● Industry · IT & Security

Pentest apps on real phones.

Real phones with full root, system-wide Frida and custom CA install on a dedicated, isolated node. The agent walks every screen of your own app while your proxy logs the traffic.

Book a call Start free

Android app security workflow · demo

All demos on YouTube ↗

Used by teams backed by a16z and Y Combinator

01 · The problem

Why mobile pentests stall.

Root detection blocks the rig

Banking and fintech apps refuse a rooted emulator.

Coverage is manual

Someone taps every screen while the proxy records.

OTP walls stop the scan

Auth needs a real code, or half the surface stays dark.

02 · The fix

Real phones, built for AppSec.

Real phones with genuine device identity, so your target app launches and behaves the way it does on a user's phone, with the root, instrumentation and isolation AppSec work needs. You drive the reversing yourself.

Full root and ADB. System-wide Frida, preinstalled.
Install custom CAs for MITM. Bring Burp or mitmproxy.
Real phones on genuine Android, not an emulator, so apps that refuse emulators still run. Your dedicated, isolated node stays yours.

03 · What you can run

What security teams run.

Enumerate the surface

The agent walks the app, your proxy captures every request.

Instrument with Frida

System-wide Frida and full root, ready for your scripts.

Capture traffic

Install a custom CA, route through Burp or mitmproxy.

Reverse on your own

Full root and ADB. Drive the reversing yourself.

04 · Try these

Real tasks, ready to run.

install our staging APK, walk every screen, and log all GET and POST endpoints
open our app, capture every network request, and flag any plaintext HTTP traffic
walk our signup and checkout flows, log each endpoint and response code as JSON
install the debug build, tap through every screen, and list all third-party domains contacted

05 · Infrastructure

Mobile execution, as infrastructure.

What a headless browser is to web agents, mobilerun is to mobile agents. You build the product. We run the phones behind it.

The device layer

Real phones, network and identity behind one REST API.

Your product on top

Ship lead-gen tools, assistants, RPA. Own the UX and the customer.

Rent, do not build

No hardware to buy. Start free, run up to 100 phones at once self-serve, and as many as you need on Enterprise.

06 · Get started

Scope it with us, then build.

For developers

API, SDK or MCP.

Get a key. Sign in, provision a device, copy your dr_sk_ key.
Install. npm install @mobilerun/sdk, set MOBILERUN_CLOUD_API_KEY.
Run. tasks.run({ deviceId, task: "Install the APK and explore every flow" }), or add the MCP server for Claude.

Read the quickstart

No code · Mobile VA

The Chat UI.

Open the Assistant. At cloud.mobilerun.ai/assistant.
Add a phone. Use a phone from your plan or connect your own.
Type the job. “Install the APK and explore every flow” The VA runs it. Save, schedule, get webhooks.

Open the Assistant

07 · Pricing

Built on Enterprise terms.

Root, Frida and custom CAs run on an isolated Enterprise node. Try the agent on Developer first.

Enterprise

Need a custom solution? Unlimited concurrent phones, outbound SMS, a custom SLA and individually agreed prices.

Book a call

Plan

Developer

Build and test your automations.

$20 / month

Billed monthly

5 concurrent phones Spin up to 5 phones at the same time. Dedicated phones from add-ons are separate.
600 device minutes Powered-on time across all your phones, pooled per month. 600 minutes are 10 hours. Extra minutes cost $0.03 each.
1,500 credits ($15) Pay for agent usage like the Assistant and Task Runner. 1 credit = $0.01. Extra credits cost $0.01 each.
5 GB residential traffic Data routed through residential IPs, pooled across your phones per month. Extra traffic costs $10 per GB.

Choose Developer

Compare all plans →

Give your agents a phone.

Book a call