Elva

Elva is an API management platform built by Theneo, the API documentation company behind a platform the vendor states is used by 20,000 companies. It sits between your codebase and everything that consumes your APIs — developers, partner integrations, and AI agents — providing automatic discovery, scoring, governance, and hosted MCP server generation in one pipeline. Elva is actively available with a free tier and paid plans, and requires no existing OpenAPI spec to get started.

What It Is

Elva is a full-lifecycle API management system designed for the agentic era, where AI agents like Claude, Cursor, and ChatGPT are first-class API consumers alongside human developers. It scans your repositories to discover every endpoint, generates OpenAPI 3.1 specs from code, scores each endpoint on design, security, developer experience, and AI readiness, and then governs what each audience — internal teams, partners, public developers, or AI agents — can access. The result is a single catalog, contract, and MCP server pipeline that replaces the manual coordination typically spread across Postman, spec files, and internal wikis.

How the Pipeline Works

Elva's workflow runs in five stages it calls Discover, Understand, Contract, Publish, and Improve:

• Discover: Connect a repo; Elva scans route registrations, validators, and serializers to build a complete endpoint catalog and emit an OpenAPI 3.1 spec. Rescans can be triggered manually, weekly, or on every commit depending on plan.
• Understand: Every endpoint is scored across design, developer experience, AI readiness, security, and performance. One-click AI fixes address missing descriptions, untyped response fields, and undocumented auth.
• Contract: Define who gets what — internal service, partner, public developer, or AI agent — and which fields are exposed or excluded (e.g., PII fields). Elva diffs every commit against the contract and blocks or notifies on breaking changes.
• Publish: From one contract, Elva generates and deploys an OpenAPI spec, Theneo documentation, a hosted MCP server, a Postman collection, and a TypeScript SDK simultaneously.
• Improve: An MCP Playground lets teams test servers with a real agent before going live. Once live, agent feedback on tool confusion is surfaced back into the catalog for fixes.

MCP Server Hosting and the Gateway

A core differentiator is Elva's MCP gateway, which hosts MCP servers as real infrastructure rather than one-off scripts. Each server is generated from an API contract, so only the endpoints and fields the audience is permitted to see are exposed as tools. The gateway provides:

• Scoped API keys with per-tool authorization
• Full call logs including agent identity, key, tool, latency, and outcome
• OAuth2 auth on Business and Enterprise plans
• Per-agent and per-key analytics with error attribution
• Log export to SIEM on Enterprise

Agents install a server in one CLI command (npx elva mcp add payments). The vendor's blog posts describe production deployments handling hundreds of thousands of tool calls, with anomalies attributed to specific agents and keys within minutes.

Governance and Breaking-Change Control

Elva's contract system is designed to prevent breaking changes from reaching consumers silently. When source code drifts from a published contract — a field removed, an auth scope tightened — Elva detects the diff, shows exactly which consumers are affected, and applies the configured policy: notify, warn, or block publish. GitHub PR comments, Slack alerts, and webhooks are available on Business and above. Approval workflows and a full exportable audit trail (actor, action, policy, result, timestamp) are available on Enterprise, making the system suitable for regulated environments and security reviews.

Enterprise Deployment and Security Posture

Elva supports three deployment models: hosted SaaS with a 99.9% SLA, private cloud in the customer's VPC with their own KMS keys, and fully air-gapped on-premises installs. The vendor states that SOC 2 Type II and ISO 27001/27701 certifications are held by Theneo and cover the infrastructure Elva runs on, with GDPR covered by a DPA. SSO via SAML 2.0 and OIDC, plus SCIM provisioning, are available on Enterprise and work with Okta, Microsoft Entra ID, Auth0, WorkOS, Google Workspace, Ping Identity, and any SAML/OIDC provider. Every AI agent gets its own identity in the audit trail, inheriting team roles rather than sharing a generic account.

Why It Matters for Agentic Workflows

Traditional API management assumed human developers as the primary consumer. Elva's design treats AI agents as first-class consumers with the same auth, rate limits, and logging as any partner integration. The scoring system quantifies "AI readiness" per endpoint, the contract system controls exactly which tools an agent sees, and the MCP gateway logs every call with enough detail to attribute failures to a specific agent and key. The vendor positions this as the missing layer between a codebase and the growing ecosystem of agents that need to call production APIs safely.