Zuplo has written the gateway vendor’s case for MCP, and it is more careful than most. In Consuming or Providing MCP Servers: Why A Gateway Matters for Both, the argument is that the two sides of MCP, the platform team connecting agents to many servers and the API provider exposing its platform through one, “come with similar governance needs”: tool discovery, authentication and authorization, routing, monitoring and metering. A consumer needs to “expose only the tools each team or role needs,” because “a sea of individual MCP tool permissions is hard to govern at scale, leading to shadow MCP servers with overpermissioned access and privilege drift.” A provider needs per-key authentication, rate limits, and a way to “charge per tool call.”
The figures come from third parties and Zuplo’s own report, and the post attributes them. It cites more than 26,000 unique servers in the official registry, 56 percent of them remote-hosted, from an independent audit; 15x year-over-year growth in active agents in Microsoft 365 from Microsoft’s Work Trend Index; and its own State of MCP Report for the claim that gateways “are already the most common way to expose an MCP server,” which is a gateway vendor’s survey about gateways. What survives is the section most vendor posts leave out. “To be fair, there are possible drawbacks.” A gateway is an extra infrastructure expense, and where “MCP creators versus consumers may sit within highly separated domains,” keeping the two sides apart “may simply make more sense operationally.”
The catalog holds both halves of Zuplo’s argument in its record. The Zuplo provider page lists 13 API pages, and the providing side is the Zuplo MCP Servers API, which turns OpenAPI-backed routes into a remote server, with per-key metering through the Zuplo API Keys - Consumers API and the Zuplo API Keys - Keys API, and the audit trail in the Zuplo Audit Logs API. The agentic access profile maps 45 operations, 26 of them acting. On the Agent Readiness score the MCP server, agent skills, error semantics, auth clarity and protected resource metadata are lit.
The Kin Score is 59.6, strong band, with access clarity at 68.4, contract quality at 62.8 and operational transparency at 60.5 against contract governance at 27.3. The Agent Readiness score is 38.3, agent-ready. The unlit dimensions are the ones the post’s provider checklist leans on: delegated identity and dynamic client registration, which are how an agent arrives without a pasted key, and idempotency and reversibility, which are what metered, per-call billing needs most when a call is retried. Zuplo sells the layer that enforces policy on other people’s servers. Its own contract has the gateway half covered. The agent half of its identity story is still unlit.