LOOMAL
Identity for AI Agents

AI agents haveno Give yours one.

Everything a human has online — now callable from one API. DKIM-signed email. AES-256-GCM vault. MCP-native.

agent.sh
create identity
live · looping
The problem

Today, agents operate with
borrowed identities & hardcoded secrets.

01still common

No email

Agents use your Gmail or dump messages to a queue. No real address, no threading, no DKIM.

from = "you@gmail.com" // your identity, not agent's
02still common

No credentials

API keys in .env files. No rotation, no 2FA, no vault. One leaked key breaks everything.

STRIPE_KEY=sk_live_•••• // committed to .env
03still common

No accountability

No delegation chain. No way to trace an agent's action back to the human who authorized it.

authorized_by = null // who sent this?

The identity stack · Human → Agent

Agents are the new users.
They need identity.

Humans need an email, a password manager, and a phone for 2FA to do anything meaningful online. AI agents need the same primitives — plus delegation chains and audit trails that trace every action back to the human who authorized it.

Human

3 primitives

Email address

@gmail · @outlook · @company

Password manager

1Password · Bitwarden · Keychain

Phone for 2FA

SMS · Authenticator app

becomes

Agent (Loomal)

5 primitives

Inbox

DKIM-signed · threaded · per-agent

Vault

AES-256-GCM · scoped · audit-logged

TOTP

seed-encrypted · 30s rotation

Delegation chain

+ new

Human → Org → Agent → Action

Audit trail

+ new

every email · vault read · totp call

Why agents need identity + 8 more capabilities shipping
What you get
Use casesReal-world

What agents build
with Loomal.

Every use case combines email, vault, and 2FA — the Agent Identity Stack.

Fully autonomous

Customer Onboarding

Agent signs up on platforms, verifies email, stores credentials, confirms setup.

agent.onboard("figma.com")
session stored · 0 retries
EmailVaultTOTP
No back-and-forth

Meeting Scheduling

Agent reads incoming requests, checks availability, sends invites, confirms replies.

inbox.parse → calendar.book
12 booked · 0 conflicts
Email
End-to-end

Document Processing

Agent receives documents, logs into platforms, uploads files, sends results back.

inbox.attach → vault.upload
8 docs · all replied
EmailVaultTOTP
~Seconds per link

Payment Link Delivery

Agent generates Stripe payment links using stored API keys and emails them to clients.

stripe.link → inbox.send
$4,900 invoice delivered
EmailVault
Never misses

Compliance Monitoring

Agent tracks regulatory deadlines, logs into portals to check status, alerts on lapse.

portal.check_all()
2 alerts sent · 0 missed
EmailVaultTOTP
Per-lead cadence

Sales Follow-ups

Agent sends personalized follow-ups from its own inbox so warm leads never slip.

inbox.followup({ cadence })
11 replies · 3 booked calls
Email
Compliance

FINRA · 2024 · fine

$1.1B

in fines to 16 firms for communication attribution failures.

HIPAA mandates unique identification for every system touching patient data. CMMC blocks DoD contracts without it. The pattern is the same everywhere: if an AI agent acts, someone needs to prove who authorized it.

See how Loomal satisfies each regulation

Finance

FINRA · SEC · SOX

Healthcare

HIPAA · Part 11

Legal

FRCP · FRE 502

Defense

CMMC · NIST 800-171

Insurance

UCSPA · RESPA

Delegation chain

Every action traces back
to the human who authorized it.

Human > Org > Agent > Action. Cryptographically verifiable via DKIM. Revoke the human and every agent stops. No orphaned access. No cleanup scripts.

Human

ops@novaworks.io

Org

novaworks

Identity

sales-agent-x8k2m

Action

email / vault / totp

DKIM-signed identity

Every outbound email is DKIM-signed with agent identity headers. Recipients and regulators can cryptographically verify who sent it.

Instant revocation

Revoke a human, org, or identity — everything downstream stops instantly. No dangling credentials, no orphaned access.

Built on 40-year-old standards

DKIM, SPF, DMARC, OAuth 2.1, MCP. No proprietary protocol. Email's global PKI is already deployed everywhere.

Compliance-ready audit trails

Every email, credential access, and TOTP code is logged with identity, timestamp, and delegation context. The trail regulators ask for.

Integrations

Works with
every framework.

REST API + native MCP server. Framework-agnostic by design.

LangChain
CrewAI
LlamaIndex
Haystack
Vercel AI SDK
Cursor
Goose
Open WebUI
Notion
Lovable
Manus
Make
n8n
Claude
OpenAI
Gemini
DeepSeek
Cohere
Perplexity
ByteDance
vLLM
Ollama
OpenRouter
MCP

Get started

30 seconds to
first email.

Plug Loomal into your AI client. Ask your agent to send the first email.

{
  "mcpServers": {
    "loomal": {
      "command": "npx",
      "args": ["-y", "@loomal/mcp"],
      "env": {
        "LOOMAL_API_KEY": "loid-your-api-key"
      }
    }
  }
}