I’ve been building Buddy, a free, open source (Apache 2.0) Android app. You type or say what you want in a floating bubble, and an AI agent reads the screen, taps and types through your apps to do it.
- Your choice of agent: Claude Code, Codex, OpenCode, Antigravity or Grok, running inside the app (Alpine Linux via proot) on your own plan. OpenCode’s free models need no account.
- No root, adb or PC: it reads the screen and taps through the accessibility service.
- Asks first: before anything is sent, posted, bought or deleted. It pauses when you touch the screen and never types passwords or payment details.
- Builds apps: with Linux tools on, it builds real APKs on the phone. This week I drew a maze on a paper towel, took a photo, and it made it a tilt game. The first build crashed on launch; it found the bug and fixed it.
To be upfront:
- What the agent reads on your screen goes to the AI service you pick.
- It’s early (2.2), tested most on a OnePlus 12 with Android 16.
- It’s not on Play (Google rejected the accessibility use), so it’s an APK from GitHub releases, built by GitHub Actions from the source.
Source and releases: github.com/ghorbelhamdi/buddy-android
Happy to answer questions here.


Token work offloading.
Unethical bingo sentences – center square.
It’s just an MCP server for the phone with an app to control it, basically computer use, but for Android. Agents using computers are already normal, so I’m not sure why phones would be different. And it runs on your own plan, or on local models if you’d rather keep it off the cloud entirely.
A much safer accessibility method would be a flutter webview. Local user will be confined to the webview instance and will still need to resolve ai agent challenges themselves.
Accessibility-from-scratch utilizing a server\client with a linux shell is what something like Shizuku was made for. Elevated privileged activities like listing installed apps, running apps, running a url (elevated) are not normal in ai agent workflows. MCP server resources can be “patched” this way from a very specific call… hence offloading somebody else’s token work.