DIYgod releases Pinky: Claude Code and Cursor control iOS and Android via MCP

Agents have long since learned to write code and browse websites. But for most people the most important things live in the phone: the bank, messengers, taxis, two-factor authentication. DIYgod's Pinky project tries to close that gap: it gives an AI agent control of a smartphone and immediately puts a human in the way of dangerous actions.

What we know about Pinky

There is not much information yet: it is a short announcement on X, not documentation. From it we learn that Pinky is open source, connects via MCP (Model Context Protocol) to Claude Code and Cursor, and can directly control iOS and Android phones. For sensitive operations, such as payments and sending messages, there is a gateway. It requires human approval. Pinky also uses biometric authentication on the PC to unlock the phone.

How control is implemented on each platform is not stated in the post. You will have to check the repository.

What it looks like in practice

Imagine you are building a mobile app in Cursor. Usually you run a build, pick up the phone, walk through the sign-up flow and manually check that the screen hasn't broken. With an MCP bridge to the device, the agent can do this itself: install the build, open the app, go through onboarding, notice a bug and immediately suggest a code fix. You stay in the editor while the phone lies on the desk and "lives its own life."

The second scenario is routine inside the phone itself. For example, "find yesterday's invoice in the messenger and send it to the accountant." The agent finds the chat, drafts the message and runs into the gateway. It shows exactly what it is about to send and waits for your "yes." This is fundamentally different from the "give the agent full access and hope for the best" model.

Why the gateway matters more than the control itself

The ability to tap the screen is no longer news: many have similar demos. The harder part is something else: the phone is the most sensitive attack surface for an agent. It holds money, private conversations and verification codes. A single hallucination or a prompt injection from an incoming message ("forward this code here") can cause real damage.

That is why Pinky's approach is sensible: the list of dangerous actions is checked by a separate layer rather than by trusting the model. The model can be wrong, but the policy on the gateway can't, because it is ordinary code with clear rules. For a product manager this is a ready-made pattern: the agent can be given broad read and navigation rights, while irreversible actions are locked behind confirmation.

Biometrics on the PC solves an everyday problem: a locked phone stops any automation. But this is also a risk, because you are essentially opening the device remotely. It is worth finding out how the channel between the computer and the phone is protected.

Limitations and takeaway

To be honest, this is an early announcement. There is no data on stability, speed, OS version support or how the project behaves on complex interfaces. It is also unclear how reliably the gateway identifies a "sensitive" action. If the rule list is incomplete, the protection gives a false sense of security.

What a developer should do: install Pinky on a test phone without real payment data and check where the gateway triggers and where it lets things through. Mobile teams should take a look at MCP as a way to automate manual QA. Founders of agent products will find the scheme itself worth studying: broad access plus mandatory human confirmation for money and messages. That idea can be adopted even if Pinky itself doesn't suit you.