Guide··14 min
How to Control Coding Agents From Your Phone: A Field Guide (November 2026)
Cloud agents, first-party remote control, companion apps and SSH: how each way of reaching Claude Code, Codex, Cursor, Copilot and Antigravity from a phone works, what it needs from your computer, and where it breaks.
Every major coding agent can now be reached from a phone. The options look alike in an app store. They differ in where the agent loop runs, where its tools run, and how its events reach you.
Flavio Copes published a useful tour of the tools earlier this month. This guide groups the options by architecture, checks first-party features against vendor documentation as of November 6, 2026, and covers the layers under the app: protocols, networks, power, phone operating systems and security.
Why this matters now
Agents now work long enough to outlast your attention. Anthropic’s study of real Claude Code usage (February 2026) found that most turns are short, the longest ones have grown substantially, and people intervene less often on hard tasks. METR’s time-horizon measurements point the same way: the length of task a frontier model can finish has kept doubling every few months.
Once an agent runs for half an hour without you, watching it is a waste and leaving it is a risk. It may stop on a question, wait for a permission, or finish while you are away. Remote access has a narrow job: answer, approve or deny, check the result, send the next task. The rest of this guide is about doing that reliably.
- 01
Answer
- 02
Approve or deny
- 03
Check the result
- 04
Send the next task
Three questions that sort every option
Where does the agent loop run?
The loop is the model-calling process that decides what to do next. It can run in a vendor’s cloud, on your computer, or, in Cursor’s Remote Control, in the vendor’s cloud while it drives your computer.
Where do the tools run?
Shell commands, file edits, tests, MCP servers and credentials. This decides whether the agent can use your local database, your signed-in CLIs and your uncommitted work.
How do events reach the phone?
A mirrored terminal, a structured event stream, a chat message, or a push notification. This decides how an approval looks on a small screen, and whether you hear about it after the app is closed.
The answers give four families.
The four architectures
Architecture
Same phone. Four different places the work can run.
Read the loop and the tools before the brand. Cursor’s Remote Control is the exception inside family 02: the loop is in Cursor’s cloud, and the tools stay on your computer.
01
Laptop can sleep
Cloud agent
- Loop
- Vendor cloud
- Tools
- Vendor sandbox
A contained change on a repo that is already pushed.
02
Computer stays awake
First-party remote
- Loop
- Your computer
- Tools
- Your computer
The session needs local files, tools, or a signed-in CLI. Cursor is the exception: its loop runs in Cursor’s cloud, and the tool calls stay on your computer.
03
Computer stays awake
Companion or gateway
- Loop
- Your computer
- Tools
- Your computer
Several agents, one client. Check the wrapper first.
04
Host stays up
Terminal over SSH
- Loop
- Your host
- Tools
- Your host
Any CLI agent. You own the network and the screen.
A closed laptop only works for family 01. Families 02, 03 and 04 need the host awake and online.
1. Cloud agents
You describe a task. The vendor clones your repository into a virtual machine and works there, usually ending with a branch or pull request. Your laptop can be closed. The VM only has the repository plus what you configure for it. Uncommitted changes, local services, private networks and tools you installed by hand are not there. Cline’s documentation states the limit plainly: rules, skills, MCP servers and connectors are not loaded in its cloud sessions.
Cloud agents fit work that is small enough to review as a diff, and whose evidence the agent can produce in the sandbox: tests, screenshots, logs, a preview link.
Cline Cloud AgentsThe documented limit: rules, skills, MCP servers and connectors stay behind.2. First-party remote control of a local session
The agent keeps running on your machine and the vendor relays its events to a phone app or web page. The well-designed versions are outbound-only. Claude Code’s Remote Control documentation says the local session “makes outbound HTTPS requests only and never opens inbound ports on your machine,” registers with the Anthropic API and polls for work. You get your files, MCP servers and signed-in tools, and the machine does not listen on the internet.
3. Third-party companions and chat gateways
Independent apps wrap one or more agents on your computer and give you a single mobile client. Some ship native apps with their own relay (Happy, HAPI). Some serve a web interface from your machine (CloudCLI, VibeTunnel, OpenCode’s opencode web). Some route the agent into a messaging app (OpenClaw through Telegram or Discord, or Claude Code’s own Channels). The appeal is one place for several agents. The risks are the wrapper’s maintenance, its security model, and whether it keeps up when the agent changes.
4. A terminal over SSH
SSH from a phone terminal such as Termius or Blink Shell, attach to tmux, and talk to the agent directly. Nothing depends on a vendor feature. The network path, the life of the session, and reading a desktop TUI on a phone all depend on you.
First-party options, verified November 6, 2026
Checked against vendor documentation and changelogs. Plans and rollout change quickly. Open the linked page before you rely on a detail.
Claude Code
Cloud
Cloud sessions at claude.ai/code, the Code tab in the Claude app, or claude --cloud
Your computer
claude remote-control, claude --rc, or /rc in a running session
Pro, Max, Ultra, Team, Enterprise. Not API keys. Team and Enterprise need an admin toggle.
Codex
Cloud
Codex cloud at chatgpt.com/codex
Your computer
ChatGPT mobile paired with the ChatGPT desktop app by QR code. Experimental codex remote-control in the open-source CLI.
Remote access went GA on iOS and Android in June 2026. Codex moved into the ChatGPT desktop app in July.
Cursor
Cloud
Cloud Agents in the iOS app or at cursor.com/agents
Your computer
Remote Control (/remote-control, Cursor 3.9.8+). The loop runs in Cursor’s cloud. Tool calls run on your computer.
Native app is iOS only. Android gets a web app for cloud agents. Remote Control pairing from iOS since October 6.
GitHub Copilot
Cloud
Cloud agent from GitHub Mobile. Generally available on paid plans since October 28.
Your computer
copilot --remote or /remote on. /keep-alive stops the machine sleeping.
Approve permissions, edit plans and answer questions from the phone. Live Activities on iOS.
Antigravity
Cloud
Remote agents in cloud projects, rolling out since November 3.
Your computer
agy remote-control start runs a background service. Dashboard at antigravity.google.com.
Jules goes read-only on November 11 and shuts down December 31, 2026. Gemini CLI stopped serving consumer accounts in June.
Amp
Cloud
Hosted orbs that pause when idle.
Your computer
Runners: amp --no-tui on your machine.
iOS (TestFlight), Android APK and Mac apps, all beta.
Cloud-first products round out the field: Cline Cloud Agents in a mobile browser, Devin through a Slack mention, and app builders such as Replit, Lovable, v0 and Manus, which own the whole project environment instead of attaching to your sessions.
Mirrored terminals vs structured events
This is the difference that matters most on a phone, and the one tool lists rarely mention.
On the phone
A desktop terminal, or a request the phone can render.
Structured events can wait, travel as a push, and lay a diff out for the screen you are holding.
Mirrored terminal
$ ssh mini
diff --git a/auth.ts
@@ -40,6 +40,18 @@
- return session
+ return await refresh(
+ session,
+ { force: true })
Allow this command? [y/n]Characters drawn for a desktop width. You answer with a key. What you missed lives in scrollback.
Structured event
Claude Code · approval
Run this command?
npm test
A typed request. It can wait for you, arrive as a push, and be replayed after a reconnect.
When you SSH in and attach to a terminal agent, a permission prompt is text, a diff arrives already wrapped to the host’s width, and images appear only if the terminal supports an image protocol.
Modern agents also expose structured event streams. Claude Code emits newline-delimited JSON with --output-format stream-json, and the Agent SDK exposes a canUseTool callback for permission decisions. Codex’s app-server speaks JSON-RPC: when a command needs approval, the server sends a request and the turn pauses until the client answers allow or deny. Zed’s Agent Client Protocol standardises the same idea with session/request_permission and options such as allow once, allow always and reject.
Wrappers that scrape a terminal tend to break when the agent updates its interface. First-party mobile apps feel different because they render the event, not the characters.
The network layer
Outbound-only beats an open port
Path
Dial out, or listen and hope the door is locked.
Outbound only
No firewall change. Nothing for a scanner to find. The relay sees what passes through it.
A listening port
As safe as its authentication and the path in front of it. OpenCode binds to 127.0.0.1 by default and calls itself unsecured without OPENCODE_SERVER_PASSWORD.
A private network is necessary and still not sufficient. The cryptominer incident below happened on one.
If you run anything that listens, reach it through a private network. Tailscale builds a WireGuard mesh with NAT traversal and falls back to relays that cannot decrypt traffic. Cloudflare Tunnel is outbound-only too, with Access policies in front of the service.
SSH, mosh and Eternal Terminal
Plain SSH dies with its TCP connection. On a phone that means every switch from Wi-Fi to cellular and every long lock. Mosh runs over UDP, roams between networks and echoes keystrokes locally before the server confirms them. It needs UDP ports 60000–61000 and only syncs the visible screen. Eternal Terminal stays on TCP, survives IP changes and keeps scrollback.
Either way, run the agent inside tmux or zellij. The multiplexer keeps the agent alive when your connection drops. It does not keep anything alive across a reboot.
Proxies and VPNs on the host
Relay-based tools need a clean outbound path from the host. Claude Code’s Remote Control requires the Anthropic API on port 443, and Codex users have reported phones stuck on “Waiting for desktop” behind a proxy or VPN. If pairing works on one network and not another, check the host’s proxy first.
Keeping the host awake
Architectures 2, 3 and 4 fail the same way: the computer goes to sleep. Claude Code’s interactive sessions reconnect after sleep or a network drop, but claude remote-control in server mode gives up after about ten minutes offline and exits. Codex, Cursor and Copilot offer keep-awake switches. Cursor’s only works while plugged in, and its documentation is blunt that tool calls cannot run while the computer is asleep or offline.
macOS laptop
Battery → Options → Prevent automatic sleeping on power adapter when the display is off.
Only on power. Closing the lid still sleeps unless an external display is attached.
macOS, one task
caffeinate -i for the length of a command.
Ends when the command ends. Good for one long run.
macOS desktop
Wake for network access (pmset womp).
Wakes on traffic aimed at the Mac. It does not keep a run awake.
Windows
powercfg /change standby-timeout-ac 0. Check blockers with powercfg /requests.
Modern Standby keeps the network up only for some scenarios.
This is why many people who work this way run agents on a machine that never travels — a Mac mini on a shelf, a desktop, or a cloud server — and treat the laptop as just another client.
The phone side: notifications are the interface
While the phone is locked
The app is suspended. The push is the product.
iOS gives a background app about thirty seconds, then networking stops. Android Doze cuts the network until a high-priority push briefly restores it.
WebSockets cannot run in the background. No mobile client can watch your agent continuously.
What reaches you is a push from Apple’s APNs or Google’s Firebase Cloud Messaging. The setup is only as good as what triggers those pushes, and what they say.
Lock Screen
Claude Code
Needs a decision before it continues.
Copilot · Live Activity
Still running · up to 8 hours
Claude Code lets you choose Push when Claude decides and Push when actions required in /config, and it skips pushes while you are active in the terminal. Copilot and Cursor add iOS Live Activities, which show progress on the Lock Screen for up to eight hours.
A raw SSH session has no push channel unless you add one. That is the practical reason people move from a terminal to a structured client. Android Doze is the platform rule underneath the Android half of this.
Security: what changes when the agent is unattended
Exposed control panels are a real pattern
In early 2026, internet scans found tens of thousands of self-hosted OpenClaw agent control panels reachable from the open internet. In July, an attacker installed a cryptominer on machines running an unauthenticated OpenCode web server bound to all interfaces — reachable over a private VPN mesh, not the public internet. An agent interface is a remote shell with a chat box on top.
Prompt injection gets easier when you are away
An agent that reads issues, web pages or pull requests can be steered by text inside them. 2026 brought several documented cases in agent CI integrations, including secrets read through instructions hidden in an HTML comment. Simon Willison’s lethal trifecta is the useful test. Remote work tempts you to loosen approvals so the agent stops waiting. Loosen them for the environment, not for convenience.
Use permission modes deliberately
Claude Code
From a question you answer, to a mode the docs reserve for a VM.
The Claude app does not offer bypass for cloud sessions. Codex pairs a sandbox mode with an approval policy.
01
Manual
You approve
02
Accept edits
Edits proceed
03
Plan
It proposes
04
Auto
A classifier blocks risky actions
05
Bypass
Isolated container or VM
A reasonable remote default: auto or accept-edits inside the project, network access only when the task needs it, and anything destructive or outward-facing left as a question you answer from the phone. See permission modes.
Read encryption claims to the end
Relays see what passes through them unless content is end-to-end encrypted. Some companions encrypt session content so the relay stores ciphertext. Check every path. Notifications, titles, file names and metadata are where the claim usually stops. One popular open-source companion has an open issue reporting that push notification text, including session summaries, is sent to a push service unencrypted.
The third-party landscape is volatile
Vibe Kanban
Community project
Company shut down, April 2026
Terragon
Code open-sourced
Shut down, February 2026
Omnara
Broader platform
Left the mobile-wrapper shape
Happy
Native apps, encrypted relay, several agents
Active
HAPI
Local hub. Native, web and Telegram clients
Active
CloudCLI
Web interface over local sessions
Active
VibeTunnel
Browser terminal for your Mac
Active
Before a workflow depends on a third-party tool, check three things.
- 1
How it talks to the agent
A structured protocol, or a scrape of the terminal.
- 2
What the relay can read
Session content, and also notification text, titles and file names.
- 3
Whether someone is still shipping
Fixes have to land when the agent changes its interface.
Choosing: start from the task, not the app
A contained fix on a pushed repo with tests
Use your agent’s cloud option. Close the laptop.
Local services, uncommitted work, or a signed-in tool
Use that agent’s first-party remote control, on a host that stays awake.
Several agents, one place to follow them
A multi-agent companion with a structured protocol and push notifications, after you have read its security model.
A CLI with no mobile client, or a remote Linux server
Tailscale, plus mosh or Eternal Terminal, plus tmux.
The task starts in team chat
A chat-native agent, such as Devin or Claude in Slack, or a messaging gateway you control.
Flavio’s advice holds: start with the mobile interface of the agent you already use, and make the first remote task a small fix in a project you know well. Coding agents from your phone.
Test it before you need it
- 1
Lock the phone for ten minutes
Did a notification arrive? Is the session where you left it?
- 2
Switch Wi-Fi and cellular
Change networks mid-task, then change back.
- 3
Sleep the computer
Close the laptop lid, or let the desktop sleep. See what the phone shows, and whether the session resumes.
- 4
Answer a permission from the phone
The command should be readable before you approve it.
- 5
Review a real diff
If you cannot judge it on the phone, ask for a smaller change, a summary, or a test result.
- 6
Confirm the checkout
Repository, branch and environment. A cloud checkout should contain the commit you expect.
- 7
Check the meter you will actually hit
Subscription limits, cloud sandbox time and API usage are billed in different places.