The agent-native app is the application model for the agent era.
An agent-native application is a portable, inspectable, user-owned package that gives a capable AI model its identity, judgment, governance, workflows, and durable state. This site defines the term, publishes the open specification, and documents what we learn building them, in public.
First, the definition.
We state it once, precisely, so it can be quoted. Everything else on this site elaborates on this sentence.
An agent-native application is a portable, inspectable, user-owned package that gives a capable AI model its identity, judgment, governance, workflows, and durable state.
What the Host supplies
- General intelligence and conversation
- Model inference and frontier upgrades
- Tool execution and the Host's permission boundary
- The runtime surface the app is mounted into
What the agent-native app supplies
- Identity and domain role
- Domain judgment and policies
- Constitution, authority, and escalation rules
- Workflows, artifacts, and durable state
- Declared tools, bindings, data custody, and compatibility
- User-owned corrections, extensions, and accumulated learning
The model is the new runtime. Applications have to change shape.
Frontier models keep absorbing generic capability.
Each model generation swallows another layer of what used to be application code: parsing, formatting, orchestration, interface glue. Building your product out of the parts the model is about to absorb is building on sand.
What survives is specific.
Domain judgment, governance, and owned state don't come with the next model release. They're earned in a domain, encoded deliberately, and owned by someone. That's the part worth packaging.
An agent-native app packages exactly that.
So it can improve when the user's model improves, without the publisher shipping a migration. Model changes are logged on governed actions, because model behavior changes both ways and regressions are real.
Not a wrapper. Not a listing. Not a promise.
The fastest way to understand a new category is to see what it excludes.
Not merely an MCP server
MCP is a supported binding. An agent-native app can speak MCP; it is not itself an MCP server. The ANA is the portable package and contract, not one of its transports.
MoreNot a prompt wrapper with a logo
A system prompt is one file. An ANA declares its constitution, tools, data custody, and compatibility, and carries durable state the user owns.
MoreNot a model provider's directory listing
Directories are distribution channels. The artifact they distribute is what the specification defines: portable across Hosts, owned by the user.
MoreNot conventional SaaS
The publisher doesn't have to host frontier inference or hold your data. Data custody is declared, and you keep your data, context, and customizations.
MoreNot a claim that automation is infallible
Governance is structural, not magical. An agent can't be the sole auditor of its own behavior, which is why the specification separates evaluation from execution.
MorePublish. Inspect. Mount. Run.
Publish
A builder packages the app: agent card, constitution, declared tools, custody, and compatibility.
agent cardInspect
Anyone can read what the app is, what it can do, what data it uses, and verify the version against its constitution hash.
constitution hashMount
The user obtains an entitlement and mounts the app into a compatible Host, which checks it at mount time.
entitlementRun
The app runs with the Host's intelligence and the app's judgment. Results, model identity, and governed actions are recorded.
HostThe user can update, diff, roll back, export, or fork within the rules. The trustworthy loop is the product.
An open specification, authored in public.
The specification defines the package format, the agent card, the constitution hash, declared data custody, and Host bindings. It is being drafted in the open, and we publish artifacts as they reach draft status, on the standards track we are building toward. The spec is a gift to the category. The registry and certification program that make conformance legible are on the roadmap.
Specification areas in open drafting
Vocabulary terms defined and citable
Category comparisons published
Dispatches in the public record
Structural counts of our own artifacts. We don't publish vanity metrics.
The people who define a category are the ones who build in it first.
Building early gets you three things: fluency in a vocabulary most builders haven't met yet, work that enters the public record of the category, and first position when certification and distribution arrive. All of that is intent, not guarantee. What we can promise today: we reply to every builder.
We are figuring this out in public. Follow along.
This space moves weekly. We publish what we learn as we learn it.
The questions everyone asks first.
What is an agent-native app?
An agent-native application is a portable, inspectable, user-owned package that gives a capable AI model its identity, judgment, governance, workflows, and durable state. The model supplies intelligence and tool execution; the app supplies the domain role, the rules, and the memory. The full explainer covers the definition clause by clause.
Is an agent-native app an MCP server?
No. MCP is a supported binding: an agent-native app can speak MCP; it is not itself an MCP server. The server transports tools; the ANA is the package and contract that declares which transports it uses, under which rules, with whose data.
Who runs the model?
The Host does. A Host is the AI system an ANA mounts into: it supplies the model, inference, tool execution, and the permission boundary. The publisher of an agent-native app doesn't have to host frontier inference at all, which is a core economic property of the category.
Do agent-native apps work offline?
The in-house deployment class exists for exactly this. An ANA mounted on a local model can run with air-gap support and controlled egress, for domains that require sovereignty. A Host-mounted ANA on a frontier model needs whatever connectivity that Host needs.