Agent chat / Phone

Mobile Remote

Away from the computer, keep using the agent chat from your phone: start a turn, watch it run, answer the agent's approval prompts, take a screenshot of its page and get notified when it finishes. The agent and your logged-in Chrome stay on the computer; the phone is a remote.

Start the gateway

chrome-use mobile serve is the only process a phone connects to. By default it listens on 127.0.0.1:17345, for a Cloudflare tunnel running on the same computer.

bash

chrome-use mobile serve                        # 127.0.0.1:17345
chrome-use mobile serve --bind 100.101.102.103 # the Tailscale address only
chrome-use mobile serve --bind 0.0.0.0 --allow-all-interfaces
chrome-use mobile serve --name "Studio Mac"       # name the phone shows; defaults to the system computer name

When the selected IP is unavailable, the gateway waits in-process with exponential backoff from 1 to 60 seconds. It reports readiness only after binding succeeds and never changes or broadens the address. After switching networks, update --bind and the phone endpoint. Other errors, including an occupied port, fail immediately.

Listening on a non-loopback address prints a warning; every interface needs --allow-all-interfaces. The gateway never forwards /api/v1/* or the stream WebSocket, and never exposes the panel service's port or capability.

Pick a way in

The phone needs an address that reaches the gateway. We run no relay; you bring the route.

Tailscale

Simplest when the computer and the phone share a tailnet:

bash

IP=$(tailscale ip -4)
chrome-use mobile serve --bind "$IP"
chrome-use mobile pair --url "ws://$IP:17345" --name "My iPhone"

Cloudflare named tunnel

Without Tailscale on the phone, a named tunnel gives the gateway a stable wss:// hostname:

bash

cloudflared tunnel login
cloudflared tunnel create chrome-use-mobile
cloudflared tunnel route dns chrome-use-mobile mobile.example.com

~/.cloudflared/config.yml

tunnel: chrome-use-mobile
credentials-file: /Users/you/.cloudflared/<tunnel-id>.json
ingress:
  - hostname: mobile.example.com
    service: http://127.0.0.1:17345
  - service: http_status:404

bash

chrome-use mobile serve --trust-cf-header
cloudflared tunnel run chrome-use-mobile
chrome-use mobile pair --url wss://mobile.example.com --name "My Pixel"

Through a tunnel every connection reaches the computer from 127.0.0.1. --trust-cf-header makes the gateway rate-limit by the CF-Connecting-IP that cloudflared sets; turn it on only when cloudflared runs on this computer.

Cloudflare terminates TLS at its edge, so every frame between the phone and the gateway is also encrypted end to end: the tunnel cannot read instructions, page text or screenshots. trycloudflare.com quick tunnels get a new address on every start, which means pairing again; use them only to try things out.

Same LAN

bash

chrome-use mobile serve --bind 192.168.1.20
chrome-use mobile pair --url ws://192.168.1.20:17345

Running pair without --url lists the Tailscale and LAN addresses it finds.

LAN addresses can change with the network or DHCP lease. For persistent access across networks, prefer a stable Tailscale address or a loopback gateway behind a named tunnel. For a launchd service, use KeepAlive = { SuccessfulExit = false } and ThrottleInterval = 60 to limit restarts after other startup errors.

Pair

pair prints a QR code for the chrome-use app. It is valid for 10 minutes and works once; scanning it again fails. When several Chrome profiles use the agent chat, choose the one this phone may drive with --profile; every request from the phone is bound to it.

bash

chrome-use mobile pair --url wss://mobile.example.com --name "My iPhone"
chrome-use mobile pair --url wss://mobile.example.com --json   # just the chromeuse://pair link

Until pairing completes, the link in the QR code is the phone's key: do not screenshot or paste it anywhere. Pairing adds a secret the phone generates itself, so afterwards the link left in your terminal's scrollback no longer works.

Manage devices

Command	What it does
`chrome-use mobile devices [--json]`	Lists devices: name, state, when paired, last connection time and IP, whether push is on.
`chrome-use mobile revoke <id>`	Deletes the device's key and push token. A running gateway drops its connection within a second.
`chrome-use mobile access <id> full\|limited`	Whether this phone may drive high-access conversations (below). `pair --allow-full-access` sets it when pairing.
`chrome-use mobile push-test <id>`	Sends a test notification to that device.

A source address with repeated failed handshakes waits longer before each new attempt (up to 5 minutes); a device itself is never disabled by failures. Connections from browsers (any Origin header) are refused.

What the phone can do

See conversations, start one, send text and up to 5 images (512 KiB each), stop the current turn.
Follow progress live. After a dropped connection it resumes where it left off, with no missing or repeated events.
Answer approval requests from Claude Code, Codex and the other agents.
Screenshot the conversation's own browser session (at most one every 2 seconds per conversation). If that session is not running it reports so; it never opens a browser.
See scheduled tasks, run one now, turn one on or off.

The phone gets less than the desktop:

No full access. Conversations created from the phone go up to writeFiles, Pi gets browser tools only, and the phone cannot raise an existing conversation's tool access.
High-access conversations (full access, command execution, or Pi with more than browser tools) can only be read, stopped and declined by default. To send to them, approve, or run such a schedule from the phone, run chrome-use mobile access <id> full on the computer; the app then asks for its lock.
No project folder choice, agent executable, configuration, skill edits, new or edited schedules, or stopping the service.
Deleting a conversation needs an explicit confirmation in the request.

Push notifications

Once the app turns on notifications, the gateway notifies the phone when an agent waits for your approval, a turn ends, or a scheduled run finishes or fails, at most once per conversation every 10 seconds. Notifications are encrypted on the computer; the push service only forwards ciphertext, and they never contain page content or tool output. The default push service is https://chrome-use-push.leeguoo.com; point --push-url or CHROME_USE_PUSH_URL at your own deployment instead.

Where data lives

The device list and keys live in ~/.chrome-use/mobile/ (directory 0700, files 0600; current user only on Windows), or in mobile/ under CHROME_USE_RELAY_DIR when that is set.