PocketCode

Coding agents, read-only files and approved project previews from your phone, end-to-end encrypted.

• Chat with Claude Code or Codex using restricted workspace tools.
• Browse and search files in a read-only explorer.
• Preview host-approved project servers, including hot reload.
• Remote terminals and direct file changes are disabled, including for older phone clients.

Getting started

1. Install the PocketCode app on your phone.
2. Run PocketCode: Connect Phone from the command palette and scan the QR code.
3. Approve the phone in VS Code.

A status bar item is shown whenever a phone is connected; click it to disconnect all phones. Manage or revoke paired phones with PocketCode: Manage Paired Devices.

When the phone's Browser tab asks for a project server, VS Code shows Allow Once (until the phone disconnects), Always Allow (saves the port for this phone) or Deny (not asked again for this phone and port until VS Code restarts). Dismissed prompts are not repeated for 2 minutes, a phone can trigger at most 5 prompts per 10 minutes, and answering after the phone disconnected grants nothing. The phone can only ask about verified project servers, and the prompt shows the process name and PID: allow only dev servers you trust, not debuggers or admin consoles. To manage saved ports in advance, open PocketCode: Browser Ports from the Command Palette, select your phone, enable browser previews, and enter the ports you need (for example 5173, 3000) or add detected project servers. Click Save changes to apply them. You can also open the panel from Manage Paired Devices → Allowed browser ports…. Detection and unsaved edits grant no access. Saving, including Always Allow, reconnects the phone and closes its existing previews. New and existing phones have no approved browser ports by default. The saved list applies across this computer's VS Code windows.

Each new connection also checks that the listening process's current working directory is inside a local workspace folder, or its subfolders, in the window serving the phone. Paths are resolved before checking. Servers outside those folders or with unknown working directories are blocked, as are windows without a local project folder. You can save a port before its server starts, but saved numbers never bypass the project check. Detection supports macOS, Linux and Windows. On Windows, servers whose working directory cannot be read (32-bit, elevated or other users' processes) are blocked. The panel shows an explanation when previews are unavailable.

Approve only trusted services. This directory check is not a sandbox: project servers can access other files and run commands, and an approved debugger or management API may allow commands to run. Existing TCP connections are not continuously rechecked when a process changes its working directory.

Security

Traffic between the phone and VS Code is end-to-end encrypted (Noise KK, XChaCha20-Poly1305). The relay server only forwards ciphertext. Only phones you approve can connect. Pair only trusted phones: they can read workspace files and prior agent transcripts, and ask agents to modify ordinary project files. Browser access also exposes the approved service.

Agents require Claude Code 2.1.280+ or Codex 0.153.2+, an open project folder, and existing default CLI sign-in. Code permits sandboxed workspace changes; Plan is read-only. Phone requests cannot grant extra permissions. Model tools cannot access the network; hooks, plugins and external MCP tools are disabled. Common credential paths are blocked from agent reads and agent/editor configuration and .git are protected against writes at any folder depth. These restrictions are checked by the providers' runtimes, with no unsandboxed fallback. Custom runtimes may need setup on the computer, and Claude requires a supported OS sandbox.

Host security instructions accompany every model request as an additional layer. They are not a security boundary. The trusted CLI process still uses its credentials to contact the provider. The file explorer can read ignored workspace files, and historical chat output may contain secrets. Agent edits can change scripts you later run on the computer. Reload VS Code after updating to stop any terminals from the previous extension version.