Your AI Agent Can Drive A Real Phone Now. What Does That Cost You?

Last Updated: 2026-11-04

Key takeaways

• ▪ Phone Harness MCP is a hosted Model Context Protocol server that gives any MCP client 15 tools to read, tap, type and swipe on a real iPhone or a cloud Android.
• ▪ Cloud Android emulators cost 5 cents a phone-minute with $5 of trial credit. A real cloud iPhone is $80 a month flat, or $100 with an eSIM and a real phone number.
• ▪ The MCP wrapper defaults to a 30 minute session, six times the API default of 5 minutes, so an unnamed start costs $1.50 and the trial credit covers three of them.
• ▪ It works by borrowing the human interface rather than an API, which is why it reaches apps that block bots, and why it can only ever act as you.
• ▪ The privacy policy logs commands, text entered, taps and the apps used, so anything typed into the phone, including passwords and one-time codes, is recorded server-side.
• ▪ The terms forbid fraud, bulk account creation and ban evasion, while the marketing sells stealth, real numbers and 2FA. Read both before you buy, and give the agent a phone that is not yours.

Phone Harness MCP lets any agent that speaks the Model Context Protocol drive a real iPhone or an Android emulator in the cloud, with 15 tools and nothing installed on the phone. It shipped on 2 November 2026 and the launch post drew 330,056 views and 5,621 bookmarks in two days, more bookmarks than likes, which is the signature of people filing it away to try later. The capability is real. The buying question is not capability. It is custody: the agent acts as you, on a handset that carries your logins and your second factor, and every keystroke passes through the vendor's activity log. Budget $1.50 for a default emulator session and $80 a month for a real iPhone, then decide which identity you are willing to lend it.

What is Phone Harness MCP?

Phone Harness MCP is a hosted Model Context Protocol server that connects an AI agent to a real phone. You paste one URL, sign in, and the agent receives 15 tools to read the screen, tap, type, swipe, press system buttons, list apps and launch them. The server is a thin HTTPS client of Phone Harness Cloud: it never holds a phone, runs no shell, and keeps no state between tool calls. On Android it drives a cloud emulator over adb and reads the phone's accessibility tree. On iPhone it drives a real handset over HTTPS and reads the screen with text recognition.

The Model Context Protocol is the plumbing that lets a chat client call external tools. A remote MCP server is just an HTTPS endpoint that advertises a tool list. That is the whole trick here: Phone Harness runs one endpoint at https://mcp.phone-harness.com/mcp, and every client that supports streamable HTTP connectors can use it. The documented list runs from Claude and ChatGPT through Cursor, Codex, VS Code, Windsurf, Devin, Gemini CLI, Copilot, Perplexity, Warp, Raycast, Manus, Zed, Muse Code and OpenClaw. There is one caveat worth knowing before you plan a rollout: on ChatGPT web, custom MCP servers are limited to Business, Enterprise and Edu workspaces, because Pro accounts can only connect servers that expose read and fetch tools.

The project has two halves and they ship separately. The open-source harness, phone-harness/phone-harness, is MIT licensed, was created on 7 August 2026, and carried 4,217 stars and 424 forks when we checked on 4 November 2026. The MCP server is its own MIT repo, created on 23 October 2026, with 553 stars and 33 forks, and its PyPI package phone-harness-mcp is at 0.1.0. The tweet's "available in phone-harness 0.3.3" refers to the command line package, not the server. The company behind it is a one-person Y Combinator Fall 2026 company in San Francisco, founded by Shawn Pana, who was previously head of growth at Browser Use.

It also has a deliberate hole: there is no tool that opens a URL. An agent can launch an app by name or package id, but it cannot hand the phone a link. For a tool that is otherwise trying to be the agent's hands, that omission is a design choice, and a sensible one, since a URL is the one input that can move a phone from a known app into an unknown web page with its own session and its own cookies.

What can an agent actually do on a phone?

The server registers 15 tools, and every one except the first two takes a device id from phone_list_available_devices. The agent can start and stop a phone, ask for the screen size, take a JPEG screenshot with a coordinate mapping line, list the visible text with tap-ready centres, tap, long press, swipe, type with an optional Enter, press HOME, BACK, APP_SWITCHER or ENTER, list installed apps, launch one, and ask which app is in front. The tool names deliberately follow the open-source mobile-mcp project, so scripts written for one harness port to the other.

The two eyes are not the same, and the difference matters when you scope a job. On Android the harness reads the real accessibility tree, so it gets exact strings and exact boxes, and a control with no visible label can still be found by its identifier. On iPhone it captures the mirroring window and runs Apple's Vision text recognition over it. That sees words, not icons, so any screen built from unlabeled glyphs needs a screenshot and a vision-capable model in the loop. If your workflow depends on a row of icons with no text, the Android path is the cheaper and more reliable one.

What the agent cannot do is verify itself. The maintainer's own guidance is blunt about why the helpers return observations rather than verdicts: every rule that fit a list broke on a feed, and every rule that fit a feed broke on a strip that scrolls inside a still screen. So the loop is the method. Name what should change, do one action, check that one thing, and isolate the failure. An agent left to decide on its own that a tap worked will eventually tell you it booked the appointment when it only opened the calendar.

What does a phone for your agent cost?

A cloud Android emulator costs 5 cents per phone-minute, billed from the moment it reports ready until the session ends, with boot time free and partial final minutes rounded up. New accounts start with $5 of credit, which is 100 minutes, and top-ups run from $5 to $200 with no expiry. A real cloud iPhone is a flat subscription instead: $80 per phone per month, or $768 a year, and $100 a month with an eSIM and a real phone number. Each account can hold 8 phones at once, a phone takes about 80 seconds to become ready, and there is no unlimited session mode.

Option	Price	Billing	What you get
Cloud Android emulator	5 cents per phone-minute	Metered from ready to close, boot free	A fresh emulator, or a saved one that keeps apps and logins
Cloud iPhone	$80 per month ($768 a year)	Flat, not metered	A real handset on a Mac the vendor runs, wiped only on request
Cloud iPhone with eSIM	$100 per month ($960 a year)	Flat, not metered	The same, plus a real phone number for SMS and 2FA
Dedicated phones	Custom	Invoiced, volume pricing	Reserved real phones, multiple profiles each, your choice of residential or dedicated proxies

Two pieces of arithmetic are worth doing before you pick a tier, and both are ours rather than the vendor's. First, $80 a month divided by 1,600 phone-minutes works out at 5 cents a minute, so a real iPhone matches emulator pricing at roughly 27 hours of use a month. Below that, the emulator is cheaper. Above it, the flat subscription wins, and you also stop worrying about a session clock. Second, the MCP wrapper's minutes parameter defaults to 30, while the API's own timeout_seconds defaults to 300 seconds. That is a six-fold difference in the default: an agent that calls phone_start_device without naming a duration spends $1.50, and the $5 trial credit covers exactly three such starts. Tell the agent to pass a short duration explicitly, and tell it to stop the phone when the task is done.

For a market comparison, AWS Device Farm lists $0.17 per device-minute for real devices. At 5 cents an emulator is roughly a third of that per minute, but the two products are not the same thing: Device Farm is a test harness you point a suite at, and Phone Harness is an endpoint an agent drives turn by turn. The honest cost metric for the second is not cents per minute. It is cost per accepted outcome, because a 40 minute session that fails and a 4 minute session that succeeds look identical on the invoice until you count what came out the other end.

What does it log, and whose identity does the agent borrow?

The privacy policy says that when you or your agent use a phone, the service automatically logs that activity, including commands and their inputs, text entered, taps and other interactions, apps and pages used, and session details, retained for as long as needed to run and secure the service. Read that list again with a login in mind. Every character the agent types into a password field and every one-time code it reads passes through that log. The policy also says the vendor does not inspect phone contents beyond what is needed to operate the service or investigate abuse, and that is a reasonable commitment, but a log of keystrokes is still a log of secrets.

The second half of the custody question is whose identity the agent wears. The marketing is unusually direct about this. The home page sells stealth, described as real hardware where apps see a person, real phone numbers with SMS and 2FA handled, and persistent state where logins survive between runs. The Y Combinator company page says the product can access 2FA, MFA and SMS codes to complete login. Those are true statements about what the plumbing does, and they are the reason the product is useful for end-to-end testing of a login flow.

They are also the reason the terms of service matter more than the feature list. The acceptable use clause requires lawful use and use only with services whose terms allow automated or non-personal access, and then names the prohibitions: no fraud, no spam, no harassment, no evading bans or sanctions, no creating accounts in bulk against a service's rules. Breach means suspension without refund. So the vendor has drawn the line in the contract and left the compliance judgement with you, which is the normal shape for a general purpose tool, but it does mean the same five features appear in both the sales page and the risk register. There is at least one control on the vendor side: the account endpoint returns a can_rent flag and a rent_blocked_reason, which is an access gate on renting real iPhones rather than just on signing up.

The technical counterweight is app attestation. Google's Play Integrity API and Apple's App Attest and DeviceCheck give an app a cryptographic verdict on whether the device and the app are genuine, and emulators and virtual iOS instances fail those checks reliably. So "apps see a person" is accurate against apps that do not check, and inaccurate against the apps that most need protecting, which are usually the ones handling money, identity or inventory. If your plan depends on a specific third-party app treating the agent as human, test that assumption on day one rather than at month three.

Where does it break?

The documented limits are more specific than most launch posts admit. A PIN-locked Android needs a person. Unlocking an iPhone pauses mirroring. Text recognition reads words, not icons. There is no multi-touch, no camera flow and no Face ID flow, and DRM video renders black. Connecting the phone is always the user's job. The iPhone path also needs macOS 15 or later with iPhone Mirroring paired to an iOS 18 or later handset, plus Accessibility and Screen Recording permission for whatever process runs the agent.

Constraint	What it means in practice
iPhone Mirroring is unavailable in the European Union	Apple withheld the feature in June 2024 citing Digital Markets Act uncertainty and confirmed at WWDC 2025 it would not ship with iOS 26 or macOS 26. The bring-your-own-iPhone path is geo-fenced out of the EU.
No multi-touch, camera or Face ID	Pinch to zoom, QR scanning and biometric confirmation are out. Plan a human step or a different transport.
Text recognition on iPhone	Icon-only controls need a screenshot and a vision model. Budget the tokens.
8 phones per account, about 80 seconds to boot	Provisioning counts against the session deadline. Choose the duration after you know the boot cost, not before.
No URL tool	The agent launches apps, it does not navigate the web on the phone. Deep links have to arrive some other way.
Operations on one phone are serialized	Sending ten parallel taps does not make the phone faster. Parallelism comes from more phones, which costs more money.

The EU point deserves its own sentence because it is easy to miss in a demo video. Apple did not ship iPhone Mirroring to EU users, and as of the 2025 developer conference it had not committed to doing so. That removes the open-source iPhone path for any Australian business with EU staff or EU customers who want to run the harness locally. Cloud iPhones are driven over HTTPS from the vendor's own Macs, so they sidestep the gate, but the self-hosted iPhone story stops at the EU border. Android over adb is unaffected, and WebDriverAgent remains the sanctioned way to automate an iPhone you own anywhere in the world, at the cost of Xcode signing and an afternoon of setup.

There is also no crowd to consult. The original Show HN post in August 2026 finished with 2 points and no comments, and a search of Hacker News on 4 November 2026 turned up no discussion thread for the MCP launch. That is not a criticism of the product, it is a warning about the evidence base: everything above comes from the vendor's own documentation, contract and privacy policy, plus one independent review from August 2026 that concluded the agent gets the same reach you have, banking apps, messages and purchases included, with no permission scoping and no undo. Treat the vendor's numbers as vendor numbers, and test the rest yourself.

Who should use it, and who should not?

The tool fits three shapes of work and fails two others. It fits when the app you need to drive is yours and you are testing it before release. It fits when a workflow only exists inside a mobile app and there is no web equivalent. It fits when you want an agent to do a supervised, repetitive task on a dedicated handset. It does not fit anything that touches your personal banking, your government identity or your own second factor, and it does not fit bulk account creation or ban evasion, which the vendor's own terms prohibit. If you are in the EU and want to drive an iPhone you own, it does not fit at all.

Use case	Verdict	Rule
Release testing your own mobile app	Strong fit	Emulator for volume, one real iPhone for the flows that only break on hardware
A workflow that exists only in a mobile app	Fit, with conditions	Dedicated phone, its own number, no personal accounts, a human approval on any payment or send step
Supervised repetitive admin on a handset	Fit	Watch the session, keep it under 30 minutes, stop the phone when the job ends
Banking, government portals, your own 2FA	Do not	The agent inherits your identity with no scoping and no undo
Bulk accounts, ban evasion, scraping behind a login	Do not	Prohibited by the vendor's terms and by the target service's terms
Bring-your-own iPhone in the EU	Blocked	iPhone Mirroring is not available there. Use Android over adb, or WebDriverAgent

What should you do this week?

Run one real task end to end before you plan a rollout. Sign up, spend the $5 of credit on an emulator, and give the agent a job you can verify from the outside, such as installing your own app and walking the first-run flow. Time it, count the minutes, and read back every character the agent typed. Then decide whether the phone it drove should be yours or a stranger's, and put an approval gate in front of the script before the second run.

1. Spend the trial credit on one task. Five dollars buys 100 emulator-minutes. Give the agent a job with an outcome you can check without trusting the agent's own report.
2. Set the duration explicitly. Pass 5 or 10 minutes rather than accepting the 30 minute MCP default, and make stopping the phone part of the task, not an afterthought.
3. Write down what it typed. List every field the agent filled and every code it read. If a password or a one-time code is on that list, you have found the boundary of where this tool belongs in your business.
4. Choose a phone that is not yours. A dedicated handset with its own number, no personal logins and no shared inbox is the only shape that survives an incident review.
5. Put a person in front of the script. The OpenClaw and Hermes integrations ask before every script by default, and the classifier that can skip that prompt is off unless you opt in, because it is a heuristic that can be bypassed. Keep it off.

Frequently asked questions

What is Phone Harness MCP?

Phone Harness MCP is a hosted Model Context Protocol server at mcp.phone-harness.com/mcp that gives any MCP client 15 tools to read, tap, type and swipe on a real iPhone or a cloud Android. It is a thin client of Phone Harness Cloud, so it holds no phone itself and keeps no state between tool calls. It is MIT licensed and shipped on 2 November 2026.

Can an AI agent control my iPhone without jailbreaking it?

Yes, on macOS 15 or later, using iPhone Mirroring paired to an iOS 18 or later handset, with Accessibility and Screen Recording permission granted to the process running the agent. Nothing is installed on the phone and no jailbreak is involved. The phone must stay locked for mirroring to work, and unlocking it pauses the session. The feature is not available in the European Union.

How much does Phone Harness cost?

Cloud Android emulators are 5 cents per phone-minute, metered from the moment the phone is ready, with $5 of trial credit on a new account. A real cloud iPhone is $80 per phone per month, or $768 a year, and $100 a month with an eSIM and a real phone number. Dedicated phones are custom priced. An account can run 8 phones at once.

Is it safe to let an AI agent use my phone?

Treat it as high risk and supervise it. The agent gets the same reach you have, including messages, purchases and any app already signed in, with no permission scoping and no undo. The privacy policy also logs commands, text entered, taps and the apps used, so credentials and one-time codes typed into the phone are recorded server-side. Use a dedicated phone with its own number and no personal accounts.

Does Phone Harness work in Australia and the EU?

It works in Australia. The hosted cloud phones are driven over HTTPS and are not affected by region. The bring-your-own-iPhone path is different: Apple has withheld iPhone Mirroring from the European Union, citing Digital Markets Act uncertainty, and confirmed at WWDC 2025 that it would not ship with iOS 26 or macOS 26. EU users can still drive Android over adb or use WebDriverAgent.