Product Contracts MCP India Stack Pricing FAQ Start free
MADE IN INDIA Data residency in Mumbai & Hyderabad

API management, rebuilt for India's agentic era

Sutra discovers every API in your repo, governs what each audience can access, and exposes it to developers and AI agents. Catalog, contracts, testing and hosted MCP servers in one pipeline — wired into UPI, ONDC, Account Aggregator and the rest of India Stack. No OpenAPI spec required.

Start free See how it works

Free tier · No credit card · INR billing · No spec needed

sutra sync kirana/payments-api live

Built for the teams shipping India's API layer

KiranaPayDhan SystemsONDC Sellers Co.Setu Logistics Vyapar CloudNucleus FintechBharatRailAadhaar Bridge GST GenieNamma CommercePaisa LabsIndus Health

01 · Discover

Automatic API discovery

Point Sutra at a repo and it produces a complete API catalog — even when nobody ever wrote a spec. Works on Django, FastAPI, Express, Spring Boot and Go.

done

Connect the repo

git · 1,204 files scanned

done

Specs generated

OpenAPI 3.1 · 214 endpoints

done

Scored & flagged

agent-ready 73% · 2 breaking

live

MCP server live

hosted · auth · logging

agent-ready in 42s · rescan armed on every commit · runs in ap-south-1
0
Endpoints discovered
0
Auth coverage
0
Tools exposed
0
Agent ready

02 · Understand

Know how agent-ready your APIs really are

Every endpoint scored on design, security and AI readiness. One-click AI fixes that write descriptions straight from your code. Test the traditional way too.

Your API results by category

Scores across 12 collections · kirana/payments-api
Design92%
Developer experience84%
AI readiness71%
Security64%
Performance59%
BEFORE
C71%
AI readiness · payments-api
!31 endpoints missing descriptions
!12 untyped response fields
!4 endpoints with undocumented auth
!UPI callback payloads unversioned

03 · India Stack

The rails your APIs already sit on

Sutra ships first-class connectors for the public infrastructure Indian products are built on. Import the upstream contract, diff against it on every commit, and expose a governed MCP tool for each.

UPI
UPI / NPCI

Collect, mandate and payout specs with callback schemas.

Connector live
ON
ONDC

Beckn protocol schemas for search, select, init, confirm.

Connector live
AA
Account Aggregator

Sahamati consent flows and FI data fetch contracts.

Connector live
DL
DigiLocker

Issued-document pull and eSign request/response types.

Connector live
GST
GSTN

Returns, e-invoice IRN and e-way bill endpoints.

Connector live
BBP
Bharat BillPay

Biller discovery, fetch and payment confirmation.

Beta
KYC
CKYC / eKYC

Offline Aadhaar XML and CKYC search contracts.

Beta
OCN
OCEN

Loan agent and lender API contracts for embedded credit.

Coming soon

04 · Contracts

API contracts decide what ships

Pick the audience, the endpoints, the fields they get and where it ships. Sutra then diffs every commit against that promise and tells you the moment the source drifts away from it.

Step 1 · Who is this contract for?

Step 2 · Which endpoints does the partner get?

GET/payouts/{payoutId}included
POST/payoutsincluded
GET/upi/collect/{txnId}/statusincluded
POST/upi/mandateincluded
DELETE/builds/{id}excluded
GET/internal/ledger/rawexcluded

Step 3 · Which fields leave your perimeter?

payout.idexposed
payout.amount · payout.currencyexposed
payout.utrexposed
payee.vpamasked · DPDP
payee.panredacted · DPDP
internal.riskScoreblocked

Step 4 · Where does this contract ship?

Developer portal · docs.kirana.in/partnerspublish
OpenAPI 3.1 bundlepublish
Hosted MCP server · 2 toolspublish
Postman collectionpublish
Changelog & partner emailon approval

Step 5 · Live and watched

v1.4payouts-partnerlive · 1 partner
CIDiffed on every push to mainarmed
SLABreaking change blocks the mergeenforced
LOGEvery partner call attributed to a keyretained 90d

Someone shipped 5 changes today. Two would have broken a partner. Sutra stopped them.

openapi.yaml · Build
Build:
properties:
id: { type: string }
status: { type: string }
- buildLog:
- type: string
- description: Full build output
+ logUrl:
+ type: string, format: uri
Impact
!Consumers reading buildLog2 services
!Partner builds affected1 partner
~MCP tools referencing field1 tool
Publish blocked by policy
openapi.yaml · security
/upi/collect/{txnId}/status:
get:
- security: [ { partnerKey: [] } ]
+ security:
+ - partnerKey: [ upi:read ]
+ - mtls: []
Impact
!Partner keys without upi:read1 partner
!Agents calling the tool today34 calls/day
✓Sandbox unaffectedno change
Publish blocked by policy

Click any change to see the exact schema diff and who it breaks.

05 · Publish

Run your MCP servers like real infrastructure

Generate an MCP server from any API. Hosted in India, authed through Sutra's MCP gateway, fully logged. Not weekend demos.

CClaude Desktop129 calls today
CuCursor IDE89 calls today
GChatGPT34 calls today
PPartner agent22 calls today
MCP GATEWAY
Scoped. Authed. Logged.
mcp.sutra.dev/kirana-payments
38paymentsA · 92%
24identityB · 84%
17billingB · 83%
12ondc-sellerA · 90%

Claude, Cursor or any MCP client. The contract decides which tools each audience sees; auth and logging come standard.

$npx sutra mcp add payments
✓Hosted in ap-south-1 or self-hosted
✓Per-tool auth scopes
✓Full call logs, exportable to your SIEM

06 · Improve

Try the playground, then read the agent feedback

Test the server with a real agent in the playground. Once it is live, the agents calling it tell you which tools confused them.

MCP Playground · kirana-payments v2 · 23 tools
Test your MCP tools

Ask the agent to do something with your server. It picks the tools and shows you every call it made.

Claude Sonnet 4.6
Agent feedback · 3 open · 1 critical
ClaudeCRITICAL2h ago

The tool description does not clearly explain when it should be used versus list_transactions.

GET/customers/{customerId}
ChatGPT4h ago

The tool failed to return a response after multiple attempts — the MCP server kept timing out on the UPI callback.

POST/orders
Cursor4h ago

The tool requires too many parameters for a simple lookup. Six of nine could be optional.

GET/products/{productId}
filed by the agents calling kirana-payments v2 · scored into the catalog

07 · Observe

847 agent calls in the last 24 hours. 27 failed.

Here is who, with which key, at what cost. Every call checked and logged, and your credentials never leave Sutra.

mcp.sutra.dev/kirana-payments · ap-south-1
TOTAL REQUESTS
847
↑ 6.7% from yesterday
AVG RESPONSE
38ms
P95 141ms · Mumbai
ERROR RATE
3.2%
27 failed · 847 total
TOKEN USAGE
124k
avg 1,240 per call
API KEY · 24HCALLSAGENTSERRORS
Production key****7f2a · most used: sutra_get_payouts4,120612
Development key****3e1b · most used: sutra_auth_login20429
CI pipeline key****a4c0 · most used: sutra_get_analytics86113

Every call logged with agent, key, tool, latency and outcome. Retained 90 days, exportable to your SIEM.

In practice

Numbers from teams running Sutra

Three write-ups from real deployments: what governed MCP servers, structured errors and per-audience contracts change in practice.

489,000
Tool calls, zero surprises

Ninety days of one production MCP server serving four agents. Every anomaly attributed to a specific agent and key within minutes.

Read the numbers →
71%
Fewer retries in a week

Across 1.2 million tool calls, one vague error message drove a third of all retry traffic. Structured errors naming the field fixed it.

Read the numbers →
31
Zombie endpoints retired

One team, first quarter on contracts: for the first time they could prove no active consumer referenced the endpoints they deleted.

Read the numbers →

Enterprise

Answers the security review before it asks

Built for the compliance regime Indian teams actually face — DPDP Act 2023, CERT-In directions, RBI data localisation — alongside SOC 2 and ISO 27001 for your global customers.

Certified infrastructure

DPDP Act 2023
aligned
CERT-In 6-hour
reporting
RBI localisation
in-country
SOC 2 Type II
certified
ISO 27001
certified
MeitY empanelled
in progress

Runs where your perimeter ends

Hosted SaaS

Mumbai and Hyderabad regions · managed upgrades · 99.9% SLA
Private cloud

Your VPC, your KMS keys, your audit trail
On-prem

Air-gapped, no egress — for regulated BFSI deployments

Works with every identity provider

Identity providers were built for people signing in to apps. Sutra extends the one you already run to AI agents, so access follows your existing teams and roles.

OktaMicrosoft Entra IDAuth0 Zoho DirectoryGoogle WorkspaceKeycloak JumpCloudAny SAML / OIDC
  • ✓SAML 2.0 and OIDC single sign-on, enforced across every workspace
  • ✓SCIM keeps groups, roles and deprovisioning in sync
  • ✓Every agent gets its own identity in the audit trail

Pricing

Priced in rupees, not converted into them

Start free on a real repo. Pay per seat when the catalog goes to production. GST invoices, UPI and NEFT accepted.

₹0
Free forever

1 repo · 1 MCP server · 50 endpoints · community support. No credit card, no spec, no trial clock.

Start free
₹2,400
Per developer / month

Unlimited repos and contracts · hosted MCP gateway · CI diffing · agent feedback · 90-day logs.

Start 14-day trial
Custom
Enterprise

SSO and SCIM · private cloud or on-prem · DPDP and CERT-In documentation pack · named support.

Talk to us

FAQ

Questions we get asked

Sutra reads your repositories, derives an OpenAPI 3.1 spec for every endpoint it finds, scores those endpoints on design, security and AI readiness, and then lets you publish governed slices of that catalog to partners, internal teams and AI agents — including as a hosted MCP server.
No. Your production traffic keeps flowing through whatever you already run — Kong, APISIX, Apigee, an ALB. Sutra governs the contract and hosts the MCP gateway that agents call. The two sit side by side.
No, and that is the point. Most Indian teams shipping fast have route handlers and no spec. Sutra parses the handlers, the serializers and the type hints, and writes the spec for you. If you already have one, it imports and diffs against it instead.
Sutra ships maintained contracts for UPI/NPCI, ONDC's Beckn schemas, Account Aggregator consent flows, DigiLocker, eSign and GSTN. When the upstream spec changes, you get the same breaking-change diff you would get for your own code — before your integration fails in production.
In India by default — ap-south-1 (Mumbai) with a standby in Hyderabad. Source code is analysed in ephemeral workers and never persisted; only the derived specs, scores and logs are stored. Private cloud and air-gapped on-prem are available for BFSI deployments.
Postman starts with a collection someone maintains by hand. Sutra starts with the code and keeps the contract honest against it on every commit — then treats AI agents as a first-class audience rather than an export format.
Free forever for one repo and one MCP server. ₹2,400 per developer per month for the full platform, billed in INR with a GST invoice. Enterprise is priced per deployment.
A small team in Bengaluru who spent too many years reconciling partner integrations by hand, and then watched AI agents make the same problem an order of magnitude worse.

Ship APIs any agent can call

Humans, tests, partners, agents. One catalog, one contract, one place — hosted in India.

$npx sutra init
Start free Talk to the team