Everyone building agents in 2026 has internalized one shape: the agent is a client, and it reaches out. It opens a connection to a Model Context Protocol server, the server presents a menu of tools, the agent authenticates with a token that is nobody's user session in particular, and work happens across a network boundary. That mental model is so dominant that it's easy to miss when a platform quietly builds the opposite thing.

Apple's WWDC26 developer story is the opposite thing.

The contract runs the other direction#

At the center of Apple Intelligence for third-party apps is a framework most iOS developers already half-know: App Intents. What changed is its status. It is no longer the way you add a Shortcuts action or a Siri phrase. It is the only way your app is legible to the assistant at all. Apple's own framing is unusually stark for a company that prefers soft edges: an app that ships no App Intents is invisible to Apple Intelligence — it can't be actioned, it can't be referred to on-screen, it can't contribute to what the system calls personal context.

Look at what an App Intent actually does and the inversion is obvious. Your app declares App Actions — the operations the assistant may invoke. It adopts the new View Annotations API to map visible views to entities, so a user can say that one and the model knows what's on the glass. It contributes Entity schemas to Spotlight's semantic index, so your content is retrievable with attribution back to you. In every case the flow is app → OS. You are not reaching out to a tool. You are pushing your capabilities down into an orchestrator you don't control and hoping it calls you.

MCP has the agent reach out to a server it authenticates against. App Intents have the app push capability down into an OS that already holds the user's session.

The trust properties fall out of the geometry. There is no server to stand up, because the intent runs in-process. There is no OAuth handshake, because the code executes on-device under the user's existing session — the same reason WebMCP gets "free" auth by living inside an already-logged-in tab. There is no transport to harden, because there is no network hop. For a developer who has spent 2026 wiring token refresh and confused-deputy defenses into an MCP server, App Intents can feel like someone removed the entire security surface. They mostly did — by moving the boundary from the network to the OS process model.

The price of admission is Apple's vocabulary#

Here is the part that doesn't make the keynote slides. MCP's defining freedom is that you name your own tools. You decide a tool is called refund_order, you write its description, you shape its arguments, and any client that connects gets your vocabulary. App Intents don't work that way. Apple ships system-defined schemas — task management, photo editing, communication, and a growing catalog of categories — and your job is to map your action onto the nearest one. Do it and you inherit every future improvement in language understanding for free, across regions and phrasings, with no phrases to maintain. Refuse, or fall outside the taxonomy, and the model doesn't know what your action is.

That is the real story, and it's a governance story dressed as a developer-experience story. Apple is standardizing the vocabulary of agent actions on its platform. The schema is the contract, and the contract is authored by the OS vendor, not by you. It is a cleaner design than the open free-for-all of tool naming — a model that has seen ten thousand apps all conform to open-item will route more reliably than one guessing at ten thousand bespoke tool descriptions. But cleaner-for-the-model and free-for-the-developer are not the same thing. The tool surface is curated, and the curator is Cupertino.

The reasoning layer, notably, is not locked down the same way. The Foundation Models framework gives a native Swift API to the on-device model, but its Language Model protocol lets you route the same session to a cloud model — Apple names Claude and Gemini explicitly — or a custom provider of your own. So the asymmetry is precise: you may bring your own brain, but the hands only speak Apple's schema. In a year where every other agent platform is fighting over which model wins, Apple has quietly decided that the model is the commodity and the action vocabulary is the moat.

The tell is the test harness#

If you want to know whether a platform feature is load-bearing, watch for the moment it ships a dedicated way to test it. Apple shipped an App Intents Testing framework at WWDC26 that validates the full path — Siri, Shortcuts, Spotlight — by driving real system pathways instead of UI automation. You don't build that for a nice-to-have. You build it when the intents have become the integration, and a silent regression in one means your app drops out of the assistant with no crash and no error to catch.

Which is the whole point. On Apple's platform, the agent doesn't call your API. It reads your contract, on the device, in the user's session — and the apps that never wrote one aren't rejected. They just quietly stop existing.