Droidrun
Droidrun gives AI agents a real phone. Its mobilerun cloud provisions genuine Android and iOS devices on demand, driven by API, while an MIT-licensed open-source framework runs locally. Business customers only; published by a German company.
What is Droidrun?
Droidrun is a mobile execution layer for AI agents: where browser agents stop, it hands the model a real phone. The manifesto states the division of labour plainly, the model decides, the Phone Layer executes. The offer comes in two complementary halves. mobilerun cloud provisions real Android and iOS handsets on demand, from one to 10,000, with parallel execution, fleet synchronisation and webhooks. mobilerun framework is the open-source half, MIT-licensed and installed with pip, model-agnostic across Gemini, OpenAI, Anthropic, DeepSeek, Qwen, Ollama and OpenRouter, running on Python 3.10 or later against Android 10 and above. The working principle is the same on both paths. The agent reads the screen through the accessibility tree plus vision, then taps, swipes and types until the goal is reached; the publisher quotes a p50 latency of 204 ms for that loop. Physical devices are the central claim rather than emulators, on the stated grounds that emulators and virtual phones get detected and blocked. To that body Droidrun adds an identity: numbers, eSIM and accounts the agent owns, with eSIM and one-time passcodes reachable by API on request, plus its own residential network, mobilerun Connect, covering the United States, Europe and Asia. Three agent archetypes are documented, Task, Testing and Research agents, over six framework primitives: LLM Agnostic, Vision Mode, Reasoning Mode, Structured Output, Custom Tools and App Cards. The manifesto describes eight stack layers, from control and orchestration through devices, identity, execution, app intelligence and reliability to infrastructure. Published use cases run from enterprise RPA, social media and sales outreach to QA, market intelligence, commerce, healthcare, gaming, supply chain and white-label deployments. The publisher claims 91.4% on AndroidWorld, 106 tasks out of 116, alongside 8,949 GitHub stars, more than 1,800 Discord members and a number-one Product Hunt day: figures reported here as vendor claims, not as measurements verified by Guidaio. One point of geography matters. droidrun.ai is now only the brand page: the usable product, its pricing, documentation and terms live on mobilerun.ai and cloud.mobilerun.ai, operated by the same company, Droidrun GmbH of Osnabrück.
What it does
- Automate any mobile application, including those with no public API.
- Extend an existing RPA setup to mobile processes without changing the back end.
- Extract structured, typed data from any mobile app, and track applications, prices and competitor moves market by market.
- Run QA and penetration tests on real user journeys, on real devices.
- Receive and read SMS messages and one-time passcodes through the API.
- Operate authorised accounts on real phones, social networks included.
- Hand a phone to a Claude Code, Cursor or VS Code agent through the MCP server.
When to use Droidrun / When not to
A quick filter to help you decide if Droidrun is the right fit.
When to use Droidrun
- Teams building AI agents that need to reach mobile-only apps, with real Android and iOS devices exposed through an API.
- Enterprise RPA teams whose processes run through mobile applications and cannot be rewired at the back end.
- QA and security teams testing real user journeys, or running pentests, on isolated physical devices.
- Social media, growth and sales teams operating authorised brand accounts and running outreach from real handsets, and analysts tracking apps, prices and competitor moves market by market.
- Python developers looking for an open-source, LLM-agnostic mobile automation framework they can run on their own machine.
When not to use Droidrun
- Private individuals: the service is reserved to business customers (terms 1.3), and proof of professional status may be required.
- Organisations that require an achieved SOC 2 certification, since it is announced as being on the roadmap only.
- Anyone planning to bypass technical protections, whether geo-blocking, rate limiting, captcha or unauthorised scraping, all explicitly forbidden by clause 5.3 of the terms.
- Non-technical teams aiming straight at the API: the no-code assistant, mobilerun VA, is still in beta.
- Projects that need an availability or accuracy guarantee, or whose data may not leave their own country: the service is supplied as is, hosting sits in Germany and the EEA, and transfers outside the EEA remain possible under standard contractual clauses.
How to use Droidrun
A typical end-to-end flow, from setup to results.
- Choose between the two documented paths, which are mutually exclusive: the hosted cloud, or the open-source framework running on your own machine.
- For the cloud path, open an account on cloud.mobilerun.ai and generate an API key from the API Keys page; it starts with dr_sk_.
- Provision a device from the dashboard, an operation the publisher advertises as a real device in under five minutes.
- Drive the platform from the REST API, the Python or TypeScript SDK, or the hosted MCP server: a task is a POST to /v1/tasks carrying a deviceId and a goal written in plain language.
- To plug in a coding agent, add the MCP server in a single command for Claude Code, or paste the JSON block supplied for Claude Desktop, Cursor and VS Code.
- For the framework path, install with pip install mobilerun, run mobilerun setup to install the Portal APK, then launch mobilerun run followed by your instruction.
- Check the local prerequisites before starting: Python 3.10 or later, adb, an Android 10 or later device, and your own LLM provider key.
- Mind the trap the documentation itself flags as the most common setup mistake: one key at a time, either the dr_sk_ cloud key or the LLM provider key, never both.
- Let the agent install itself with Mobile Harness if you prefer: a single prompt pasted to the agent, which reads install.md and installs mobilerun-core.
- Move from local to cloud when ready, announced as one config change, and try mobilerun VA, the no-code natural-language assistant still in beta.
Pros & Cons
Pros
- Real physical Android and iOS hardware rather than emulators, the central claim of the product and the reason the publisher gives for it.
- An MIT-licensed open-source framework, model-agnostic and runnable locally, which limits lock-in to the hosted layer.
- Detailed technical documentation covering quickstart, API reference, guides, MCP and n8n, next to a published AndroidWorld score of 91.4% (106 of 116) claimed by the publisher.
- An identified European company with a complete imprint, an explicit GDPR posture and data processed in Germany and the EEA.
- A published DPA and DPA Addendum, together with a named list of sub-processors.
- Network and SIM layers operated in-house through Connect and eSIM, with no resale announced.
- Public pricing with a low entry point at USD 5 per month on your own device, a documented EUR 2.1M raise in July 2025 with named investors, and publicly checkable traction claimed by the publisher.
Cons
- SOC 2 is stated as being on the roadmap, which means no certification has been obtained to date.
- Business customers only under clause 1.3: private individuals have no access.
- No free trial and no permanent free plan is documented on the pricing page.
- Terms heavily favour the publisher: the service is supplied as is, with no availability or accuracy warranty (4.1, 4.2), liability capped at a quarter of the annual fee per event (12.2), no responsibility for the storage, accessibility or integrity of customer data (3.2), and exclusive Berlin jurisdiction under German law with the CISG excluded.
- No documented opt-out from training: anonymised and aggregated reuse is a contractual right under 7.4 and 8.3, and the platform stores the third-party app credentials the customer supplies (7.2).
- Automating third-party applications may breach their own terms, and clause 5.2 shifts that responsibility entirely onto the customer.
- Identity scattered across three domains after the rebrand, with droidrun.ai/terms returning the home page; mobilerun VA is in beta and eSIM is on request; and prices are displayed in dollars while clause 10.1 states euro prices.
Pricing & Plans
No free trial and no permanent free plan is documented: the Start free button leads to cloud sign-up without published conditions. The cheapest paid entry point is USD 5 per month under the Your Own Phone plan, which uses your own device and network and includes USD 5 of credits per month. A dedicated Android phone costs USD 80 per month, or USD 768 per year with annual billing at minus 20%, and the iPhone plan, running on custom hardware, costs USD 200 per month or USD 1,920 per year. Usage may also be paid as you go at USD 0.03 per minute of Android phone time, with no commitment. On-demand consumption is billed at USD 0.03 per Android phone minute, USD 10 per gigabyte on Connect and USD 0.01 per agent step; the Android and iPhone plans include USD 25 of credits per month against USD 5 on Your Own Phone. Enterprise pricing is on quotation. The open-source framework is free to run locally, the user paying for their own LLM provider key. Note that clause 10.1 of the terms states prices in euros excluding VAT, payable within 14 days, while the website displays dollars.
- your own device and your own network
- USD 5 of credits
- persistent state
- real identity
- VA included
- EU or US region.
- a dedicated always-on Android phone
- a Connect residential IP included
- USD 25 of credits
- persistent state
- VA
- 24/7 automation
- EU or US region.
- a real physical iPhone on custom hardware for native iOS stealth
- residential IP included
- USD 25 of credits
- VA
- 24/7 automation.
- Android on demand with no commitment
- VA and stealth agent included
- Connect not included.
- 10
- 000 or more concurrent phones
- custom iOS hardware
- SSO
- private fleets
- SOC 2 announced as being on the roadmap
- dedicated support and SLA.
- Annual billing is announced at minus 20% across the subscription tiers.
Data, GDPR & hosting
A consolidated view of how Droidrun handles your data.
GDPR overview
GDPR compliance is claimed explicitly: processing takes place always in accordance with Regulation (EU) 2016/679 and the German BDSG. The controller is Droidrun GmbH, Rheinstraße 82, 49090 Osnabrück, reachable at dataprotection@droidrun.com, and the privacy policy is dated February 2026 and covers droidrun.ai as well as mobilerun.ai. Rights are listed article by article: withdrawal of consent (7(3)), access (15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) and complaint (77), with the national limits of §§34-35 BDSG and the competent authority named, the State Commissioner for Data Protection of Lower Saxony. Sub-processors are named (PostHog, Plus Five Five/Resend, Cloudflare, Autumn Labs, Stripe), each covered by an Article 28 DPA or Article 46(2)(c) standard contractual clauses. No Article 27 representative applies, the company being established in the EU.
Who owns the data?
Under the terms of service, the customer keeps every right to its Customer Content: content, prompts, workflows and uploaded APKs (7.1). In exchange, DroidRun receives a non-exclusive, worldwide, sublicensable licence to host, reproduce, distribute, modify and combine that material in order to run the service (7.3). Everything on the publisher's side stays its own: platform, models, weights, prompts, knowledge graphs and algorithms (6.1). Credentials for third-party apps supplied by the customer are stored, and shared only at the customer's request (7.2). Where an organisation provides the account, it is the controller and DroidRun only a processor (privacy 3.4). The publisher disclaims responsibility for data storage, accessibility and integrity (3.2), and allows 30 days after termination to download Customer Content (14.4).
Reuse rights
Service Results belong to the customer to use freely: clause 8.2 requires no further permission, but they are delivered as is and it is up to the customer to check them. In the other direction, the publisher reserves a broad right of reuse. Clause 7.4 lets DroidRun exploit Customer Content and other customer data, including trajectories, prompts, execution times, API calls, error messages and consumption, in aggregated and anonymised form to improve the service, its learning models and its foundation models; clause 8.3 extends the same right to Service Results. The privacy policy (3.5) confirms that anonymisation comes first, cites Article 6(1)(f) GDPR as the legal basis, and states that once anonymised the data falls outside the scope of the GDPR and may be kept indefinitely. Server logs (browser, operating system, host, date, IP address) are kept for seven days at most, are not merged with other sources and are not used for marketing (3.1). The newsletter runs on double opt-in with open tracking and can be revoked at any time (3.3), and no automated decision-making within the meaning of Article 22 takes place (section 8). No opt-out from training use is documented anywhere on the site.
Data retention & training
Hosting summary
The privacy policy states that personal data is generally processed in Germany and in other countries of the European Economic Area. Transfers outside the EEA remain possible, framed by standard contractual clauses under Article 46(2)(c) or by an adequacy decision, with the documentation supplied on request. Cloudflare is identified as a sub-processor for DNS, domain protection and website hosting, which explains why droidrun.ai resolves to 104.21.10.52 on AS13335 Cloudflare: an anycast CDN node whose US geolocation says nothing about where the data actually lives. Devices are a separate matter from the website and the account data. The Android and bring-your-own-device plans advertise an EU or US region, the Connect residential network covers the United States, Europe and Asia, and the enterprise offer promises iOS and Android in your regions, behind your own access controls. In short: European jurisdiction and EEA processing for personal data, with device and network placement chosen per plan.
Things to keep in mind
Risks and trade-offs to weigh before adopting Droidrun.
- SOC 2 is announced as being on the roadmap and has not been obtained: it must not be read as a certification held today.
- Anonymised and aggregated reuse of customer data to train models is written into the terms (7.4 and 8.3) with no documented opt-out, and the platform stores the third-party app credentials the customer supplies (7.2).
- Automating a third-party application may breach its own terms, and clause 5.2 shifts that responsibility entirely onto the customer; clause 5.3 also forbids proxies used to bypass geo-blocking, rate limiting or captcha, as well as unauthorised scraping, a contractual limit that sits alongside the marketing's stealth positioning.
- Liability is capped at a quarter of the annual fee per event (12.2), there is no availability or accuracy warranty (4.1, 4.2) and no responsibility is accepted for the storage or integrity of data (3.2).
- The rebrand scatters the product: droidrun.ai is now a brand page, droidrun.ai/terms returns the home page as a soft 404, and the applicable terms live on cloud.mobilerun.ai, so check which document you are actually signing. Two further inconsistencies deserve a look, prices displayed in USD while clause 10.1 states EUR excluding VAT, and an imprint that shows contact@droidrun.ai while its mailto link points elsewhere.
- Over-delegation is the human risk: an agent that types like a human and operates real accounts at fleet scale still acts under your identity and your responsibility, and with results delivered as is, human review of what the phone actually did remains necessary. Features announced as beta (mobilerun VA) or on request (eSIM) should not be planned as generally available.
- The traction figures quoted on the site, 8,949 GitHub stars, more than 1,800 Discord members and 91.4% on AndroidWorld, are publisher claims and have not been verified by Guidaio.
Setup & Integrations
Technical difficulty
Two levels, depending on the path. The cloud route needs no local setup: a dr_sk_ key, a device provisioned from the dashboard, then REST, an SDK or the hosted MCP server, with a real device claimed in under five minutes and MCP added in one command for Claude Code. The framework route is developer territory: Python 3.10 or later, adb, the Portal APK and an Android 10 device, announced as three commands. No-code is possible through n8n, Zapier or Make, and through mobilerun VA in beta. Documented trap: one key at a time, never both.
Deployment
Integrations
Supported languages
Behind Droidrun
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Droidrun.
Frequently asked questions
What devices does the agent actually run on?
Do I need to know how to code?
Which LLM does it use?
How much does Droidrun cost?
Is there a free trial or a free plan?
Can private individuals sign up?
Where is the data hosted?
Is my data used to train models?
Is Droidrun SOC 2 certified, and is a DPA available?
Can the agent receive SMS messages, and is the framework open source?
Should you pick Droidrun?
Droidrun is a real, documented product rather than a landing page: a complete imprint, terms and a privacy policy both dated February 2026, a published DPA, public pricing and verifiable open-source code. The positioning is narrow and deliberate, a mobile execution layer that begins where browser agents stop, and the publisher backs it with physical Android and iOS devices instead of emulators. The signals of seriousness are there for a buyer who checks them: an identified German company, an explicit GDPR posture with named sub-processors, hosting in Germany and the EEA, and a documented EUR 2.1M raise with named investors. Reservations are just as concrete. SOC 2 is on the roadmap, not obtained. Access is business-only. Anonymised and aggregated customer data feeds model training as a contractual right, with no documented opt-out. The terms are unusually protective of the publisher, from the as-is service and the absence of any availability or accuracy warranty to a liability cap set at a quarter of the annual fee. And the ongoing rebrand scatters the product across three domains, which makes it easy to read the wrong document: droidrun.ai is now a brand page, while pricing, documentation and the applicable terms sit on mobilerun.ai and cloud.mobilerun.ai. The company is young, its domain registered in April 2025, and its headline figures on GitHub stars, Discord membership and the AndroidWorld benchmark are publisher claims that Guidaio has not verified. For a technical team that already knows why it needs a phone rather than a browser, the entry cost is low and the framework can be tested locally for nothing. For a buyer with a formal compliance checklist, the honest reading is: promising, European, well documented, and still early.
- Choosing a selection results in a full page refresh.
- Opens in a new window.