--- title: "MCP Management — generate, authorize, observe · Elva" description: "Generate MCP servers from API contracts, put every tool call behind an authorization gateway with per-tool scopes, and log each call's agent and outcome." canonical: "https://getelva.ai/mcp" lastModified: "2026-09-01T23:11:23.016Z" --- MCP Management # MCP servers your security team will approve Generate MCP servers from your API contracts, put every tool call behind an authorization gateway, and see exactly which agent did what. Hosted, scoped, logged. [Deploy your first server](https://app.getelva.ai/signup) [Talk to security](mailto:hello@getelva.ai) OAuth2 + per-tool scopes Full call logs SSO / SAML On-prem available ![Claude](https://getelva.ai/assets/icons/claude.svg) Claude ![Cursor](https://getelva.ai/assets/icons/cursor.svg) Cursor Partner bot Authorization gateway mcp.elva.dev/acme-payments Active auth OAuth2 scopes per-tool rate 600/min logs on ✓ get\_payment\_status Claude scope ok · 98ms ✓ create\_invoice Cursor scope ok · 145ms ✕ delete\_account Partner bot denied · out of scope Your API · payments-api v2.4.1 23 tools exposed of 214 endpoints 99.9% UPTIME SLA 138 P95 GATEWAY LATENCY (MS) Every CALL LOGGED, NO SAMPLING 0 UNSCOPED TOOLS ALLOWED 01 MCP generation ## Servers built from contracts, not hand-written glue A contract already says which endpoints an audience can see and which fields they get. Elva turns that into a typed MCP server: curated tools, rich descriptions, output schemas, and an install page you can hand to a partner. Tools exposed curated from 214 endpoints 23 of 214 ✓ get\_payment\_status typed output read:payments ✓ create\_invoice idempotent write:billing ✓ list\_transactions paginated read:payments ! refund\_charge held back: missing output schema — 191 endpoints not exposed out of contract scope https://mcp.elva.dev/acme-payments Install page Curated, not dumped Agents choose tools by reading descriptions. A 214-tool server makes every choice worse. Elva exposes only what the contract allows and what scores well enough to be understood. Schema changes are gated A tool schema is a promise agents take literally. Remove a field an agent depends on and the publish is blocked until someone approves it. Hosted or your own cloud Run on Elva with a custom domain, or deploy inside your VPC on Enterprise. Same contracts, same logs, your perimeter. 02 Authorization gateway ## No agent gets a raw key to your API Every tool call passes through the gateway: identity checked, scope enforced, rate limited, logged. Keys are issued per agent and revoked in one click, and your upstream credentials never leave Elva. Keys and scopes Issue key elva\_live\_...8f2a Claude Desktop read:payments read:invoices 600 req/min elva\_live\_...c91d Cursor IDE read:payments 120 req/min elva\_test\_...44b0 Revoked 2m ago Elevated error rate, 5.8% · scope escalation attempt blocked Policy checks per call in order, fail closed 01 Identity OAuth2 token or managed key, mapped to an agent 02 Tool scope Is this key allowed to call this specific tool 03 Field redaction PII stripped from responses per contract 04 Rate and quota Per key and per tool, retry storms contained 05 Audit record Agent, key, tool, arguments hash, latency, outcome 03 MCP logs ## Answer “which agent did this” in one query Every call, not a sample. Filter by agent, key, tool, or outcome, export to your SIEM, and set retention to match your policy. When an auditor asks, the answer takes a minute. Live call log streaming Export TIME AGENT TOOL KEY LATENCY TOKENS OUTCOME 14:32:12 Claude Desktop get\_payment\_status ...8f2a 98ms 820 ok 14:32:10 Cursor IDE create\_invoice ...c91d 145ms 1,340 ok 14:32:08 Partner bot delete\_account ...44b0 4ms — denied · out of scope 14:32:06 Claude Desktop list\_transactions ...8f2a 172ms 4,100 ok 14:32:03 Windsurf refund\_charge ...7e15 210ms 960 error · schema mismatch 14:32:01 Partner bot sync\_ledger ...44b0 2410ms 2,200 ok · slow 14:31:59 Cursor IDE get\_customer ...c91d 88ms 640 ok retention 30 days on Business · custom on Enterprise export: JSON, CSV, webhook to SIEM 04 MCP insights ## See cost, latency, and blast radius per agent One agent doing most of your traffic is either your best integration or a retry loop. Insights separate the two, surface the tools that are slow or failing, and show what tokens are actually costing you. Tool calls (24h) 847 ↑ 6.7% from yesterday p95 latency 138ms streaming included Denied calls 12 9 scope, 3 rate limit Token spend (24h) 124k avg 1,240 per call Traffic by agent Claude Desktop 412 calls · 98ms Cursor IDE 233 calls · 145ms Partner bot 147 calls · 210ms Windsurf 55 calls · 132ms Needs attention 3 tools ! refund\_charge 14% errors · missing output schema ↑ list\_transactions 4,100 tokens avg · unpaginated ◷ sync\_ledger p95 2.4s · agents timing out Each of these becomes a fix suggestion in your catalog, so the next contract version ships without them. Enterprise readiness ## Built for the review your platform team runs Least privilege by default Tools ship scoped or they do not ship. No wildcard keys, no ambient access to endpoints outside the contract. Your credentials stay put Upstream API secrets live in the gateway, never in an agent config or a partner’s machine. Rotate without redistributing anything. Revoke in seconds One click kills a key, an agent, or a whole server. The log keeps everything it did up to that moment. SSO, SAML, SCIM Your identity provider owns who can publish and approve. Deprovisioning a person removes their access everywhere. Audit trail and approvals Who changed which contract, who approved the breaking change, and when the server picked it up. Exportable. Private cloud or on-prem Run the gateway inside your network with a custom domain, keep logs in your account, and satisfy data residency. ## FAQ ### What is the Elva MCP gateway? The hosted layer agents connect to. Every tool call passes five checks in order: identity, tool scope, field redaction per contract, rate and quota, and an audit record with actor, tool, arguments hash, latency, and outcome. ### Can Elva generate an MCP server from my API? Yes. MCP servers are generated from a contract view of your catalog, so agents only see the tools an audience was deliberately granted. Servers are hosted by Elva, or self-hosted on Enterprise. ### Which AI clients can connect? Any MCP client, including Claude, Cursor, and ChatGPT, plus partner agents using scoped keys through the same gateway. ### How many tool calls are included? 1,000 per month on Free, 25,000 on Startup, 250,000 on Business, and custom on Enterprise. Paid plans continue past the limit with metered overage at $10 per 10,000 calls. RELATED READING [ MCP Aug 27 · 5 min What is an MCP server, explained for API teams Read → ](https://getelva.ai/blog/what-is-an-mcp-server.md)[ MCP Aug 30 · 8 min Turning a code repository into an MCP server, compared Read → ](https://getelva.ai/blog/turning-code-repositories-into-mcp-servers.md)[ MCP Jul 14 · 8 min MCP servers are infrastructure. Run them like it. Read → ](https://getelva.ai/blog/mcp-servers-are-infrastructure.md) ## Give agents a door, not a spare key Deploy a scoped, logged MCP server from your first contract in minutes. [Sign up free](https://app.getelva.ai/signup) [See plans](https://getelva.ai/pricing.md)