---
title: "iPhone Use, read from source: what Codex can do to a phone"
description: "iPhone Use lets Codex operate a real iPhone over USB. We read the source: its 17 tools, where it stops for you, what leaves your Mac and what it never mentions."
url: https://personalagentbench.com/phone-use/iphone-use/
last_updated: 2026-10-13
---

# iPhone Use, read from source: what Codex can do to your phone

iPhone Use is an open-source plugin that lets Codex, and two Chinese desktop assistants, operate a real iPhone plugged into a Mac: open apps, read the screen, tap, scroll and type. It went on GitHub on 6 October 2026 and had 3,504 stars a week later, one of the fastest-rising of the open-source [phone use agents](https://personalagentbench.com/phone-use/) we track. We have not run it. We have no spare phone we are willing to hand to an agent, and we would not test it on an account we care about. This page is a reading of its source at one pinned commit: what it can do, where it stops for you, and what leaves your Mac.

- iPhone Use gives the agent 17 tools. Seven only read the screen; the rest act on it, including tapping anywhere, typing, launching any installed app and running up to 20 steps in one call.
- The code refuses to type into password fields and stops a batch after an unverified submit. Everything else that protects you, including how it handles sending and payment, is instruction text the model is asked to follow.
- Screenshots and the screen's element tree go to whichever model the host assistant uses. The Codex install also sends anonymous usage events to PostHog by default; the two other installers switch that off.
- The repository says nothing about whether apps such as WeChat or Alipay detect this kind of automation, or what happens to an account that is caught.

## What iPhone Use is and who builds it

The project lives at [zhongerxin/iPhone-use](https://github.com/zhongerxin/iPhone-use) under the MIT licence. Its README describes it as a way to let Codex, WorkBuddy or Doubao's desktop work assistant operate your real iPhone over USB, with a live view of the phone's screen in the assistant's sidebar. [README](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/README.md#L7-L7).

It moves fast. The [changelog](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/CHANGELOG.md#L3-L42) runs from 0.2.x on 7 October to 0.3.12 on 13 October, the version we read. Anonymous analytics arrived in 0.3.7 on 9 October, and the WorkBuddy and Doubao adapters were merged on 13 October. A page written about it is a snapshot; the commit we read is `5cc2fa8`.

One small contradiction is worth knowing before you go looking for it. The README still says the repository is private and needs GitHub access. [README line 50](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/README.md#L50-L50). It is public. Another project with almost the same name, [leeguooooo/iphone-use](https://github.com/leeguooooo/iphone-use), is a separate tool by a different author; this page is not about it.

## How iPhone Use connects Codex to a real iPhone

There are three moving parts, all on your Mac and your phone.

| Part | What it is | Where it runs |
| --- | --- | --- |
| MCP server | One Python file, standard library only, that the host assistant talks to over stdio | Mac |
| USB forwarder | A small Node script that listens on `127.0.0.1:18100` and forwards to port 8100 on the phone | Mac |
| WebDriverAgent | Appium's open-source UI automation service, pinned to 16.14.0 and built with your own Apple signing | iPhone |

Sources: [MCP server](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/iphone_use.py#L1-L2), [forwarder](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/tooling/forward.mjs#L1-L36), [WDA version and build](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_setup.py#L31-L33).

[WebDriverAgent](https://github.com/appium/WebDriverAgent) is the same test-automation service app developers use to drive their own apps in tests. iPhone Use repurposes it: instead of a test script, a language model decides what to tap. The client refuses to talk to any WebDriverAgent address that is not on the Mac itself, and we found no Wi-Fi path in the code, so the phone has to stay plugged in. [Loopback check](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_client.py#L29-L31).

The live screen view is a small web panel served by the same MCP server. Its content security policy allows no outside connections, so the preview itself does not phone home. [Widget resource](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/iphone_use.py#L30-L35).

## The iPhone Use tools: what the agent can read and what it can do

The README counts 17 tools for the model and two more that only the preview panel uses. [Tool list](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/README.md#L194-L204). The code marks each one as read-only or destructive, which is a useful way to read them. [Annotations](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/iphone_use.py#L176-L186).

| Reads the phone | Acts on the phone |
| --- | --- |
| `pua_observe`: element tree and/or screenshot | `pua_tap`: by element or by x/y coordinates |
| `pua_find`: look up elements | `pua_type_text`: type, optionally submit |
| `pua_wait`: wait for an element | `pua_swipe`, `pua_scroll_find` |
| `pua_apps`: find an app's bundle ID | `pua_launch_app`: open any installed app |
| `pua_doctor`, `pua_metrics`: health and timing | `pua_press_button`: home, volume |
| `pua_screen`: open or pause the preview | `pua_batch`: up to 20 steps in one call |
|   | `pua_collect_list`, `pua_setup`, `pua_ready` |

Two of these deserve a closer look. `pua_launch_app` checks only that the bundle ID is well formed before opening the app; there is no list of apps the agent may or may not open. [Launch](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_controller.py#L596-L603). And `pua_batch` lets the model chain taps, typing, launches and waits, up to 20 at a time, which is where speed comes from and also where a wrong assumption travels furthest. [Batch limit](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/iphone_use.py#L93-L94).

A file lock stops two operations running on the phone at once; a second caller gets `device_busy` and nothing happens. [Operation lock](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/iphone_use.py#L327-L332).

## What iPhone Use asks you to set up and trust

No jailbreak and no separate Appium server, but this is still a developer's setup. You need macOS, full Xcode, Python 3.9 or later and Node 20.19 or later. [Requirements](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/README.md#L107-L116). WebDriverAgent is signed with your own Apple account and development team. [Signing](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/README.md#L118-L128).

The setup skill lists the steps only you can do: sign in to Xcode, tap "Trust This Computer", turn on Developer Mode and restart, possibly enable UI Automation under Settings, trust the developer profile, and keep the phone unlocked. [Manual steps](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use-setup/SKILL.md#L36-L41). The model is told never to ask you for credentials and to wait for a real "done" answer rather than assume one. [Hand-off rule](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use-setup/SKILL.md#L43-L43).

Put plainly, Developer Mode plus a running WebDriverAgent means software on your Mac can drive your whole phone while it is unlocked and connected. That is the point of the tool. It is also the thing to understand before you plug in the phone that holds your banking and messaging apps.

## Where iPhone Use stops for you: passwords, sends and payments

This is the part that matters most for a [personal agent](https://personalagentbench.com/landscape/), and it splits into two kinds of protection.

**Enforced by code.** Typing into a secure text field, the kind iOS uses for passwords, is refused with an error that tells the model to ask you instead. [Secure field refusal](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_controller.py#L531-L531). Submitting after typing is off unless asked for, and a batch stops after any submit it could not verify. [Submit default and batch stop](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_controller.py#L736-L738). Long text typed in pieces is bound to the app and field it started in; if either changes, the rest is not typed. [Continuation guard](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_controller.py#L746-L769).

**Asked of the model.** Everything else is instruction text in the skill. Passwords, PINs, verification codes and Face ID are handed to you, with the preview paused. [Authentication hand-off](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use/SKILL.md#L26-L26). Messages are sent only when you authorised sending, after checking the recipient and the full draft. [Send rule](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use/SKILL.md#L86-L86). An input, send, payment or order whose result is uncertain must be checked, never replayed. [No replay](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use/SKILL.md#L104-L104).

What we did not find is a rule, in code or in the skills, that the agent must stop and confirm with you before paying. The skill guards against paying twice, not against paying once without asking. A password field that an app draws as an ordinary text field also falls outside the code check; only the skill text covers it. [Authentication reference](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use/references/authentication.md#L34-L34). Compare that with the products we took apart: [Pine](https://personalagentbench.com/agents/pine/) asks before every billing action, and [Muse](https://personalagentbench.com/agents/muse/) routes approvals through one gatekeeper.

## What leaves your Mac when you use iPhone Use

Three things go out.

1. **The screen, to the model.** Element trees and screenshots are returned to the host assistant, which sends them to whatever model it uses. Screenshots are shrunk to JPEG first; the original stays on disk. [Image handling](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_image.py#L1-L6). Whatever is on screen, a chat, a balance, a code, is in that picture.
2. **App lookups, to Apple.** Finding an app's bundle ID can query Apple's public search API. [App search](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_apps.py#L199-L201).
3. **Usage events, to PostHog.** The Codex plugin sends anonymous events by default; the WorkBuddy and Doubao installers turn this off unless you pass `--analytics`. [Default](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/ANALYTICS.md#L14-L14), [WorkBuddy installer](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/workbuddy/install.py#L77-L82).

We compared the analytics code against [ANALYTICS.md](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/ANALYTICS.md#L21-L24) and they match: five event types, a random install ID, tool names, outcomes, durations and error codes, and an allow-list that drops any field not named in advance. Screen text, screenshots, selectors, device IDs and signing teams are not sent. [Allow-list](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/analytics.py#L33-L53). Setting `IPHONE_USE_ANALYTICS=0` or `DO_NOT_TRACK=1` stops it, checked both before recording and before sending. [Opt-out](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/analytics.py#L56-L72).

Two details the document leaves out. The events disable PostHog's location lookup, but your IP address still reaches PostHog's servers in the request; whether it is kept, the code cannot tell us. And every event is labelled as coming from the Codex plugin, even from the other two hosts. [Source label](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/analytics.py#L140-L140).

## iPhone Use and account bans: what the repository does not say

Demos shared on X and Xiaohongshu include scrolling WeChat Moments and ordering food delivery, inside apps run by companies with their own anti-automation systems. The changelog mentions a WeChat optimisation; it is about reading long chat lists faster, not about avoiding detection. [WeChat notes](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/skills/iphone-use/references/wechat.md#L1-L15). We found no random delays or human-like jitter: typing runs at a fixed rate. [Typing constants](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/server/wda_controller.py#L27-L30). That is honest, and it also means nothing disguises the automation.

The repository says nothing about platform terms, risk controls or account bans. We do not know whether WeChat, Alipay or Meituan detect WebDriverAgent-driven input, and we have not tried. That gap is not unique to iPhone Use; the hosted Android service behind Droidrun goes the other way and advertises stealth typing, which our [phone use agent overview](https://personalagentbench.com/phone-use/) discusses. If you try iPhone Use, try it on a phone and accounts you could afford to lose.

## What we could not check about iPhone Use

- **Whether it works, and how often.** We did not run it. The project publishes no success rate, and nothing here is a measurement. It is not in our exam and has no score.
- **What the hosts keep.** Screenshots go to Codex, WorkBuddy or Doubao and their model providers. Their retention is outside this repository.
- **PostHog retention** of the IP address that arrives with each event.
- **Anything after 0.3.12.** At its current pace, details on this page may change within days. The pinned links show exactly what we read.

## FAQ

**Is iPhone Use safe to try?** It is open source and its analytics match its documentation, which is more than many tools offer. But the agent can open any app and tap anywhere on an unlocked phone, and the only code-level stops are password fields and unverified submits. Payment confirmation is left to the model. Use a spare phone and accounts you could afford to lose.

**Does iPhone Use need a jailbreak?** No. It uses Appium's WebDriverAgent, signed with your own Apple developer team, plus Developer Mode on the phone and full Xcode on a Mac.

**Can iPhone Use work over Wi-Fi?** Not in the version we read. The client only talks to WebDriverAgent through a forwarder on the Mac, and we found no Wi-Fi path.

**What does iPhone Use send to PostHog?** Five kinds of anonymous event: tool names, outcomes, durations, error codes and a random install ID. It does not send screen content, screenshots or device IDs. It is on by default in the Codex install and off in the WorkBuddy and Doubao installs; `IPHONE_USE_ANALYTICS=0` turns it off.

**Will WeChat or Alipay ban an account for this?** We do not know, and neither does the repository: it never mentions bans or platform terms. Nothing in the code disguises the automation.

**How do I install iPhone Use?** On a Mac with full Xcode, Python 3.9 or later and Node 20.19 or later, clone the repository and run `sh scripts/install.sh` for the Codex plugin; WorkBuddy and Doubao have their own installers. Then sign WebDriverAgent with your own Apple team and trust the Mac on the phone. [Install steps](https://github.com/zhongerxin/iPhone-use/blob/5cc2fa8808187797d73aea2167104f370dc29724/README.md#L105-L137). We read these steps; we did not run them. Other [phone use agent](https://personalagentbench.com/phone-use/) tools are compared on our overview page.

---

Published by Personal Agent Bench (https://personalagentbench.com), run by the Zentor team. Zentor builds agent software of its own, so its products are not on the scorecard and will not be added.