Loomal wants to give every AI agent its own SSN
Loomal just shipped what nobody has clearly built yet, an identity infrastructure where every agent gets its own email address, its own encrypted credential vault, and its own 2FA. One API, eighteen tools, free at launch. The MCP server plugs into Claude, OpenAI, Cursor, LangChain, and CrewAI, so the agent does not have to know or care which framework is running it.
The founder pitch is blunt. Ask your agent to buy a pair of socks and it falls apart, because the real world assumes identity. Every SaaS login, every email verification loop, every 2FA challenge is built for humans with phones. Today people hack around this by sticking shared credentials in env files and hoping nothing bad happens. Loomal treats the agent as a first-class actor and hands it the three primitives it actually needs to function, signed inbox with DKIM for verifiable message attribution, AES-256 vault for per-agent secrets, and time-based OTPs scoped to specific actions with automatic audit logs.
This is the category the security people have been asking for and nobody shipped. The obvious precedents are Okta for humans and Auth0 for apps. Agents need a third bucket and they need it before the first big incident where an agent with credentials stapled in a prompt leaks an enterprise customer base. Loomal is early but the primitives look right, signed inbox means an inbound email can prove it came from a known agent, per-agent 2FA means a compromised prompt cannot escalate to a different system, audit logs mean you can ask what an agent did at 3am and actually find out.
The second-order question is whether identity infra should be a neutral layer like DNS or a feature of whichever framework you use. Loomal is betting on neutral. If they are right, every agent framework eventually calls them. If they are wrong, CrewAI or LangChain bakes this in and Loomal becomes a feature. Either way the shape of the answer is clear, agents cannot stay anonymous forever.
Launch page at https://www.producthunt.com/products/loomal.
← Back to all articles
The founder pitch is blunt. Ask your agent to buy a pair of socks and it falls apart, because the real world assumes identity. Every SaaS login, every email verification loop, every 2FA challenge is built for humans with phones. Today people hack around this by sticking shared credentials in env files and hoping nothing bad happens. Loomal treats the agent as a first-class actor and hands it the three primitives it actually needs to function, signed inbox with DKIM for verifiable message attribution, AES-256 vault for per-agent secrets, and time-based OTPs scoped to specific actions with automatic audit logs.
This is the category the security people have been asking for and nobody shipped. The obvious precedents are Okta for humans and Auth0 for apps. Agents need a third bucket and they need it before the first big incident where an agent with credentials stapled in a prompt leaks an enterprise customer base. Loomal is early but the primitives look right, signed inbox means an inbound email can prove it came from a known agent, per-agent 2FA means a compromised prompt cannot escalate to a different system, audit logs mean you can ask what an agent did at 3am and actually find out.
The second-order question is whether identity infra should be a neutral layer like DNS or a feature of whichever framework you use. Loomal is betting on neutral. If they are right, every agent framework eventually calls them. If they are wrong, CrewAI or LangChain bakes this in and Loomal becomes a feature. Either way the shape of the answer is clear, agents cannot stay anonymous forever.
Launch page at https://www.producthunt.com/products/loomal.
Comments