news

Agent-Native (Builder.io)

Sebastien Dubois

07 Aug 2026 — 2 min read

Canonical version: Agent-Native (Builder.io).

Agent-Native is a framework for building applications that are an app and an agent, from Builder.io. MIT License, TypeScript, React.

Its pitch: "Don't pick between apps or agents. Agent-Native apps are both."

This is the framework. For the conceptual layer of the same name, see Agent-Native Product Decomposition, which is Andrej Karpathy's sensors/actuators/logic framing. Related ideas, different artifacts.

The one idea: Actions

Everything rests on a single primitive. You define a unit of work once:

export default defineAction({
  description: "Say hello from the local agent.",
  schema: z.object({ name: z.string().default("world") }),
  http: { method: "GET" },
  readOnly: true,
  run: async ({ name }) => ({ message: `Hello, ${name}!` }),
});

That one declaration becomes seven surfaces:

Agent tool — the model sees it as JSON Schema and can call it conversationally
React hooks — useActionMutation() / useActionQuery(), fully typed
Imperative client — callAction() when hooks don't fit
HTTP endpoint — auto-mounted at /_agent-native/actions/<name>
MCP tool — exposed to Claude, ChatGPT and other MCP hosts
A2A tool — callable by other Agent-Native apps
CLI command — pnpm action <name>, for scripting

One implementation, one schema, one place where the behavior lives. The alternative, which is what everyone currently does, is writing the same operation four times: once as a route handler, once as a tool definition, once as a UI mutation, once as a script.

Permissions, which is where it gets serious

Five independent flags on each action, and they're the part that makes this look designed rather than demoed:

agentTool: false — hidden from the model, still callable from UI, HTTP, CLI
toolCallable: false — blocks extension iframe calls, for high-blast-radius operations
publicAgent: { expose: true } — safe reads without authentication
needsApproval: true — pauses the agent loop pending human approval
authorize: guard — gate-check on every caller

The guard runs before input validation and applies uniformly across agent, HTTP, frontend, MCP, A2A and CLI. There is no bypass route. That sentence is the whole security argument, and it's only possible because there's one definition rather than six.

Every mutating action is audited automatically: who, when, from which surface, which agent thread. The audit log is itself queryable through built-in actions.

The rest of the stack

Agent runtime: chat, tools, skills, memory, jobs, observability and handoffs ship together
Backend agnostic: any Drizzle-supported SQL database, any Nitro-compatible host
Toolkits: reusable blocks for collaboration, sharing, settings, teams, observability

npx @agent-native/core@latest create my-app

There's a gallery of working apps meant to be forked and evolved by an agent rather than read as demos: a Loom clone, a visual plan mode for coding agents, a Figma-like design tool, an analytics tool positioned against Amplitude and FullStory, a minimal ChatGPT-style shell, and an Obsidian/Notion-style content app.

Design guidance worth stealing

The docs warn against one-action-per-UI-affordance sprawl: prefer a single CRUD-style update with optional fields over N per-field actions, mark UI-only operations agentTool: false to free model context, and delete actions the UI stopped using rather than leaving them exposed. There's an advisory pnpm actions:audit that flags dead actions and redundant clusters.

That is the same problem DrSkill scans for, one layer up: too many near-identical capabilities is a routing failure, not just clutter. Whether the router is a model choosing a tool or a model choosing a skill, overlapping descriptions are what break it.

Agent-Native (Builder.io)

Sebastien Dubois

The one idea: Actions

Permissions, which is where it gets serious

The rest of the stack

Design guidance worth stealing

References

About Sébastien

Ready to get to the next level?

Free: Knowledge System Checklist