by Theneo and covering the infrastructure Elva runs on. SSO, SAML, OIDC, and SCIM work with the identity provider you already run, and Elva deploys as hosted SaaS, in your private cloud, or on-prem. ### Who builds Elva? Elva is built by Theneo, the API documentation company whose platform is used by 20,000 companies. ## Ship APIs any agent can call Humans, tests, partners, agents. One catalog, one contract, one place. `npx elva init` [Sign up free](https://app.getelva.ai/signup) [Elva vs Postman](https://getelva.ai/vs/postman.md)