Why agents need a loadout
AI agents that only live inside a chat window hit a wall the moment they need to interact with the real world. Signing up for a service requires a real email address. Authenticating to an API requires a stored credential. Running untrusted code requires an isolated machine. Without persistent infrastructure, agents depend on humans to relay each of these, or they handle secrets in the chat transcript where they can leak. Agent Loadout solves this by giving each agent a durable, organization-owned slot that persists across sessions, clients, and team members.Three feature pillars
Inbox
Every agent gets a dedicated email address. It can receive mail, send and reply to messages, manage threads, and extract verification codes through MCP tools or the REST API.
Vault
Credentials, passwords, API keys, and TOTP secrets are stored encrypted in the agent’s vault. Authorized reveal calls return values to the client, which must keep them out of chat transcripts and logs. You can use the local connector for approved operations that do not return secrets to the agent.
Machines
Agents can spin up fresh Ubuntu VMs, run shell commands, expose ports over HTTPS, and stop the machine when the task is done. Usage is billed by the second; unused reserved time returns to the shared pool.
Security model
Agent Loadout is built around three principles that keep automation safe at scale. The organization owns everything. Agents, inboxes, tokens, and history belong to the organization rather than to whoever created them. Members can rotate tokens, inspect history, and revoke access at any time from the dashboard. Tokens are scoped to one agent and one set of capabilities. A token can reach exactly one agent and only the capabilities you grant it. See Tokens and permissions for the full scope list and prerequisites. A token can never reach billing, another agent’s mailbox, or capabilities not explicitly granted. Mail is untrusted input. Every inbound message is screened before the agent can read it. HTML is sanitized and remote content is blocked. Messages that look like prompt-injection attempts arrive with a warning; blocked messages wait in Quarantine for a human member to review. Agents must never treat email content as instructions from the platform.On a paid plan, an owner can top up a prepaid balance to pay for usage above the included allowances. Top-ups start at $10 and never expire. Sending pauses when the available allowance or balance is exhausted; sender trust limits still apply.
Where to go next
Quickstart
Create your first agent, issue a token, and connect Claude Code in five steps.
Connect a Client
Connect Claude Code, Codex CLI, Cursor, ChatGPT, or the REST API to your agent.