Cloak — a private remote for your coding agent

Drive Claude Code from your phone. Nothing leaves your machines.

Cloak is a private, self-hosted remote for your coding agent — full terminal and chat, every edit gated with a diff, over a direct end-to-end-encrypted tunnel between your computer and your phone. No account. No cloud. Nothing leaves your two devices.

Works with Claude Code today; OpenAI / Gemini CLI next.

📱 The Cloak mobile app isn't live yet — it's coming soon. The host below (npx cloak-remote) is published and works today, but the iOS / Android app that scans the QR and pairs with it hasn't been released yet. Want early access? Get in touch → — tell us how you'd use Cloak and we'll reach out. We read every message and reply personally.

Quick start

On the computer where you run Claude Code:

npx cloak-remote

That's it — no install, no signup. On first run it:

1. Asks you to set a PIN (4+ digits).
2. Prints a QR code in your terminal.
3. Scan it with the Cloak mobile app (early access — see above) and enter the PIN — the two devices pair directly over end-to-end encryption.

Then drive your agent from anywhere: approve edits with inline diffs, run commands, and watch responses stream.

The command installed by this package is cloak. You can also run it directly with npx cloak-remote.

How it works

The phone is a thin remote. Your message is encrypted on-device, sent to the host, which runs the Claude Agent SDK locally on your existing Claude Code login. Claude decides and acts on your machine; the host streams tokens and tool requests back; the phone renders them and gates every action. The Cloudflare tunnel binary is downloaded automatically on first run — no install, no account.

Options

cloak [start] [options]

| Option | Description | | --- | --- | | --pin <digits> | Set/override the PIN (4+ digits). Persisted for next time. | | --port <n> | Local port to listen on (default 6767). | | --cwd <dir> | Working directory for the shell (default: current directory). | | --lan | Skip the Cloudflare tunnel; advertise the LAN address (same Wi-Fi only). | | --keep-awake | Keep this computer awake while serving so the connection isn't dropped (macOS). | | --fingerprint | Print this computer's pairing-key fingerprint (compare it in the app) and exit. | | -h, --help | Show help. |

Environment equivalents: POCKET_CLAUDE_PIN, POCKET_CLAUDE_LAN=1, POCKET_CLAUDE_KEEP_AWAKE=1.

Security

ECDH P-256 pairing by QR (no key is ever transmitted) → per-message AES-256-GCM → PIN → per-session forward secrecy. The tunnel is outbound-only — no inbound ports are opened. Verify the fingerprint yourself with npx cloak-remote --fingerprint and compare it to the value shown under "Verify encryption" in the app.

Requirements

• Node.js 18+
• macOS, Linux, or Windows
• An existing Claude Code login on the host machine

License

MIT