Gateways route traffic. Catalogs sell menus. Loom is the third thing: the agent that builds the connector that isn't on the menu, keeps its secrets where they belong, and nurses it for life.
✍️
Author from a Plain-Language Ask
Endpoint, tenant, an API-doc link, "we use Entra" — Loom takes what the person knows, probes the rest, proposes the auth mechanism from evidence (a 401 means a token; an open 200 means none), and emits a working, registered connector.
🗝️
Custody by Reference
Secrets live in your vault or environment and enter the registry only as references — env://, keychain://, akv://. Only the deterministic runtime resolves a value, in memory, at connection-open.
♻️
Heal for Life
A scheduled loop watches every connection: re-handshakes dead sessions, flags credentials approaching rotation, escalates repeated failures to the owner — and never widens its own scope to "try harder".
🚫
Rule Zero
No secret value ever enters model context, logs, journal, database, or error output. It is structural, not policy: the model's tool surface has no read-secret call, and every output path passes the redaction layer.
✋
Humans on the Trigger
The model proposes; the deterministic runtime and a human execute. A new credential, a scope expansion, a go-live — each blocks on explicit approval, with the manifest shown as YAML and in plain English first.
🚪
A Front Door for Agents
Loom is itself an MCP server. A consuming agent calls request_connection or describe_need, gets back the human steps that remain, and polls connection_status until the route is live. Deposit and approval have no agent-reachable surface.
🤝
We Have It, or We Build It
Point your gateway's agents at one question: "can anyone here do X?" If a live tool already serves the intent, they get it. If not, a governed build request opens — and the agent is told to check again soon.
👀
Custody Is Authorship-Agnostic
Loom adopts every system already live in your gateway — the ones it never built — and watches them through the gateway's own health verdicts. A system an operator disables is paused, not paged.
🧭
Never Invents an Endpoint
When the requester has an intent but no URL, Loom offers a human-vetted shortlist of 8 well-known public APIs (currency, weather, zip, holiday, …) to pick from. No web scraping, no internet access, zero injection surface.
🧠
A Local Brain
Authoring runs on a local model through Ollama — no frontier API required, so it works air-gapped. Frontier APIs are a pluggable option, never a dependency. Every authoring run is captured as a secret-free trace that stays in your tenant.
🪪
Governed by the Gateway It Builds For
Inside Prava EAG, Loom acts as a registered agent — id loom — under the same ceiling as any other agent, with a scoped machine credential that reaches only the control-plane endpoints it needs. The agent that builds your connectors appears in your audit trail like everyone else.
📜
Append-Only Journal
Intent is journaled write-ahead, before the action. Authored, opened, healed, paused, approved, denied, revoked — every transition is a row that cannot be updated or deleted. "Which agent had access to what, when" is a query, not an investigation.
