Buying guide
As agents run longer and in parallel, the hard part is staying in control without babysitting a terminal. These tools take very different approaches: notifications, full-session mirrors, phone approvals, per-tool policy, and audit. Here is what each one does, where it wins, and who it is for.
Does it work only with Claude Code, or also Codex, Cursor, Hermes, Devin Desktop, and any MCP client?
Can you actually approve or deny a blocked agent from your phone, away from your desk?
Can you set author-once rules (auto-approve safe reads, push on Bash, deny rm -rf) so you are not tapping every prompt?
Can a rule decide on the action's values, not just its name? A $12 refund and a $12,000 refund are the same tool call, so a name-only policy cannot tell them apart. None of the other tools below do this. Command allowlists, like Forge Remote's or Fleetify's, match the command text but cannot compare a value such as an amount. Some agent frameworks now can: the Vercel AI SDK can check toolApproval against an Open Policy Agent policy through @ai-sdk/policy-opa, which is Rego you write rather than a rule you edit.
Is there an immutable, exportable record of every question and decision, for a team or compliance?
Does your code leave the machine? Is it end-to-end encrypted, or does it send only the decision?
Any OS or Mac-only? Native app, push notifications, or a daemon? Free, paid, or waitlist?
Pushary is one control panel for all your AI agents. You set one rule per tool: safe reads run on their own, Bash and git push ask you first, rm -rf is always blocked. You approve from your phone, your browser or your Mac, and every answer is saved. On Agent Pro and up you can filter and export it. Rules can read what an action does, so "refunds of $500 or more need a person" is a rule, not code. It sends the question, not your code, and works with Claude Code, Codex, Cursor, Hermes, Devin Desktop (formerly Windsurf), and any MCP client, on any OS. If you ship the agent to your own customers, the Partner plan asks them instead of you.
Best for: Individuals and teams who want guardrails plus a record across more than one agent, on any platform.
Checked October 18, 2026
Anthropic ships Remote Control inside the Claude iOS and Android apps, so you can start and steer Claude Code sessions from your phone, get notified, and review diffs. It is polished, free, and no longer Max-only: it covers Pro, Max, Team and Enterprise, though on Team and Enterprise an Owner has to enable the toggle first. It is Claude-only, so it does not touch Codex, Cursor, Gemini CLI, or Hermes, and there is no cross-agent per-tool policy or audit trail. API keys are not supported, and it is unavailable on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry.
Best for: People who only run Claude Code, sign in through claude.ai, and want first-party phone control.
Checked October 18, 2026
OpenAI's Codex Remote links the ChatGPT app on your phone to Codex in the ChatGPT desktop app, so you can follow a task, send instructions and approve its requests. It is included with paid ChatGPT plans, and setup starts from the desktop app. The Codex CLI has only an early codex remote-control command, which reaches a session while its own daemon keeps running. There is no per-tool policy across other agents and no exportable cross-agent audit trail.
Best for: People who run Codex in the ChatGPT desktop app and want first-party phone control.
Checked October 18, 2026
Happy is a free, open-source (MIT) app that mirrors your Claude Code, Codex and Grok sessions to your phone or the web, end-to-end encrypted, with parallel sessions and voice. Voice is 20 free minutes a month, then a subscription. You run Happy Desktop or the happy CLI, and approve requests yourself or let a session run in Auto mode. The end-to-end encryption means there is no server-side audit trail to export.
Best for: Anyone who wants a free, private, full-session mirror and does not need policy or audit.
Checked October 18, 2026
HumanLayer started as a human-in-the-loop SDK that developers embedded in their own agents, routing approvals to Slack and email. That SDK is deprecated. HumanLayer is now an IDE for orchestrating coding-agent sessions, not yet open source, briefly renamed CodeLayer and since returned to the HumanLayer name. It is generally available: a free Starter tier covers 3 members and 200 sessions a month, Pro is $100 per user per month, and Enterprise is custom. There is no dedicated mobile approval app, though the same UI runs on web, desktop or phone.
Best for: Teams ready to adopt a new IDE built around coding-agent sessions.
Checked October 18, 2026
Conductor is a Mac desktop app that runs many Claude Code, Codex, Cursor and OpenCode agents in parallel, each in an isolated git worktree, with first-class diff review and merge. The desktop app is free. Pro, at $50 a month, adds Conductor Cloud workspaces and a mobile app for chatting with agents and merging pull requests from your phone. There is no per-tool policy engine and no audit log.
Best for: Mac users who want to run many agents in parallel, at their desk or in the cloud.
Checked October 18, 2026
Claude Code Notifier is a macOS menu bar app, with companion iOS and Android apps, that notifies you when Claude Code needs input, and can forward to webhooks. It is Claude-only with no policy engine. With a mobile subscription it relays Claude Code's own permission prompts and questions to your phone, so you can approve tool use or answer from there. Mobile replies need iTerm2 for now, and they pass through its encrypted relay server and are deleted within 24 hours.
Best for: Claude-only users on macOS who want simple alerts and replies from their phone.
Checked October 18, 2026
Forge Remote is an iOS and Android app, now aimed at mobile app developers, that drives Claude Code on your computer from your phone. You install a relay, pair by QR, and approve or deny actions in the sessions it starts, each with a Low-to-Critical risk badge. It runs on your own Firebase project, so data stays in infrastructure you control. It has an auto-approve list for commands you trust, and high-risk commands always ask. We did not find an exportable audit trail.
Best for: Solo devs who want a native app with a risk score on every action and their data in their own Firebase.
Checked October 18, 2026
Onepilot is an iPhone SSH terminal for your own servers. It detects the Claude Code, Codex and OpenCode sessions running there and streams them live, so you can follow a run and jump into the terminal to respond, and it can deploy a persistent agent built on a framework like OpenClaw or Hermes. It is free to download, and is iOS-only with no per-tool policy engine or audit trail we could verify.
Best for: SSH-heavy developers who want to deploy and run agents on their own server from an iPhone.
Checked October 18, 2026
AgentsRoom runs many agents across projects on your desktop and mirrors the sessions to an end-to-end-encrypted iOS and Android companion app, where you can respond to prompts and approve actions. It supports Claude, Codex, Aider, OpenCode, and more, with a library of agent roles. It is free for two projects, and Pro at €7.99 a month lifts the caps. It is full-session mirroring rather than a per-tool policy engine, and has no exportable audit trail we could verify.
Best for: Solo devs and small teams orchestrating a fleet of agents with full-session mobile mirroring.
Checked October 18, 2026
Cosyra gives you a persistent cloud Ubuntu box on your phone with Claude Code, Codex CLI, OpenCode, and Antigravity CLI pre-installed, so agents keep running with your laptop closed. You sign in to your own agents and pay $20 or $30 a month for the workspace, after a 7-day trial in the App Store app. You can approve permissions and review diffs from the phone, but it is cloud-hosted rather than local-first, with no per-tool policy engine or audit trail we could verify.
Best for: Developers who want a persistent cloud Linux dev environment driven entirely from a phone.
Checked October 18, 2026
LeCoder MConnect is an open-source (MIT) layer that turns your laptop into a multi-agent server you control from an iOS app, now in TestFlight beta, pairing over a Cloudflare tunnel with no port forwarding. It works with any CLI agent, including Claude Code, Cursor, Codex, and Gemini CLI. The core is free and self-hostable. It focuses on remote access and monitoring rather than a per-tool approval policy or exportable audit trail.
Best for: Developers who want a free, open-source, self-hostable way to reach all their CLI agents from a phone.
Checked October 18, 2026
Fleetify (fleetify.dev) is a local-first desktop command center that orchestrates many coding agents in one window, with live per-tool-call cost pricing, spend caps, and one-click approve or deny gates on risky operations. It works with Claude, Codex, Gemini, Cursor, Devin, and more. It is in private beta with a waitlist. Its paid plans list automated approval rules, and the Team plan adds shared approval policies and audit logs. Control is at the desktop, with no phone surface.
Best for: Developers running many agents at once who want live cost control and destructive-op gating from one screen.
Checked October 18, 2026
Omnara used to mirror Claude Code and Codex to native apps, web, and CLI through a daemon on your machine, with parallel worktrees, two-way voice, and cloud failover. It has since become an open-source managed-agent platform. Its blog calls the remote coding app its previous product, and the iOS app is no longer in the App Store.
Best for: No longer an option for controlling coding agents from your phone. If you used it for that, the tools above cover it.
Checked October 18, 2026
| Tool | Any MCP agent | Phone approval | Per-tool policy | Audit trail | Platform | Price |
|---|---|---|---|---|---|---|
| Pushary | Any OS, push notifications | $9.99/mo | ||||
| Claude Remote Control | iOS, Android (Claude app) | Free (Pro and up) | ||||
| Codex app | iOS, Android | Paid ChatGPT plans | ||||
| Happy | iOS, Android, web | Free (MIT), paid voice | ||||
| HumanLayer | IDE, web, phone | Free tier, $100/user/mo | ||||
| Conductor | macOS, iOS (Pro) | Free + $50/mo | ||||
| Claude Code Notifier | macOS + mobile | Free + paid | ||||
| Forge Remote | iOS, Android | BYO Firebase | ||||
| Onepilot | iOS + SSH | Free + BYO server | ||||
| AgentsRoom | Desktop + mobile | Free + €7.99/mo | ||||
| Cosyra | iOS, Android (cloud) | 7-day trial + $20/mo | ||||
| LeCoder MConnect | Laptop + iOS (beta) | Free | ||||
| Fleetify | Desktop | Free + $29/mo (beta) | ||||
| Omnara (discontinued) | No longer offered | n/a |
Checked October 2026 against each tool's public sources. An empty cell means no documented or public feature at that time, not a guarantee of absence. Vendor details change; verify current pricing and features before you decide.
You run more than one agent and want guardrails plus a record: Pushary. One policy and one audit trail across Claude Code, Codex, Cursor and Hermes, plus questions from any MCP client such as Devin Desktop, from any phone.
You want free and open source above all: Happy, for an encrypted mirror.
You want to watch and drive the whole session remotely: Happy, for an encrypted full-session mirror, or Anthropic's Remote Control if you only run Claude Code.
You want a new IDE built around agent sessions: HumanLayer.
You only use Claude Code on a Mac and want simple alerts: Claude Code Notifier.
It depends on what you need. For per-tool guardrails plus an audit trail across more than one agent, on any OS, Pushary is the best fit. For a free, open-source, end-to-end-encrypted full-session mirror, Happy is excellent. For first-party phone control of Claude Code alone, Anthropic's Remote Control. There is no single best tool, which is why this guide breaks down who each one is for.
Pushary, Forge Remote, and Claude Code Notifier let you approve or deny an agent's actions from your phone. Happy, Anthropic's Remote Control and OpenAI's Codex Remote also approve from the phone, each for the agents it supports. AgentsRoom, Cosyra, Onepilot, and LeCoder MConnect let you respond and approve through a mirrored mobile terminal. Fleetify is desktop-only, and Conductor's mobile app, on its Pro plan, lets you chat with agents and merge pull requests in cloud workspaces. Of these, Pushary is the one with an author-once per-tool policy and an audit trail you can export on Agent Pro and up.
Anthropic's Claude Remote Control is included with Claude Pro, Max, Team and Enterprise plans, and OpenAI's Codex Remote is included with paid ChatGPT plans. Both are single-vendor. Happy is free and open source (MIT), with paid voice. Conductor, HumanLayer and Claude Code Notifier have free tiers. Pushary has a 3-day free trial, then $9.99/mo, and is the cross-agent option with per-tool policy and audit.
Pushary works with Claude Code, Codex, Cursor, Hermes, Devin Desktop (formerly Windsurf), and any MCP client. Happy covers Claude Code, Codex and Grok. Conductor adds Cursor and OpenCode. HumanLayer covers Claude Code, Codex and Copilot. Claude Code Notifier is Claude-only.
Pushary keeps an immutable audit trail of every question and decision, with filtering and export on Agent Pro and up. HumanLayer lists audit logs on its Enterprise plan, and Fleetify on its Team plan. The others are not built around compliance, and end-to-end-encrypted tools like Happy structurally cannot provide a queryable server-side audit log.
Yes, and many people do. For example, run parallel agents in Conductor on your Mac and use Pushary to approve them from your phone, or use Happy for an encrypted mirror and Pushary for policy and audit.
Pushary is approval-based access control for AI agents. You set per-tool policies and gate risky actions behind a human tap, which is the practical equivalent of RBAC plus approvals for agents.
Pushary governs what your agents may do at runtime and keeps an immutable audit trail of every decision, which is the runtime control and evidence part of AI agent posture management.
Yes. Pushary works across all major agents, including Codex, Cursor, Claude Code, Gemini, and Devin Desktop (formerly Windsurf), through hooks or MCP.
Least privilege means giving an agent only the tools it needs and requiring a human approval for anything destructive. Pushary enforces this with per-tool policies and phone approvals.
Pushary's kill switch stops one session from the phone app, a question's web page or the dashboard, or every session on the site with Stop all agents in the phone app. For hooked agents it denies every later tool call in that session, including auto-approved ones, and cancels its open questions, for one hour. An MCP-only client is told to stop the next time it asks, but its tool calls are not blocked. Conductor and the vendor apps can stop a session you are attached to, but they stop that session only. If the requirement is halting an agent running somewhere you are not, the control has to sit in the approval path rather than in the UI.
File access is a policy question, not a separate product. In Pushary you write per-tool rules that match on the arguments, so Read on your repo is auto-approved while a Read or Edit touching .env, credentials, or a path outside the project is pushed to your phone or denied outright. A proven read-only command set is auto-approved by default, decided from 1,721 real production questions. Sandboxing tools like Docker or a devcontainer restrict the filesystem itself and pair well with this, because they set the outer boundary while the policy decides case by case inside it.
Pushary writes every gated call to an immutable audit trail: the tool, the arguments, the policy that matched, who was asked, what they chose, and when. It is queryable in the dashboard, filterable and exportable on Agent Pro and up, and it spans agents, so a Claude Code session and a Codex session land in the same log. That gives you replay in the sense that matters for an audit, which is the ordered record of what was attempted and what was allowed. End-to-end-encrypted mirrors cannot offer this, because the server never sees the content.
Pushary is built as one control plane across agents: one permission policy and one approval path for the agents it hooks, such as Claude Code, Codex, Cursor and Hermes, and one audit trail that also covers questions from any MCP client. HumanLayer is now an IDE for agent sessions, with audit logs on its Enterprise plan. Fleetify's Team plan adds shared approval policies and audit logs, at the desktop. Most of the rest are remote controls or desktop orchestrators, which means running several of them leaves you with several separate records and no shared policy.
Classic RBAC assigns permissions to roles ahead of time, which fits humans and fits agents poorly, because the risk lives in the arguments rather than the role. Running git status and running git push --force are the same Bash tool. The workable shape is approval-based access control: author rules per tool and per argument pattern, auto-approve the proven-safe set, and route the rest to a human, never treating silence as a yes unless you chose that for a rule. That is what Pushary does, and it is why the policy matches on tool input and not just tool name.
An agent that runs when nobody is watching needs the gate to survive you being away, which rules out anything resolving in a terminal. Three things have to be true: the decision reaches a phone rather than a screen, the wait is durable so a crash or deploy does not lose it, and an unanswered question never counts as a yes unless you set that rule's timeout action to approve. Pushary does all three, and logs the outcome. Notification-only tools cover the first and none of the rest, which is the usual gap.
That is a different problem from controlling your own agents, and most tools on this page do not do it. You need the approval addressed to your end-user rather than to you, with no Pushary account on their side. Pushary's Partner plan covers it: enroll(externalId) gives you a link that connects that person's phone once, decisions.ask() makes your agent wait until they answer, and the notification carries your product's name. Published adapters cover the Vercel AI SDK, LangGraph, LangChain, CrewAI, Mastra, the OpenAI Agents SDK, and n8n over plain HTTP.
Everything compared above assumes you are the person approving. If you ship a product that runs an agent for other people, the approver is your customer instead, and almost none of these tools do that. The pages below cover that case: the API, the framework adapters, and the plan you embed.
Set your guardrails once, approve from your phone, and keep an audit trail. Works with Claude Code, Codex, Cursor, Hermes, and any MCP client. 3-day free trial.
Start your trial