Is it safe to answer Claude Code prompts from a phone?
answered for v0.5.2, 1 November 2026
A phone that can approve can run commands, so treat a paired phone like your Mac's keyboard. Jantar keeps what can reach it small: it listens only on 127.0.0.1, your phone comes in through your own Tailscale or Cloudflare tunnel, pairing is a one-time QR code, every switch is set at the Mac, and a terminal answer is typed only if the dialog is still exactly what you tapped.
What keeps it small
- network
- The daemon listens on 127.0.0.1 only. The phone reaches it through Tailscale Serve, private to your tailnet, or a Cloudflare Tunnel with Access in front; with Cloudflare, TLS ends at Cloudflare.
- pairing
- A QR code that works once, for 10 minutes. Every write carries the device's secret, and over the network every /v1 route but the pairing claim needs a paired device.
- scopes
- Read, control, launch and admin, in that order. Only the Mac grants launch, which starts sessions.
- switches
- No phone can turn a feature on, add a folder or grant itself a scope, not even an admin device.
- typing
- A dialog answer is typed only if the screen still shows exactly what you tapped, checked again in the same AppleScript run that types it. Rows that save a rule or switch mode take a 2-second hold.
- hooks
- Opt-in, and they fail open: with Jantar stopped, Claude behaves as usual.
What it can't close
- A key pressed at the Mac in the few milliseconds before Jantar types can still come first.
- Anything running as you on the Mac, a Claude session with Bash included, can reach Jantar's local sockets and could pair itself as a device. Treat a card approval as coming from anything running as you, not only your phone.
- A lost phone stays paired until you sign it out at the Mac:
jantar devices revoke <device>.