AURA
01 For developers
Your phone is an MCP server.
Install the app, pair once with a six-digit PIN, and your MCP client drives a real handset — taps, screenshots, browser pages, deep links, the lot. No root and no ADB required for the core phone connection; no cloud service sits in the data path.
02 Setup
Pair once, then forget about it
Reconnects are silent after the first approval. The phone remembers the client's token; you can see and revoke every paired client in the app.
The bridge pulls native WebRTC dependencies on first run, which can take a minute. Do it before adding AURA to your MCP client — otherwise the client's startup timeout fires during the download and the first session looks like a failure when it's just a slow install.
npx aura-mcp-connect@latest --version
Open AURA → MCP → Start WebRTC. The app shows a six-digit PIN and tap-to-copy commands.
Run this on your computer, then tap Approve on the phone when the dialog names your machine. That's the last time you'll do this — the token is remembered.
npx aura-mcp-connect pair <PIN>
The bridge runs one shared local daemon per computer. It owns the single WebRTC link to the phone and serves MCP over HTTP on localhost — so Claude Code, Claude Desktop, Cursor and VS Code can all drive the same phone at once instead of kicking each other off.
# Claude Code
claude mcp add --transport http aura http://127.0.0.1:4816/mcp
Or by command, in any mcp.json — this auto-starts the shared
daemon. On Windows, wrap it with cmd /c.
{
"mcpServers": {
"aura": { "command": "aura-mcp", "args": [] }
}
}
03 The surface
56 tools, and instructions for using them
The server doesn't just expose tools — it ships a behavioural contract at
initialize, so a client that has
never seen a phone before still knows to re-check the screen after acting.
Sent at handshake
Perceive-act-verify discipline, deep-link-first, never estimate coordinates, explicit stop conditions, and the hard-blocked categories — so the agent doesn't burn turns discovering what it isn't allowed to do.
Read on demand
The policy boundaries, the long-form tool-selection guide, and a live device snapshot — fetched when needed rather than padding every prompt.
Workflow templates
Reusable starting points that walk a model through the policy-aware loop for a goal, instead of leaving it to improvise one.
Web, links, and device state
Browser tools can open, read, find, extract, upload, and act on pages. Deep-link, notification, media, file, contact, and system tools take deterministic routes when a gesture loop would be slower or less reliable.
browser_openbrowser_extractbrowser_tabsopen_deeplinkread_notificationsmedia_controlfind_files
launch_applookup_apptype_textbrowser_findbrowser_waitbrowser_screenshotbrowser_handoffbrowser_tabsbrowser_extractbrowser_uploadbrowser_openbrowser_readbrowser_actbrowser_closeresolve_contactlist_app_deeplinksresolve_deeplinkopen_deeplinktappress_homepress_backvolume_upvolume_downmuteget_device_statusechoend_sessionfind_filesopen_fileswipescroll_todouble_taplong_pressscroll_upscroll_downscroll_leftscroll_rightget_usage_guideopen_recent_appspress_enterget_media_sessionsmedia_controlread_notificationsnotification_actiondismiss_notificationperceive_screenget_screenshotrequest_screen_capture_permissionwatch_device_eventsvalidate_actionconnect_deviceread_screensystem_intentverify_actionwait_forweb_search04 Developer bridge
ADB over AURA MCP.
When the accessibility path cannot see a Flutter, React Native, WebView, or stuck screen, your MCP client can switch to the same phone's local ADB channel for evidence and developer workflows.
One extra tool: aura-adb
The daemon runs adb <command> on the computer hosting your MCP connection and targets the phone already paired to that machine over USB or Android Wireless Debugging. It is separate from AURA's WebRTC pairing and never runs a host shell.
aura-mcp daemon --enable-adb aura-adb(command: "logcat -d -t 200") aura-adb(command: "shell dumpsys window | grep mCurrentFocus")
ADB is a second channel, not a safety bypass. If AURA refuses a banking, payment, authenticator, credential, or other sensitive action, ADB must stay refused too. Ask before destructive commands such as pm clear, uninstall, or device-side deletes.
05 Security
Five gates, all fail-closed
A tool server that can tap anything on a personal phone is a serious thing to expose. Each layer below denies by default, and an unclassified tool is treated as a write.
The data channel is DTLS-encrypted by WebRTC itself. There is no plaintext path and no certificate for you to manage.
A short-lived PIN authorises the one-time handshake. No long-lived URL or bearer token sitting in a config file waiting to leak.
The handset shows who is connecting — client name, host, platform — and waits for a human tap. Approved clients reconnect silently, and every one is listed and revocable in the app.
Every tool is classified read or write. A write call from a read-only principal is rejected, and anything unclassified defaults to write rather than to open.
A static engine runs before any handler. Banking, payment and authenticator packages are refused; card numbers, CVVs, national IDs and password phrases are refused as text. It lives inside the single chokepoint every tool passes through, so nothing routes around it — including the on-device agent.
Firebase carries the WebRTC handshake and nothing else. Once the data channel is up, every tool call travels directly phone-to-computer — the signalling server never sees your screen or your taps. Session logs keep raw screenshots, never the annotated overlays, and audit entries key on a token prefix rather than the secret.
Install it, pair it, drive it.
The server is the app. There's nothing else to deploy.