Buying guide
As agents run longer and in parallel, the hard part is staying in control without babysitting a terminal. These tools take very different approaches: notifications, full-session mirrors, phone approvals, per-tool policy, and audit. Here is what each one does, where it wins, and who it is for.
Does it work only with Claude Code, or also Codex, Cursor, Hermes, Windsurf, and any MCP client?
Can you actually approve or deny a blocked agent from your phone, away from your desk?
Can you set author-once rules (auto-approve safe reads, push on Bash, deny rm -rf) so you are not tapping every prompt?
Can a rule decide on the action's values, not just its name? A $12 refund and a $12,000 refund are the same tool call, so a name-only policy cannot tell them apart. None of the other tools below do this, though some agent frameworks now can: the Vercel AI SDK evaluates toolApproval against an Open Policy Agent policy, which is Rego you deploy rather than a rule you edit.
Is there an immutable, exportable record of every question and decision, for a team or compliance?
Does your code leave the machine? Is it end-to-end encrypted, or does it send only the decision?
Any OS or Mac-only? Native app, web push, or a daemon? Free, paid, or waitlist?
Pushary is a cross-vendor control plane for AI agents. You set one per-tool policy (auto-approve safe reads, push on Bash, escalate git push, always deny rm -rf), approve only what matters from your phone over web push, and keep an immutable, exportable audit trail of every decision. Rules can also read an action's arguments, so "refunds at or above $500 need a human" is a rule rather than code. It sends the decision, not your code, and works with Claude Code, Codex, Cursor, Hermes, Windsurf, and any MCP client, on any OS, with no native app. If the agent is one you ship to your own customers, the Partner plan points the same evaluation at them instead of at you.
Best for: Individuals and teams who want guardrails plus a record across more than one agent, on any platform.
Checked August 23, 2026
Anthropic ships Remote Control inside the Claude iOS and Android apps, so you can start and steer Claude Code sessions from your phone, get notified, and review diffs. It is polished, free, and no longer Max-only: it covers Pro, Max, Team and Enterprise, though on Team and Enterprise an Owner has to enable the toggle first. It is Claude-only, so it does not touch Codex, Cursor, Gemini CLI, or Hermes, and there is no per-tool policy engine or cross-agent audit trail. API keys are not supported, and it is unavailable on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry.
Best for: People who only run Claude Code, sign in through claude.ai, and want first-party phone control.
Checked August 23, 2026
OpenAI's Codex has a mobile experience that notifies you when a cloud task finishes and lets you approve blockers from your phone. It is free with a ChatGPT plan, but it is centered on Codex and OpenAI's cloud tasks. There is no per-tool policy across other agents and no exportable cross-agent audit trail.
Best for: ChatGPT and Codex users who want first-party notifications for Codex tasks.
Checked August 16, 2026
Happy is a free, open-source (MIT) app that mirrors your Claude Code and Codex session to your phone or the web, end-to-end encrypted, with parallel sessions and voice. You run the happy CLI instead of claude or codex. Approvals are manual and session-scoped, and the end-to-end encryption means there is no server-side audit trail to export.
Best for: Anyone who wants a free, private, full-session mirror and does not need policy or audit.
Checked August 23, 2026
Omnara is a command center that mirrors Claude Code and Codex to native apps, web, and CLI through a daemon on your machine. It adds parallel worktrees, two-way voice, and cloud failover. It streams session content, including code and diffs, to its backend, is not end-to-end encrypted yet, and approvals are manual with no per-tool policy engine.
Best for: People who want an IDE-grade remote control of the whole session, with voice and parallel worktrees.
Checked August 23, 2026
HumanLayer started as a human-in-the-loop SDK that developers embed in their own agents, routing approvals to Slack and email. It is now an open-source IDE for orchestrating coding-agent sessions, briefly renamed CodeLayer and since returned to the HumanLayer name, generally available rather than waitlisted: a free Starter tier covers 3 members and 200 sessions a month, Pro is $100 per user per month, and Enterprise is custom. There is still no dedicated mobile approval app, so approvals happen where you are already working rather than on a phone.
Best for: Builders embedding approvals into their own agents, or teams ready to adopt a new IDE.
Checked August 23, 2026
Conductor is a free, Mac-only desktop app that runs many Claude Code, Codex and Cursor agents in parallel, each in an isolated git worktree, with first-class diff review and merge. Approvals are manual desktop prompts, so you have to be at the Mac. There is no mobile surface, no per-tool policy engine, and no audit log.
Best for: Mac users who want to run many agents in parallel at their desk.
Checked August 23, 2026
Claude Code Notifier is a macOS menu bar app, with companion iOS and Android apps, that notifies you when Claude Code needs input or finishes, and can forward to Slack and Discord. It is Claude-only, with no human-in-the-loop questions and no policy engine, and keeps data on your device.
Best for: Claude-only users on macOS who want lightweight, private local notifications.
Checked August 23, 2026
Forge Remote is an iOS and Android app that streams and controls desktop Claude Code, Aider, and Codex CLI sessions from your phone. You install a relay, pair by QR, and approve or deny each tool action with a Low-to-Critical risk badge. It runs on your own Firebase project, so data stays in infrastructure you control. Approvals are per action, and we did not find a documented author-once policy engine or exportable audit trail.
Best for: Solo devs who want a native app with a risk score on every action and their data in their own Firebase.
Checked August 16, 2026
Onepilot is an iPhone-native agentic IDE and SSH terminal that deploys and controls coding agents on any server you reach over SSH. It works with Claude Code, Codex, Hermes, and custom frameworks, keeps credentials in the iOS Keychain, and lets you approve, interrupt, or redirect agents from your phone. It is free to start with your own server and API key, and is iOS-only with no per-tool policy engine or audit trail we could verify.
Best for: SSH-heavy developers who want to deploy and run agents on their own server from an iPhone.
Checked August 23, 2026
AgentsRoom runs many agents across projects on your desktop and mirrors the sessions to an end-to-end-encrypted iOS and Android companion app, where you can respond to prompts and approve actions. It supports Claude, Codex, Aider, OpenCode, and more, with a library of agent roles. It is free up to three projects and $9.99 a month for unlimited. It is full-session mirroring rather than a per-tool policy engine, and has no exportable audit trail we could verify.
Best for: Solo devs and small teams orchestrating a fleet of agents with full-session mobile mirroring.
Checked August 23, 2026
Cosyra gives you a persistent cloud Ubuntu box on your phone with Claude Code, Codex CLI, OpenCode, and Gemini CLI pre-installed, so agents keep running with your laptop closed. You bring your own LLM key and pay for compute, from a free hour to $29.99 a month. You can approve permissions and review diffs from the phone, but it is cloud-hosted rather than local-first, with no per-tool policy engine or audit trail we could verify.
Best for: Developers who want a persistent cloud Linux dev environment driven entirely from a phone.
Checked August 16, 2026
LeCoder MConnect is an open-source (MIT) layer that turns your laptop into a multi-agent server you control from an iOS app, pairing over a Cloudflare tunnel with no port forwarding. It reaches more than seven CLI agents including Claude, Cursor, Codex, and Gemini. The core is free and self-hostable, with a hosted tier at $20 a month. It focuses on remote access and monitoring rather than a per-tool approval policy or exportable audit trail.
Best for: Developers who want a free, open-source, self-hostable way to reach all their CLI agents from a phone.
Checked August 16, 2026
Fleetify (fleetify.dev) is a local-first desktop command center that orchestrates many coding agents in one window, with live per-tool-call cost pricing, spend caps, and one-click approve or deny gates on risky operations. It works with Claude, Codex, Gemini, Cursor, Devin, and more, and is free to start. Control is at the desktop, with no phone surface, and no per-tool policy engine or audit trail we could verify.
Best for: Developers running many agents at once who want live cost control and destructive-op gating from one screen.
Checked August 16, 2026
| Tool | Any MCP agent | Phone approval | Per-tool policy | Audit trail | Platform | Price |
|---|---|---|---|---|---|---|
| Pushary | Any OS, web push | $9.99/mo | ||||
| Claude Remote Control | iOS, Android (Claude app) | Free (Pro and up) | ||||
| Codex app | iOS, Android | Free (ChatGPT plan) | ||||
| Happy | iOS, Android, web | Free (MIT) | ||||
| Omnara | iOS, Android, web | Free tier + paid | ||||
| HumanLayer | IDE + SDK | Free tier, $100/user/mo | ||||
| Conductor | macOS app | Free | ||||
| Claude Code Notifier | macOS + mobile | Free + paid | ||||
| Forge Remote | iOS, Android | BYO Firebase | ||||
| Onepilot | iOS + SSH | Free + BYO server | ||||
| AgentsRoom | Desktop + mobile | Free + $9.99/mo | ||||
| Cosyra | iOS, Android (cloud) | Free hr + $29.99/mo | ||||
| LeCoder MConnect | Laptop + iOS | Free + $20/mo | ||||
| Fleetify | Desktop | Free to start |
Compiled July 2026 from each tool's public sources. An empty cell means no documented or public feature at that time, not a guarantee of absence. Vendor details change; verify current pricing and features before you decide.
You run more than one agent and want guardrails plus a record: Pushary. One policy and one audit trail across Claude Code, Codex, Cursor, Hermes, and Windsurf, from any phone.
You want free and open source above all: Happy for an encrypted mirror, or Conductor if you are on a Mac and want parallel orchestration.
You want to watch and drive the whole session remotely: Omnara, for its full mirror, voice, and cloud failover.
You are building your own agent or adopting a new IDE: HumanLayer and CodeLayer.
You only use Claude Code on a Mac and want simple alerts: Claude Code Notifier.
It depends on what you need. For per-tool guardrails plus an audit trail across more than one agent, on any OS, Pushary is the best fit. For a free, open-source, end-to-end-encrypted full-session mirror, Happy is excellent. For IDE-grade remote control with voice, Omnara. There is no single best tool, which is why this guide breaks down who each one is for.
Pushary, Forge Remote, and Onepilot are built to approve or deny an agent's actions from your phone. AgentsRoom, Cosyra, and LeCoder MConnect let you respond and approve through a mirrored mobile terminal. Conductor and Fleetify are desktop-only, and Claude Code Notifier notifies without an approval gate. Of these, Pushary is the one with an author-once per-tool policy and an exportable audit trail.
Anthropic's Claude Remote Control is free but needs a Claude Max plan, and OpenAI's Codex app is free with a ChatGPT plan. Both are single-vendor. Happy (MIT) and Conductor are free, and Claude Code Notifier and Omnara have free tiers. Pushary has a 3-day free trial, then $9.99/mo, and is the cross-agent option with per-tool policy and audit. HumanLayer and CodeLayer are waitlist-only with no public pricing.
Pushary works with Claude Code, Codex, Cursor, Hermes, Windsurf, and any MCP client. Happy, Omnara, and Conductor cover Claude Code and Codex. HumanLayer's CodeLayer and Claude Code Notifier are Claude-centric.
Pushary keeps an immutable, exportable audit trail of every question and decision. HumanLayer advertises an audit trail aimed at builders. The others are not built around compliance, and end-to-end-encrypted tools like Happy structurally cannot provide a queryable server-side audit log.
Yes, and many people do. For example, run parallel agents in Conductor on your Mac and use Pushary to approve them from your phone, or use Happy for an encrypted mirror and Pushary for policy and audit.
Pushary is approval-based access control for AI agents. You set per-tool policies and gate risky actions behind a human tap, which is the practical equivalent of RBAC plus approvals for agents.
Pushary governs what your agents may do at runtime and keeps an immutable audit trail of every decision, which is the runtime control and evidence part of AI agent posture management.
Yes. Pushary works across all major agents, including Codex, Cursor, Claude Code, Gemini, and Windsurf, through hooks or MCP.
Least privilege means giving an agent only the tools it needs and requiring a human approval for anything destructive. Pushary enforces this with per-tool policies and phone approvals.
Pushary has a kill switch that stops an agent mid-session across every agent connected to the workspace, not just the one you are looking at. It denies every pending and subsequent gated call rather than relying on you closing a terminal. Conductor and the vendor apps can stop a session you are attached to, but they stop that session only. If the requirement is halting an agent running somewhere you are not, the control has to sit in the approval path rather than in the UI.
File access is a policy question, not a separate product. In Pushary you write per-tool rules that match on the arguments, so Read on your repo is auto-approved while a Read or Edit touching .env, credentials, or a path outside the project is pushed to your phone or denied outright. A proven read-only command set is auto-approved by default, decided from 1,721 real production questions. Sandboxing tools like Docker or a devcontainer restrict the filesystem itself and pair well with this, because they set the outer boundary while the policy decides case by case inside it.
Pushary writes every gated call to an immutable audit trail: the tool, the arguments, the policy that matched, who was asked, what they chose, and when. It is queryable in the dashboard and exportable, and it spans agents, so a Claude Code session and a Codex session land in the same log. That gives you replay in the sense that matters for an audit, which is the ordered record of what was attempted and what was allowed. End-to-end-encrypted mirrors cannot offer this, because the server never sees the content.
Pushary is built as one control plane across agents: one permission policy, one approval path, one audit trail covering Claude Code, Codex, Cursor, Hermes, Windsurf, and any MCP client. HumanLayer targets a similar builder-side problem and is waitlist-only. The rest of this list are single-vendor remote controls, which means running several of them leaves you with several separate records and no shared policy.
Classic RBAC assigns permissions to roles ahead of time, which fits humans and fits agents poorly, because the risk lives in the arguments rather than the role. Running git status and running git push --force are the same Bash tool. The workable shape is approval-based access control: author rules per tool and per argument pattern, auto-approve the proven-safe set, and route the rest to a human with a fail-closed default. That is what Pushary does, and it is why the policy matches on tool input and not just tool name.
An agent that runs when nobody is watching needs the gate to survive you being away, which rules out anything resolving in a terminal. Three things have to be true: the decision reaches a phone rather than a screen, the wait is durable so a crash or deploy does not lose it, and an unanswered question denies instead of assuming yes. Pushary does all three, and logs the outcome. Notification-only tools cover the first and none of the rest, which is the usual gap.
That is a different problem from controlling your own agents, and most tools on this page do not do it. You need the approval addressed to your end-user rather than to you, with no account and no app on their side. Pushary's Partner plan covers it: enroll(externalId) maps your own user id to that person's phone with one keyless tap, decisions.ask() blocks your agent until they answer, and the decide page carries your brand. Published adapters cover the Vercel AI SDK, LangGraph, LangChain, CrewAI, Mastra, the OpenAI Agents SDK, and n8n over plain HTTP.
Everything compared above assumes you are the person approving. If you ship a product that runs an agent for other people, the approver is your customer instead, and almost none of these tools do that. The pages below cover that case: the API, the framework adapters, and the plan you embed.
Set your guardrails once, approve from your phone, and keep an exportable audit trail. Works with Claude Code, Codex, Cursor, Hermes, and any MCP client. 3-day free trial.
