Put your AI agents to work on
the systems you already have.
apistash is a hosted MCP server that connects your agents to your tools, APIs, and knowledge through one endpoint — so they work on your real infrastructure, instead of a bespoke integration for every task.
Add to your MCP client config
{
"mcpServers": {
"apistash": {
"type": "http",
"url": "https://api.apistash.io/mcp",
"headers": {
"X-API-Key": "YOUR_API_KEY"
}
}
}
}Works with the MCP clients you already use
- Claude Desktop
- Cursor
- Windsurf
- Cline
- Continue
- OpenCode
- Gemini CLI
- + any MCP-compatible client
Why apistash
One endpoint replaces a stack of integrations
Instead of wiring up a bespoke integration for every tool, dataset, and system, connect them to apistash once — and every agent, on every team, can act on them through a single endpoint.
Act on your systems
Custom HTTP connectors let agents trigger your pipelines, fire webhooks, and call your internal APIs — alongside 70+ built-in tools.
Work from your knowledge
ADRs, coding standards, design guidelines, reports — resources your agents read for the project at hand.
Keep every agent consistent
Shared, versioned prompts so every agent, on every team, follows the same instructions and standards.
Shared across your teams
One catalogue, scoped per team — internal or external — with enterprise SSO through your own domain.
Your agent, working on your stack
You
Deploy the payments service to staging, then check it against our rollout checklist.
apistash
Agent
Deployed v2.3.1 to staging. Every checklist item passes except the metrics dashboard — flagged for review.
Built-in tools
70+ tools, ready to use
A growing catalogue of built-in tools across eight categories — callable the moment you connect.
Math
Expression calculator
Time
Datetime, workdays, holidays
Encoding
JWT, TOTP, hashing, Base64/32
Utility
UUID generate & validate
Conversion
Units + JSON/YAML/TOML/XML
Web
URL parse, build, encode
Validation
Email and more
Cache
Store values across sessions
Search, Audio, and Image categories are on the way.
Custom tools
Let your agents act on your systems
Turn any HTTP API into a tool your agent calls by name — trigger a deploy, fire a webhook, hit an internal service. No code, just a declarative connector.
Pipelines, webhooks, any API
Point a connector at your CI/CD, a webhook, or an internal service — method, URL, headers, body, and an input schema.
No code, just a connector
A declarative request definition, not code — edit or swap it any time, with no deploy.
A first-class tool instantly
Once created, your agent calls it by name exactly like a built-in — no wrapper, no glue.
Upstream credentials stay encrypted server-side — never exposed to the model.
// one custom-tool connector
{
"name": "trigger_deploy",
"method": "POST",
"url": "https://ci.acme.com/deploy",
"auth": { "type": "bearer" }
}→ your agent now has a trigger_deploy tool.
Shared knowledge
Give your agents your knowledge, not just tools
Resources are the documents and data your agents read to work on your projects — the decisions, standards, and context they'd otherwise have to guess.
Decisions & standards
ADRs, coding standards, design guidelines — so agents follow how your team actually builds.
Live data & reports
Store reports and generated data over the REST API — from your test pipelines and beyond — and agents always read the latest.
Shared & versioned
One catalogue across your teams; every change is a new version. Agents can even keep it current themselves.
- adr/0007-auth-token-rotation.md
- standards/typescript.md
- design/brand-voice.md
- reports/perf/2026-01.json
Teams & access
Built for teams — with access you control
One hosted server for your dev and IT teams — internal or external — with fine-grained control over what every agent can reach.
Shared catalogue, scoped per team
apistash catalogue
one shared library
A shared catalogue
One library of tools, prompts, and resources — shared, never duplicated.
Per-team toolsets
Scope content per team, so each agent gets exactly what it should.
Scoped credentials
API keys and OAuth, scoped to just what each agent needs.
You decide the reach
Grant access on purpose — a leaked key touches only what you allowed.
Security & privacy
Your data stays yours
apistash is a secure conduit between your agent and the services you connect — nothing more.
Credentials never leave the server
Your upstream API secrets are encrypted at rest and injected server-side — the model only ever sees results.
No training on your data
We never store, analyze, or train on the content of your requests or responses.
Hardened connectors
Custom tools reach public HTTP/HTTPS endpoints only; private, loopback, and cloud-metadata addresses are blocked, redirects are not followed, and responses are capped.
Revoke instantly
Every API key and OAuth client is scoped and can be revoked the moment you need to.
Common questions
Everything you need to know about apistash.
What can apistash do?
apistash is a hosted MCP server that gives your agent three things through one endpoint: tools — 70+ built-in utilities (math, hashing, JWT & TOTP, encoding, UUIDs, unit & data-format conversion, URL helpers, caching) plus your own custom API connectors; prompts — reusable, versioned templates; and resources — documents and data your agent can read. Browse the full catalogue in our documentation. New tools ship regularly.
What is the Model Context Protocol (MCP)?
MCP is an open standard that lets AI assistants (like Claude, and other MCP-compatible agents) securely discover and call external tools, prompts, and resources. Think of it as a universal plugin system for AI agents — apistash implements this protocol so your agent can reach everything you connect through a single server.
Can I add my own API as a tool?
Yes. A custom tool is a declarative connector to any HTTP API. You define the request — method, URL, headers, body — and its input schema in the dashboard, and apistash exposes it to your agent as a first-class MCP tool. Credentials for the upstream API are encrypted at rest and never exposed to the model.
Can my agent create and manage tools, prompts, and resources itself?
Yes. Beyond using them, your agent can create and maintain its own prompts, resources, and custom tools over MCP — adding what's missing and refining what fell short, mid-session. It works in your personal and team spaces with your credential's permissions; publishing to the organization catalogue and setting connector secrets stay human actions in the dashboard. See the guides.
Can my team use apistash together?
Yes. Create an organization to share a catalogue of tools, prompts, and resources with your members, and use teams to scope who can reach what. Access is governed by roles and per-credential policies, so each API key or OAuth client only ever sees what you allow.
Do I need an account to use apistash?
Yes — connecting requires a free account and an API key (or an OAuth connection); there is no anonymous access. Creating one is free and takes a minute. You then pick which of the built-in tools your agents reach, and add your own custom tools, prompts, resources, per-key scoping, and organizations & teams.
How do I connect apistash to my AI agent?
Add a single entry to your MCP client's config file with the URL https://api.apistash.io/mcp and your API key in the X-API-Key header (or an OAuth token, if your client supports it) — every MCP request must be authenticated. Then pick the tools your agent should reach under Settings → MCP Settings in the dashboard. Works with Claude Desktop, Cursor, Windsurf, and any other MCP-compatible client. Our Get Started guide walks through the setup in under two minutes.
Is apistash free?
Yes — the free tier is genuinely free. Create a free account, connect an API key or OAuth token, and use the built-in tools plus custom tools, prompts, resources, and team features at no cost. Higher-volume Pro and Enterprise tiers are on the way; today everything runs on the free tier, and we will never artificially throttle free usage to push upgrades.
How does apistash handle my API credentials?
Secrets for your custom-tool connectors — the API keys, bearer tokens, or basic-auth credentials of the upstream services you connect — are encrypted at rest and injected server-side when the call is made. They are never returned by the API and never exposed to the AI agent, which only ever receives the structured result.
Does apistash collect or analyze my data?
No. We do not save, analyze, or train on the content of your requests or responses. apistash acts strictly as a secure conduit between your AI agent and the services you connect. The only data we collect is high-level telemetry — tool usage counts and performance metrics — used solely to keep the platform reliable.