New Mobilerun VA is now in beta — a hosted 24/7 agent for mobile automation
Industry · IT & Security

Pentest apps on cloud phones.

Cloud phones with full root, system-wide Frida and custom CA install on a dedicated, isolated node. The agent walks every screen of your own app while your proxy logs the traffic.

Used by teams at a16z and Y Combinator companies Backed by Merantix · SIXTY · DEGREE · TKM · May Ventures
01 · The problem

Why mobile pentests stall.

01

Root detection blocks the rig

Banking and fintech apps refuse a rooted emulator.

02

Coverage is manual

Someone taps every screen while the proxy records.

03

OTP walls stop the scan

Auth needs a real code, or half the surface stays dark.

02 · The fix

Cloud phones, built for AppSec.

Cloud phones with genuine device identity, so your target app launches and behaves the way it does on a user's phone, with the root, instrumentation and isolation AppSec work needs. You drive the reversing yourself.

  • Full root and ADB. System-wide Frida, preinstalled.
  • Install custom CAs for MITM. Bring Burp or mitmproxy.
  • Cloud phones on genuine Android, not an emulator, so apps that refuse emulators still run. Your dedicated, isolated node stays yours.
03 · Key workflows

What security teams run.

Enumerate the surface
The agent walks the app, your proxy captures every request.
Talk to us →
Instrument with Frida
System-wide Frida and full root, ready for your scripts.
Talk to us →
Capture traffic
Install a custom CA, route through Burp or mitmproxy.
Talk to us →
Reverse on your own
Full root and ADB. Drive the reversing yourself.
Talk to us →
Try these

Real tasks, ready to run.

  • install our staging APK, walk every screen, and log all GET and POST endpoints
  • open our app, capture every network request, and flag any plaintext HTTP traffic
  • walk our signup and checkout flows, log each endpoint and response code as JSON
  • install the debug build, tap through every screen, and list all third-party domains contacted
Infrastructure

Mobile execution, as infrastructure.

What a headless browser is to web agents, mobilerun is to mobile agents. You build the product. We run the phones behind it.

The device layer

Real phones, network and identity behind one REST API.

Your product on top

Ship lead-gen tools, assistants, RPA. Own the UX and the customer.

Rent, do not build

No hardware to buy. 1 to 10,000 devices, billed by usage.

04 · Get started

Two ways in. Live in minutes.

For developers

API, SDK or MCP.

  1. Get a key. Sign in, provision a device, copy your dr_sk_ key.
  2. Install. npm install @mobilerun/sdk, set MOBILERUN_API_KEY.
  3. Run. tasks.run({ task: "Install the APK and explore every flow" }), or add the MCP server for Claude.
Read the quickstart
No code · Mobile VA

The Chat UI.

  1. Open the Assistant. At cloud.mobilerun.ai/assistant.
  2. Add a phone. Rent a phone, or connect your own.
  3. Type the job. “Install the APK and explore every flow” The VA runs it. Save, schedule, get webhooks.
Open the Assistant
05 · Pricing

Pick your phone.

Usage-based

Pay as you go

$0.03 /min

Cloud Android by the minute. Spin up and down, no commitment. Proxy sold separately, persistent state coming soon.

Start now
Custom · SLA

Enterprise

Custom

Private fleets, custom networking, eSIM provisioning, SLA.

Talk to us

Rooted, isolated work ships as a dedicated node (around 8 phones) on Enterprise terms. Trial on an Android Phone first. See full pricing →

Give your agents a phone.

Full control of a rooted cloud phone. Reverse your own app, your way.