# Pinky: open-source MCP gateway lets Claude Code, Codex or Cursor drive a real iPhone or Android phone

Canonical: https://theagenticweekly.com/news/pinky-ai-agents-control-iphone-android-mcp · Evidence: Reported · First seen: 2026-11-13 13:10 UTC · Source published: 2026-11-06 16:53 UTC · Brief published: 2026-11-13 13:26 UTC · Updated: 2026-11-13 13:26 UTC · Author: Agentic Weekly

> Pinky is a free, Apache-2.0 desktop app for macOS, Windows and Linux that lets any MCP agent, such as Claude Code, Codex or Cursor, operate a real iPhone (iOS 17.4+) or Android phone (Android 10 to 17), while payments and other risky taps wait for the user's approval in Pinky's gateway. The project calls itself pre-alpha.

## What changed

- Any agent that can use MCP servers (the README names Claude Code, Claude Desktop, Codex and Cursor) can operate a real iPhone or Android phone through Pinky, over stdio or HTTP, while the user watches a mirror on the computer.
- Approvals live in Pinky's gateway between the agent and the phone, not in the prompt: payments, trades and transfers wait for a click by default, and sends, orders, deletions, calls, installs and settings changes can be set to wait too.
- Banking, wallet and password-manager apps are invisible to agents by default, and agents cannot type into password or one-time-code fields; a banking app can be allowed for a single task only.
- On Android 13 and later, agents work on a hidden second screen so the phone's own screen stays free; on older Android and on iPhones they use the main screen. Clicking the mirror or touching an Android phone pauses the agent.
- Every run is recorded as plain-language steps, screenshots and a screen recording, exportable as an HTML report that stays on the computer.
- Pinky's own phone app can also run tasks with no computer, using a model the user picks, from DeepSeek, Qwen, Kimi and GLM to Claude, GPT, Gemini or local models in Ollama or LM Studio.

## Who should look at it, and who can wait

Builders who already run Claude Code, Codex or Cursor and want them to test or operate a mobile app on a real device get a one-app setup on macOS, Windows or Linux. Pinky brings its own adb for Android and prepares iPhones itself, per the README.

Anyone who needs a supported, audited product should wait. The README labels the project pre-alpha and says some built features still wait for a person to try them; the Windows installer is not signed yet.

## Our read: the safety claim is architectural, and that is the part to test

Most phone-use agent demos rely on the model to ask before acting. Pinky's pitch is different: the README says the approval rules run in the gateway, so an agent cannot approve itself even when on-screen text tries to talk it into it. That is the right place for the control, but it is a claim from the authors, not something we have tested.

The README says Pinky spots risky buttons in 10 languages. Button detection is the weak link to probe: an approval gate only helps if it recognizes the risky tap in the first place, in apps and languages it was not tuned on.

## The numbers in the source

Figures from the Pinky README and GitHub repository, read Nov 13, 2026

| Item | Figure |
| --- | --- |
| GitHub stars (repo created Nov 6, 2026) | 2,063 at detection, about 6.8 days old |
| Desktop download size | 16 to 22 MB |
| Idle memory on a Mac, per README | about 70 MB, 0% CPU |
| Android versions supported | Android 10 to 17 |
| iOS versions supported | iOS 17.4 or later |
| Languages for risky-button detection | 10 |
| Latest release tag at time of writing | v2026.1113.17 (Nov 13, 2026) |
| License | Apache-2.0 |

## In the source's words

> "Whoever does the task, approvals are enforced by Pinky's gateway, not by instructions to the agent."
> (Pinky README, https://github.com/DIYgod/pinky)

> "Banking, wallet and password-manager apps are invisible to agents, and agents can't type into password or one-time-code fields."
> (Pinky README, https://github.com/DIYgod/pinky)

## What we have not verified

- We did not run Pinky ourselves; everything here is as the README states it.
- We could not confirm that the gateway blocks every risky action, or how reliably it detects risky buttons across apps and its 10 languages.
- The README says iPhone setup can download Apple's developer disk image from a third-party mirror on request; we did not check that mirror.
- The repository includes a Cloudflare Worker that receives usage statistics and crash reports; we did not review what is collected or whether it is opt-in.
- Star counts move quickly and are from the detector and GitHub API at the time of writing.

## Timeline

- Source published: 2026-11-06 16:53 UTC
- First seen by our watcher: 2026-11-13 13:10 UTC (via Watcher: GitHub new-repo discovery sweep, topic claude-code (item 674ba78fd9e3); repo created Nov 6, 2026, picked up once it crossed the traction threshold)
- Brief published: 2026-11-13 13:26 UTC

## Sources

- [Pinky README and repository (DIYgod/pinky on GitHub)](https://github.com/DIYgod/pinky) (primary source) (fetched 2026-11-13)
- [Pinky latest release](https://github.com/DIYgod/pinky/releases/latest) (primary source) (fetched 2026-11-13)

## Related

- [All news briefs](https://theagenticweekly.com/news)
- [New AI models this week](https://theagenticweekly.com/models/this-week)

## How to cite

Agentic Weekly, "Pinky: open-source MCP gateway lets Claude Code, Codex or Cursor drive a real iPhone or Android phone", published 2026-11-13 13:26 UTC, https://theagenticweekly.com/news/pinky-ai-agents-control-iphone-android-mcp