Skip to main content

​
What’s on the iPhone

TapKit installs nothing on the iPhone and doesn’t need a jailbreak or developer mode. The Mac app can only reach a phone that is plugged into the Mac, trusts it, and is paired with it over Bluetooth. TapKit can’t get past the passcode, Face ID, or anything else that would stop a person holding the phone. To cut off TapKit, unplug the phone, quit the Mac app, or forget the Mac in Settings > Bluetooth.

​
Mac permissions

​
Where screenshots and actions go

Built-in agent. The Mac app captures screenshots and sends them through TapKit’s servers to a hosted language model, which picks the next action. The Mac app sends actions straight to the phone. MCP and REST API. Your agent’s commands go through TapKit’s servers to your Mac. Screenshots come back the same way, and TapKit stores them. Your agent’s provider, such as Anthropic or OpenAI, receives every screenshot your agent requests. Live streaming. When you watch a phone in the web app, Agora streams its screen to your browser. The Mac app shows each phone’s screen on the Mac. It only sends the screen elsewhere when an agent takes a screenshot or someone opens a live stream.

​
Access control

The Mac app signs in through tapkit.ai and keeps its session in the macOS Keychain. MCP clients sign in with OAuth, and you approve each one on a consent screen. Access tokens expire after an hour, and clients refresh them automatically. The REST API uses API keys from the web app. TapKit stores only a hash of each key, and a revoked key stops working immediately. Everyone in your organization can use its phones.

​
Agent safety

TapKit’s skills tell agents to check typed text and stop before submitting it unless you’ve asked them to. They also tell agents not to type passwords you haven’t given them. These rules reduce risk but don’t remove it, because an agent with your phone can do anything you can. Use a phone and accounts you’re comfortable handing to an agent. Read the Privacy Policy, Terms of Service, and list of subprocessors. Report security issues to security@tapkit.ai.