All the building blocks for production MCP servers
Use the dashboard builder, Manager MCP agent builder, hosted runtime, OAuth, workflow tools, testing, snapshots, and public sharing to move from internal platforms, SaaS products, or GraphQL backends to live remote HTTP MCP servers.
Compatible Platforms
Six pillars, one hosted MCP workflow
Build the server, authenticate upstream APIs, compose tools, shape output, deploy the endpoint, then share it when it is ready.
Build
Create MCP servers in the visual wizard or through the API To MCP manager server from your AI agent.
- Visual server wizard
- REST and GraphQL integrations
- https://mcp.apitomcp.io/
Authenticate
Support upstream APIs that use no auth, API keys, Bearer tokens, Basic Auth, OAuth, or employee authorization flows.
- OAuth Client Credentials
- Employee OAuth Authorization Code
- API key, Bearer, Basic Auth
Compose
Expose direct API calls or combine multiple API tools into one workflow tool.
- API tools
- Workflow tools
- Step output mapping
Shape Output
Use JMESPath to return clean JSON that is easier for AI agents to read and act on.
- JMESPath response mapping
- Generated output schema
- Structured tool responses
Deploy
Publish hosted Streamable HTTP MCP endpoints on apitomcp.io.
- Open or authenticated access
- SSL endpoints
- Usage tracking
Share
List live MCP servers in the public directory or publish reusable snapshots for forking.
- Public MCP directory
- Forkable snapshots
- Published revisions
Authentication for real-world APIs
API To MCP separates upstream API authentication from MCP server access, so teams can support REST and GraphQL APIs, private systems, and employee-authorized platforms.
Credential security
Stored API keys, Bearer tokens, Basic passwords, OAuth client secrets, access tokens, and refresh tokens are encrypted at rest and masked in the owner UI.
No Authentication
For public APIs and open-data endpoints that do not require credentials.
API Key
Send keys in headers or query parameters for services that use token-style access.
Bearer Token
Store a token securely, or forward the Bearer token supplied by the connected agent.
Basic Auth
Use username and password authentication for legacy or internal APIs.
OAuth Client Credentials
Use machine-to-machine OAuth for billing, commerce, operations, and internal services.
OAuth Authorization Code
Let every employee or end user connect their own upstream account without an API To MCP account.
MCP access modes
Choose how AI clients connect to the MCP server itself. This is separate from the credential used to call the upstream API.
Practical MCP use cases
The same platform works for employee-authorized business tools, public tools, OAuth-connected SaaS tools, internal APIs, and multi-step workflows.
Public Data MCPs
Publish open-data APIs such as weather, country data, exchange rates, or Hacker News as no-auth MCP servers.
Employee-authorized platform MCPs
Let every employee connect their own account on your company CRM, ERP, support, HR, or finance platform with OAuth Authorization Code.
Internal API MCPs
Expose private APIs with stored credentials, client-token access, or authenticated MCP access.
Workflow MCPs
Chain calls like fetch record, enrich details, then return one summary-ready JSON result.
Agent-built integrations
Use Codex, Cursor, Claude Code, or another remote MCP client to create, update, test, and deploy servers.
Security for live servers, snapshots, and user connections
API To MCP keeps live servers, MCP access, upstream credentials, and forkable snapshots separate so teams can publish safely without leaking secrets.
- Secrets are encrypted at rest and masked in owner-facing edit screens.
- Production encryption keys can be isolated from the app through AWS Secrets Manager and KMS.
- Listed servers expose enough upstream context for users to review before connecting.
- Snapshots copy configuration and tools, not live server access or stored secrets.
- OAuth Authorization Code creates per-end-user upstream connections without requiring an API To MCP account.
Stored secrets
API keys, Bearer tokens, Basic passwords, OAuth client secrets, access tokens, and refresh tokens stay encrypted at rest.
Owner editing
Credential values stay masked in the dashboard unless the owner explicitly replaces them with a new value.
Forkable snapshots
Snapshots preserve tools and configuration, but strip live credentials, runtime tokens, and private access state.
Production isolation
Production encryption keys can live outside the application database through AWS Secrets Manager and KMS-backed key handling.