MCP · 5 min
What is an MCP server, explained for API teamsRead →MCP Management
MCP servers your security team will approve
Generate MCP servers from your API contracts, put every tool call behind an authorization gateway, and see exactly which agent did what. Hosted, scoped, logged.
OAuth2 + per-tool scopesFull call logsSSO / SAMLOn-prem available
Claude
CursorPartner bot
Authorization gatewaymcp.elva.dev/acme-paymentsActive
auth OAuth2scopes per-toolrate 600/minlogs on
✓get_payment_statusClaudescope ok · 98ms
✓create_invoiceCursorscope ok · 145ms
✕delete_accountPartner botdenied · out of scope
Your API · payments-api v2.4.123 tools exposed of 214 endpoints
99.9%UPTIME SLA
138P95 GATEWAY LATENCY (MS)
EveryCALL LOGGED, NO SAMPLING
0UNSCOPED TOOLS ALLOWED
01MCP generation
Servers built from contracts, not hand-written glue
A contract already says which endpoints an audience can see and which fields they get. Elva turns that into a typed MCP server: curated tools, rich descriptions, output schemas, and an install page you can hand to a partner.
Tools exposedcurated from 214 endpoints23 of 214
✓get_payment_statustyped outputread:payments
✓create_invoiceidempotentwrite:billing
✓list_transactionspaginatedread:payments
!refund_chargeheld back: missing output schema
—191 endpoints not exposedout of contract scope
https://mcp.elva.dev/acme-paymentsInstall page
Curated, not dumpedAgents choose tools by reading descriptions. A 214-tool server makes every choice worse. Elva exposes only what the contract allows and what scores well enough to be understood.
Schema changes are gatedA tool schema is a promise agents take literally. Remove a field an agent depends on and the publish is blocked until someone approves it.
Hosted or your own cloudRun on Elva with a custom domain, or deploy inside your VPC on Enterprise. Same contracts, same logs, your perimeter.
02Authorization gateway
No agent gets a raw key to your API
Every tool call passes through the gateway: identity checked, scope enforced, rate limited, logged. Keys are issued per agent and revoked in one click, and your upstream credentials never leave Elva.
Keys and scopesIssue key
elva_live_...8f2aClaude Desktop
read:paymentsread:invoices600 req/min
elva_live_...c91dCursor IDE
read:payments120 req/min
elva_test_...44b0Revoked 2m ago
Elevated error rate, 5.8% · scope escalation attempt blockedPolicy checks per callin order, fail closed
01IdentityOAuth2 token or managed key, mapped to an agent
02Tool scopeIs this key allowed to call this specific tool
03Field redactionPII stripped from responses per contract
04Rate and quotaPer key and per tool, retry storms contained
05Audit recordAgent, key, tool, arguments hash, latency, outcome
03MCP logs
Answer “which agent did this” in one query
Every call, not a sample. Filter by agent, key, tool, or outcome, export to your SIEM, and set retention to match your policy. When an auditor asks, the answer takes a minute.
Live call logstreaming
Export
TIMEAGENTTOOLKEYLATENCYTOKENSOUTCOME
14:32:12Claude Desktopget_payment_status...8f2a98ms820ok
14:32:10Cursor IDEcreate_invoice...c91d145ms1,340ok
14:32:08Partner botdelete_account...44b04ms—denied · out of scope
14:32:06Claude Desktoplist_transactions...8f2a172ms4,100ok
14:32:03Windsurfrefund_charge...7e15210ms960error · schema mismatch
14:32:01Partner botsync_ledger...44b02410ms2,200ok · slow
14:31:59Cursor IDEget_customer...c91d88ms640ok
retention 30 days on Business · custom on Enterpriseexport: JSON, CSV, webhook to SIEM
04MCP insights
See cost, latency, and blast radius per agent
One agent doing most of your traffic is either your best integration or a retry loop. Insights separate the two, surface the tools that are slow or failing, and show what tokens are actually costing you.
Tool calls (24h)847↑ 6.7% from yesterday
p95 latency138msstreaming included
Denied calls129 scope, 3 rate limit
Token spend (24h)124kavg 1,240 per call
Traffic by agent
Claude Desktop412 calls · 98ms
Cursor IDE233 calls · 145ms
Partner bot147 calls · 210ms
Windsurf55 calls · 132ms
Needs attention3 tools
!refund_charge14% errors · missing output schema
↑list_transactions4,100 tokens avg · unpaginated
◷sync_ledgerp95 2.4s · agents timing out
Enterprise readiness
Built for the review your platform team runs
Least privilege by defaultTools ship scoped or they do not ship. No wildcard keys, no ambient access to endpoints outside the contract.
Your credentials stay putUpstream API secrets live in the gateway, never in an agent config or a partner’s machine. Rotate without redistributing anything.
Revoke in secondsOne click kills a key, an agent, or a whole server. The log keeps everything it did up to that moment.
SSO, SAML, SCIMYour identity provider owns who can publish and approve. Deprovisioning a person removes their access everywhere.
Audit trail and approvalsWho changed which contract, who approved the breaking change, and when the server picked it up. Exportable.
Private cloud or on-premRun the gateway inside your network with a custom domain, keep logs in your account, and satisfy data residency.
FAQ
What is the Elva MCP gateway?
The hosted layer agents connect to. Every tool call passes five checks in order: identity, tool scope, field redaction per contract, rate and quota, and an audit record with actor, tool, arguments hash, latency, and outcome.
Can Elva generate an MCP server from my API?
Yes. MCP servers are generated from a contract view of your catalog, so agents only see the tools an audience was deliberately granted. Servers are hosted by Elva, or self-hosted on Enterprise.
Which AI clients can connect?
Any MCP client, including Claude, Cursor, and ChatGPT, plus partner agents using scoped keys through the same gateway.
How many tool calls are included?
1,000 per month on Free, 25,000 on Startup, 250,000 on Business, and custom on Enterprise. Paid plans continue past the limit with metered overage at $10 per 10,000 calls.
Give agents a door, not a spare key
Deploy a scoped, logged MCP server from your first contract in minutes.