An Android MCP server for AI agents on real phones

In short: An Android MCP server lets AI agents such as Claude Code or Codex use a real Android phone through the Model Context Protocol. BenchFleet's, on the Pro and Team plans, gives each AI client only the phones and access you choose, holds sensitive steps for a person's approval and records every call in an audit log.

AI agents such as Claude Code and Codex can do much more when they can use a real phone. BenchFleet is an app that runs on your own computer and controls your Android phones: it runs a Model Context Protocol (MCP) server there that gives agents the phones you choose. They read the screen and its interface, tap, type, open apps and run your workflows, under the same permissions, approvals and audit log as the people who use the phones.

Free for up to 3 phones, with no account. Pro adds workflows, schedules and AI for up to 25 phones from £12 a month + VAT.

Download free See pricing

What an agent can do on a phone Pro

BenchFleet gives AI clients 25 tools in four groups. A client is shown only the tools its access level allows, so a Look only client never sees the tools that act.

Group	Tools	Access level
See	`list_devices`, `get_device`, `get_screen` (a small picture of the screen, optionally with its text), `get_ui_tree` (the interface as a compact tree), `find_element`, `read_text`, `wait_for`, `take_screenshot`	Look only
See more	`get_device_logs` (the newest logcat lines)	Look and operate
Act	`tap_element`, `long_press_element`, `type_text`, `swipe`, `scroll_to`, `press_key` (Back, Home, Recents, Enter, Delete, wake), `launch_app`, `stop_app`, and `type_secret` (a saved password typed by the Hub; the AI names it but never sees it)	Look and operate
Hand over work	`list_workflows`, `run_workflow` (one phone, waiting for its outputs), `queue_task` (one phone, several, a group or every phone), `get_task_status`	Look and operate
Ask a person	`request_manual_control` (a request in the attention queue, with the screen)	Look only
	`pause_device`, `resume_device`	Look and operate

With Choose capabilities you tick exactly the capabilities a client gets instead. Some things are never offered to an AI client: shell commands, file transfer, installing or uninstalling apps, the clipboard and rebooting. Administration rights, such as deciding approvals or managing people, cannot be given to a client at all.

Agents work by finding elements by their text, ID or description rather than by screen coordinates, so the same instructions keep working on phones with different screen sizes. To do the same job on many phones, an agent can work through each phone in its scope or hand a published workflow to a group with queue_task, which asks it to confirm how many phones that reaches.

Connect Claude Code or Codex

In BenchFleet, open Settings, then AI clients, and choose Connect an AI client.
Pick the phones it may use (every phone, a group or one phone) and its access level: Look only, Look and operate, or Choose capabilities.
Copy the line BenchFleet prints for Claude Code and run it in a terminal, or add the block it prints for Codex to ~/.codex/config.toml.
Start your AI client and ask it to list the phones; it sees only the phones and tools you allowed.

BenchFleet prints the setup with your computer's paths filled in. It has this shape, where <command> is BenchFleet's own program and <token file> the file that holds the client's token, so the token never sits in the client's settings:

Claude Code (run once in a terminal; it adds the server for all your projects):

bash

claude mcp add --scope user controlhub -- "<command>" mcp --token-file "<token file>"

Codex (add to ~/.codex/config.toml):

toml

[mcp_servers.controlhub]
command = '<command>'
args = ['mcp', '--token-file', '<token file>']

Other MCP clients (an mcpServers entry for Claude Desktop, .mcp.json and others):

json

{"mcpServers": {"controlhub": {"command": "<command>", "args": ["mcp", "--token-file", "<token file>"]}}}

Claude Code and Codex start a small bridge that talks to BenchFleet on your computer and can reach nothing else. Clients that connect by URL get an address on your computer, http://127.0.0.1:<port>/mcp, and a token to send as Authorization: Bearer <token>; BenchFleet shows the token once, when you create the client. A new client starts as Look only on every phone, with a limit of 120 calls a minute and an expiry after 90 days, and you can change all three.

The safety layer

AI clients go through the same door to the phones as people and workflows in BenchFleet:

Scope and access. A client works only on the phones you gave it, with the tools its access level allows. A phone with automation switched off is not even listed.
Manual and paused phones. On a phone in Manual mode only the person holding it may act; on a paused phone nobody may. A client can still look at both, and its actions are refused. It also cannot act on a phone that a running workflow holds.
Approvals. By default, typing a saved password and any request that reaches more than ten phones wait until a person approves them; you can add rules on the Approvals page. Payments and account-security changes always need a person when an AI reaches them, once each time. Only people with the right to decide approvals can approve, never an AI client, and an unanswered request expires after an hour.
Human-only steps. BenchFleet checks the screen before every tap or keystroke and after the agent reads it. At a CAPTCHA, a sign-in check, an identity or biometric prompt or another anti-automation control, the Hub blocks the action and holds that app on that phone until a person has dealt with it, and tells the agent to stop and ask for a person.
Limits. Each client has its own limit on calls per minute and an optional expiry date. Disconnecting a client revokes it at once. Spending budgets per model, agent or phone apply to BenchFleet's own AI (below); Claude Code and Codex bring their own models, which you pay their provider for.
A record of everything. Every call goes into the audit log under the client's name, with the phone, the tool, the result and any approval. Typed text is kept only as its length and a saved password only by its name. The log is hash-chained, so a change to it can be detected.
Local by default. The server answers on your computer only, unless you turn on remote access to use the app from another device. BenchFleet starts in Local mode, where nothing leaves your computer and your network, and it sends no telemetry.

For app teams and developers. Not for fake accounts or engagement farming: BenchFleet has no features for getting around apps' anti-automation controls, and the terms forbid using it for that.

Compared with DIY MCP servers and cloud agent platforms

Open-source MCP servers on GitHub are a good fit for one development phone or an emulator, and free. Many of them drive whatever phone ADB sees, often with shell commands included, and leave out what a shared fleet needs: choosing which phones an agent may use and what it may do there, approvals, a record of every call, and a person taking over when the agent gets stuck.

Cloud agent platforms run agents on phones, real or virtual, in the provider's data centre. They suit you if you have no phones of your own or need many devices on demand. The phones are theirs, though, so the apps, accounts and data the agent uses sit on someone else's devices.

BenchFleet is for phones you own or look after, on your desk or in your lab. It adds the rest of the work too: a live view of every phone, taking over by hand in one click, and workflows for the routine parts. See controlling many Android phones from one PC.

AI inside BenchFleet too

You do not need an outside AI client to automate with AI. On Pro and Team, BenchFleet's own AI tasks take a goal for one phone, a group or every phone, and per-phone agents work with their own instructions, allowed apps, working hours and spending limit. Both use your own model: any AI service with an API and your key, or a model on your computer. See AI with your own model.

What it costs

AI clients are part of Pro, at £12 a month + VAT for up to 25 phones, and Team, at £20 per seat a month + VAT. AI usage is never included: Claude Code, Codex or your model is paid to its own provider. Watching and controlling phones by hand is free for 3 phones.

Testing an app? An agent can explore it on your phones while workflows repeat the fixed checks: see Android app testing on real phones, or the BrowserStack alternative if you are moving off a cloud device farm.

Questions

What is an Android MCP server?

An MCP (Model Context Protocol) server gives AI tools such as Claude Code or Codex a set of tools they can call. BenchFleet's MCP server turns the Android phones connected to your computer into such tools, so an AI can list the phones, read a screen and its interface, tap, type, open apps and run your workflows.

Does it work with Claude Code and Codex?

Yes. The AI clients page in BenchFleet prints a one-line command for Claude Code, a block for Codex's config.toml, a JSON entry for other MCP clients, and an address with a token for clients that connect over HTTP.

Can an AI client use every phone?

Only the phones you choose. Each client gets one scope, which is every phone, a group or a single phone, and an access level. It can look at a phone in Manual mode or a paused phone but cannot operate it, and it does not see a phone you have not allowed for automation.

Can the AI run shell commands or install apps?

No. BenchFleet offers AI clients no shell, no file transfer, no installing or uninstalling apps, no clipboard and no reboot. Its tools read the screen, tap, type, open and stop apps, read logs and run the workflows you published.

What stops an AI from doing something risky?

The same rules as for people and workflows. Typing a saved password, payments, account-security changes and work on more than ten phones at once wait for a person's approval, and the AI never sees the password itself. At a CAPTCHA, sign-in check or other human-only step the Hub blocks the action and holds that app until a person deals with it.

Can one agent work on many phones?

Yes. An agent can work on each phone in its scope, or hand a published workflow to a group or to every phone at once. It has to confirm how many phones that reaches, and above ten phones a person approves first.

Is every call recorded?

Yes. Every tool call goes into BenchFleet's hash-chained audit log under the client's name, with the phone and the result. Typed text is recorded only as its length and a saved password only by its name. Disconnecting a client revokes its access at once.

Which plan do I need?

AI clients are part of the Pro and Team plans. AI usage is not included, so Claude Code, Codex or the model you use is paid to its own provider.

Start with the Free plan