Reported News
Pinky: open-source MCP gateway lets Claude Code, Codex or Cursor drive a real iPhone or Android phone
Pinky is a free, Apache-2.0 desktop app for macOS, Windows and Linux that lets any MCP agent, such as Claude Code, Codex or Cursor, operate a real iPhone (iOS 17.4+) or Android phone (Android 10 to 17), while payments and other risky taps wait for the user's approval in Pinky's gateway. The project calls itself pre-alpha.
- Changes reported
- 6
- listed below, each from a source we read
- We tested
- Not tested yet
- reported from sources; we did not run it ourselves
- Gaps we flag
- 5
- things we could not verify
- Sources
- 2
- 2 primary, linked below
What changed
| # | What the source says | Status |
|---|---|---|
| 01 | Any agent that can use MCP servers (the README names Claude Code, Claude Desktop, Codex and Cursor) can operate a real iPhone or Android phone through Pinky, over stdio or HTTP, while the user watches a mirror on the computer. | Reported |
| 02 | Approvals live in Pinky's gateway between the agent and the phone, not in the prompt: payments, trades and transfers wait for a click by default, and sends, orders, deletions, calls, installs and settings changes can be set to wait too. | Reported |
| 03 | Banking, wallet and password-manager apps are invisible to agents by default, and agents cannot type into password or one-time-code fields; a banking app can be allowed for a single task only. | Reported |
| 04 | On Android 13 and later, agents work on a hidden second screen so the phone's own screen stays free; on older Android and on iPhones they use the main screen. Clicking the mirror or touching an Android phone pauses the agent. | Reported |
| 05 | Every run is recorded as plain-language steps, screenshots and a screen recording, exportable as an HTML report that stays on the computer. | Reported |
| 06 | Pinky's own phone app can also run tasks with no computer, using a model the user picks, from DeepSeek, Qwen, Kimi and GLM to Claude, GPT, Gemini or local models in Ollama or LM Studio. | Reported |
reported by the sourcemeasured or run by usnot verified
Primary source: Pinky README and repository (DIYgod/pinky on GitHub). We are the fast, independent index; the vendor’s own page is the source of record for this release.
Who should look at it, and who can wait
Builders who already run Claude Code, Codex or Cursor and want them to test or operate a mobile app on a real device get a one-app setup on macOS, Windows or Linux. Pinky brings its own adb for Android and prepares iPhones itself, per the README.
Anyone who needs a supported, audited product should wait. The README labels the project pre-alpha and says some built features still wait for a person to try them; the Windows installer is not signed yet.
Our read: the safety claim is architectural, and that is the part to test
Most phone-use agent demos rely on the model to ask before acting. Pinky's pitch is different: the README says the approval rules run in the gateway, so an agent cannot approve itself even when on-screen text tries to talk it into it. That is the right place for the control, but it is a claim from the authors, not something we have tested.
The README says Pinky spots risky buttons in 10 languages. Button detection is the weak link to probe: an approval gate only helps if it recognizes the risky tap in the first place, in apps and languages it was not tuned on.
The numbers in the source
| Item | Figure |
|---|---|
| GitHub stars (repo created Nov 6, 2026) | 2,063 at detection, about 6.8 days old |
| Desktop download size | 16 to 22 MB |
| Idle memory on a Mac, per README | about 70 MB, 0% CPU |
| Android versions supported | Android 10 to 17 |
| iOS versions supported | iOS 17.4 or later |
| Languages for risky-button detection | 10 |
| Latest release tag at time of writing | v2026.1113.17 (Nov 13, 2026) |
| License | Apache-2.0 |
In the source’s words
“Whoever does the task, approvals are enforced by Pinky's gateway, not by instructions to the agent.”
“Banking, wallet and password-manager apps are invisible to agents, and agents can't type into password or one-time-code fields.”
What we have not verified
- We did not run Pinky ourselves; everything here is as the README states it.
- We could not confirm that the gateway blocks every risky action, or how reliably it detects risky buttons across apps and its 10 languages.
- The README says iPhone setup can download Apple's developer disk image from a third-party mirror on request; we did not check that mirror.
- The repository includes a Cloudflare Worker that receives usage statistics and crash reports; we did not review what is collected or whether it is opt-in.
- Star counts move quickly and are from the detector and GitHub API at the time of writing.
This brief is Reported: written from the sources below, not from running the release ourselves.
Sources
- Pinky README and repository (DIYgod/pinky on GitHub)primary source · fetched 2026-11-13
- Pinky latest releaseprimary source · fetched 2026-11-13
Related
Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/pinky-ai-agents-control-iphone-android-mcp.md
Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.
Newsletter
The Weekly Verdict. Free, every Monday.
A free email every Monday: the week's few big AI releases, then 5 short use cases for the new models, each with a prompt you can paste.
Free. Double opt-in. One click to unsubscribe.