Expose an API to agents

Expose your APIs to agents, without a second access control.

One extension in the contract, and the operation becomes an MCP tool: same authorisation, same quota, same audit line as a REST call. No MCP server to write, no second access control to maintain.

The path

Declarex-flexway-tool on the operation, in the contract you already have
AuthoriseOAuth 2.1 resource server: the agent gets a token like any application
DelegateThe user's token is never relayed; it is exchanged when the upstream verifies tokens; delegation is bounded
AuditEach tool call in the same trace and log as a REST call

An agent bypasses nothing: it goes through the decision that already protects your APIs, and its calls read in the same place.

Open this template in the editor

Configuration

The mcp-tools example, as it ships with Flexway v1.6.3.

examples/mcp-tools/flexway.yaml

# Agent tools from the contract: one line per host declares the MCP surface, then x-flexway-tool
# per operation. A token must be issued for that URL (RFC 8707); it is never relayed upstream.
version: 1
contracts:
  openapi: ./openapi.yaml
upstreams:
  default:
    url: http://orders.internal:8080
auth:
  tenant_header: X-Tenant
  issuers:
    - name: customers
      discovery: https://login.example.net/.well-known/openid-configuration
      audience: api                              # REST tokens; MCP tokens carry the resource below
      tenant_claim: org
agents:
  mcp:
    resources:
      api.example.com: https://api.example.com/mcp

Features

What is delivered in the published release v1.6.3, and what is coming; a feature is never shown as delivered before its release.

Feature	Status
MCP surface: the contract's operations offered as tools	Delivered · v0.1.0
OAuth 2.1 resource server, RFC 9728 metadata	Delivered · v0.1.0
RFC 8693 token exchange: human subject, agent actor	Delivered · v0.1.0
Delegation bounded in time and depth, cascading revocation	Delivered · v0.1.0
MCP federation: existing MCP servers under the same authorisation, quota and audit	Delivered · v0.1.0
A2A governance: signed agent cards, traffic under quota and audit	In progress

Going further

Let's talk about your gateway

Flexwiz is a young company: you talk directly with the person who founds it. Tell us what you want to run through Flexway. We talk about your infrastructure and your digital sovereignty requirements.

Talk to an expert Write to Flexwiz

Online booking is coming soon; until then, an e-mail is enough.