Platform

The virtualization platform
for mobile.

Real iOS and Android guests, masked AOSP that passes for hardware, and cloud sandboxes, all behind one normalized API with kernel-deep instrumentation.

Launch console Read the docs

Devices & providers

Pick a backend, get a device.

Every provider normalizes to one sandbox shape, so the console, SDK, CLI, and MCP never branch on what is underneath.

Kind	Platform	Transport	Notes
vphone	iOS	SSH / vphone-cli	Real iOS guests on Apple silicon
baguette	iOS	simctl	iOS Simulator runtimes, no VM
android	Android	adb	Android SDK emulator (AVD)
cuttlefish	Android	cvd / adb	Masked AOSP, presents as real hardware
qemu	Linux / Android	qemu	Generic guest transport
e2b	Cloud	E2B SDK	Cloud Linux sandbox, pause/resume
daytona	Cloud	REST + PTY	Self-hostable cloud dev sandbox
modal	Cloud	Modal SDK	gVisor sandbox, accurate /proc metrics

Capabilities

Every device advertises what it can do.

A capability map travels with each instance, so the UI and SDK light up exactly the features a device supports, with an honest reason when one is unavailable.

Screen

SCREEN

VNC, scrcpy H.264, or WebRTC, plus one-shot screenshots.

Input

INPUT

tap, swipe, key, text, tap-text, launch, launch-intent.

Frida

FRIDA

Install, inject, and stream scripts; hook Java/ART and native.

Traffic

PROXY

Hosted mitmproxy flows plus a reverse tunnel to your Burp.

Shell

SHELL

Interactive shell and file browser on node and cloud devices.

Snapshots

SNAPSHOT

Point-in-time snapshot and restore; reset between runs.

lldb

DEBUGGER

Push lldb-server with root and step native code with symbols.

Kernel gdb

KGDB

A guest-kernel gdb stub that freezes the whole VM at a breakpoint.

Metrics

METRICS

Live CPU, memory, battery, and storage with a log stream.

Templates

TEMPLATE

Save a device as a reusable template and clone fresh copies.

Root

ROOT

adb root, remount, and Magisk as a gated capability.

WebRTC

WEBRTC

Low-latency browser streaming for Cuttlefish devices.

iOS modes

Stock to exploit research.

Stock

Read-only filesystem, re-signed sideload. Closest to a shipping device.

Jailbroken

Root, writable /var/jb, Sileo/apt and TrollStore for arbitrary installs.

Exploit Research

Jailbroken plus anti-VM-detection and a spoofed device identity.

Cuttlefish images

Masked, debug, kernel-debug.

masked

Anti-detection image, no root. Presents as a real phone to RASP-aware apps.

debug

Rooted userdebug: root shell, frida, and lldb for instrumentation.

kernel-debug

Adds a guest-kernel gdb stub for breakpoints below the app surface.

Architecture

Auth and audit in one place.

Clients talk only to the control plane, which reverse-proxies to node agents and cloud services. Agents bind loopback; remote nodes dial out, so there are no inbound ports.

Clients