Zuplo
Programmable API gateway on the edge — GitOps deploys, TypeScript policies, OpenAPI-native routing.
About
Zuplo is a fully managed, edge-deployed API gateway built for developer experience. Routes are defined directly in an OpenAPI file, policies are configured as JSON or written in TypeScript, and every Git branch maps to its own environment, so API changes ship through the same pull-request workflow as application code. It runs on V8 isolates across 300+ edge locations, and every plan includes a Zudoku-based developer portal, an AI gateway, and an MCP Server handler that can expose OpenAPI operations as MCP tools for AI agents.
The honest picture: the gateway runtime itself is closed source, so teams wanting a fully self-hostable gateway should look at open-source alternatives. Private connectivity (VPC/tunnels) costs extra on top of base tiers, and while the free tier is generous for prototypes, usage-based pricing can surprise teams with spiky traffic. Push-triggered deploys are GitHub-only; GitLab and Bitbucket users deploy via the CLI from their own CI.
What it can do
- OpenAPI-native routing deployed to 300+ edge locations
- TypeScript custom policies and request handlers
- GitOps environments — one per branch, production from default branch
- Built-in API key auth, OAuth, and rate limiting
- Hosted MCP servers generated from your OpenAPI spec
- Developer portal with self-serve API keys on every plan
Setup
Sign up at zuplo.com, connect a GitHub repo containing your OpenAPI file, and push — Zuplo deploys a global gateway per branch. Configure policies in the dashboard or as code.
Prerequisites
An OpenAPI spec for your API; a GitHub account for push-triggered deploys (or any CI for CLI deploys).
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 53; Trending score 75/100 from researcher assessment.
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.