Oleksandr Kuzmenko, EditorPublished 9 min readAI-assisted · editor-reviewed
TL;DR
- Pinky provides a lightweight native desktop bridge enabling MCP agents to drive Android and iOS devices.
- Security boundaries run inside the local gateway to block agent access to sensitive apps and require manual clicks for financial operations.
- Device PINs are stored securely on the host and confirmed via Touch ID or Windows Hello, keeping credentials hidden from LLMs.
Key facts
- Memory Footprint
- ~70 MB RAM idle
- Binary Download Size
- 16–22 MB
- Supported Android Versions
- Android 10 to 17
- Supported iOS Versions
- iOS 17.4 and later
- Open Source License
- Apache-2.0
Source: Key facts — Binary Download Size
Source: Key facts. Binary Download Size: 16–22 MB. Each figure is copied from the story.
- Binary Download Size16–22 MB
Native MCP Bridge for Mobile Automation
Pinky connects mobile devices to agentic coding environments like Claude Code, Cursor, and Codex through the standard Model Context Protocol (MCP). Built natively with MyGo rendering directly on the GPU, the desktop client avoids Electron overhead, resulting in a 16–22 MB binary footprint that idles at 0% CPU and approximately 70 MB of RAM on macOS, Linux, and Windows.
Mobile devices connect via USB or paired Wi-Fi. Pinky bundles its own adb implementation compiled from Android sources, eliminating external Android Studio platform tool dependencies while supporting Android versions 10 through 17. On iOS, it supports iOS 17.4+ setups using developer disk images.
Gateway-Enforced Safety and Secure Unlocking
Rather than relying on model prompts to maintain guardrails, Pinky enforces security boundaries in its local binary gateway:
- Off-Limits Targets: Banking apps, crypto wallets, and password managers remain invisible to the agent by default, and text injection into OTP or password inputs is strictly blocked.
- Intervention Triggers: Payments, trades, and transfers pause execution until confirmed by user click. Users can configure settings to require approval for deletions, messages, phone calls, orders, or app installations across 10 supported UI languages.
- Protected Unlocking: Stored device PINs are never revealed to agents; unlocking from the computer requires confirmation via Touch ID, Windows Hello, or keyring passwords.
- Android Secondary Display: On Android 13 and newer, Pinky spawns a hidden secondary virtual display, allowing autonomous tasks to execute without locking the phone's physical screen or disrupting user interaction.
Interruption and Audit Logging
Engineers retain full execution control. Tapping the physical Android phone screen, clicking the mirror view, or pressing ⌥⌘. (Ctrl+Alt+. on Windows/Linux) immediately pauses the running agent. Every action sequence generates an inspectable log complete with plain-text execution steps, screenshots, and exportable HTML session recordings.