Apple's fm CLI: Powerful AI Scripting with Significant Restrictions

Summary

Apple has shipped fm, a command-line interface for Foundation Models, with macOS 27. Introduced at WWDC26, the tool provides streamlined access to two models: 'system' (on-device, free) and 'pcc' (Private Cloud Compute, larger cloud-based model). The fm CLI supports Unix-standard input/output, JSON output, and requires no API keys, positioning it as a developer-friendly tool for AI integration.

However, a detailed technical analysis reveals significant restrictions on the larger pcc model. A security gate called ParentProcessGate requires PCC requests to originate from a genuine terminal and be launched by an Apple-signed process. This effectively prevents scripting PCC via subprocess calls, cron jobs, CI systems, or automation frameworks. The on-device 'system' model has no such restrictions and works seamlessly with scripts and automation.

The Python SDK does not support PCC at all, directing users exclusively to the CLI. This creates a curious limitation: Apple built fm to be scriptable, but gatekeeps the more powerful cloud model to terminal-only, human-initiated access. The restrictions appear motivated by controlling access to PCC resources and preventing unauthorized automated use.

• The restriction appears designed to ensure PCC is used only interactively at terminals, preventing automated abuse of Apple's cloud compute resources

Editorial Opinion

Apple's fm CLI demonstrates a clever but limiting approach to protecting cloud resources. The ParentProcessGate restrictions—requiring a genuine terminal and Apple-signed launcher—successfully prevent automated abuse while allowing interactive use. However, this undermines the core promise of a scriptable CLI for developers who want to integrate the more capable pcc model into workflows, automation, and tooling. The tension between openness and resource protection is real, but the current balance favors restriction over utility.