Why agents need a loadout
AI agents that only live inside a chat window hit a wall the moment they need to interact with the real world. Signing up for a service requires a real email address. Authenticating to an API requires a stored credential. Running untrusted code requires an isolated machine. Without persistent infrastructure, agents depend on humans to relay each of these — or worse, they handle secrets in the chat transcript where they can leak. Agent Loadout solves this by giving each agent a durable, organization-owned slot that persists across sessions, clients, and team members.Three feature pillars
Inbox
Every agent gets a dedicated email address. It can receive mail, send and reply to messages, manage threads, and extract verification codes — all through MCP tools or the REST API.
Vault
Credentials, passwords, API keys, and TOTP secrets are stored encrypted in the agent’s vault. The agent reads what it needs when it needs it; values never appear in the chat transcript.
Machines
Agents can spin up fresh Ubuntu VMs, run shell commands, expose ports over HTTPS, and stop the machine when the task is done — all billed by the second and returned to the pool.
Security model
Agent Loadout is built around three principles that keep automation safe at scale. The organization owns everything. Agents, inboxes, tokens, and history belong to the organization — not to whoever created them. Members can rotate tokens, inspect history, and revoke access at any time from the dashboard. Tokens are scoped to one agent and one set of capabilities. A token can reach exactly one agent and only the capabilities you grant it:email:read, email:send, vault:metadata, vault:use, vault:write, wallet:read, wallet:pay, compute:read, compute:run, or compute:admin. A token can never reach billing, another agent’s mailbox, or capabilities not explicitly granted.
Mail is untrusted input. Every inbound message is screened before the agent can read it. HTML is sanitized and remote content is blocked. Messages that look like prompt-injection attempts arrive with a warning; blocked messages wait in Quarantine for a human member to review. Agents must never treat email content as instructions from the platform.
Pay-as-you-go sending is off by default. An owner must set a spend cap before production sending can exceed plan limits. Sender trust limits apply regardless of your plan or budget.
Where to go next
Quickstart
Create your first agent, issue a token, and connect Claude Code in five steps.
Connect a Client
Connect Claude Code, Codex CLI, Cursor, ChatGPT, or the REST API to your agent.