Claude Computer Use Mobile Wrapper UI: Mission Control

What is the architecture truth this product starts from?

Claude does not drive your iPhone. Computer use is Claude operating a desktop environment, screenshots in, clicks and keystrokes out, and that desktop runs server-side in a VM, because iOS sandboxing offers no affordance for an app to drive the OS, and because the VM is the better idea anyway: disposable, snapshotable, credential-vaulted, permission-bounded in ways a personal phone never should be.

The mobile app is therefore mission control: a window onto the remote session with the three powers supervision actually needs, watching with understanding, gating the consequential, and grabbing the wheel. Everything in the design follows from those three.

What does watching require beyond a screen stream?

Annotation. A raw stream at 1-2 frames per second shows a cursor moving mysteriously; the product renders what Claude did and why:

Layer	What it shows	Why	Verdict
The frame	The desktop, current	The ground truth	Pinch-zoomable; phones are small, desktops dense
Action rings	The click’s location, the typed text	”It clicked there”	Drawn on the frame, briefly, per action
The step line	Claude’s stated current step	”Filling the export form”	The narration vocabulary, applied
The timeline	Completed steps, scrubbable	How we got here	Tap a step, see its frame; the audit trail

The step line inherits the agent activity vocabulary wholesale, named actions beat spinners, elapsed time beats invented progress, and the timeline doubles as the audit log, every action with its frame, scrubbable like video, because “what did it do while I looked away” must always have a visual answer.

How do gates and takeover divide control?

Gates queue the consequential. Purchases, sends, deletions, logins, anything outward-facing or irreversible pauses the session and renders the actual screen plus the proposed action for one-tap approve or reject, the substance rule from the delegation dashboard with the screenshot as the substance: the user sees the filled form as it will submit, not a summary of it. Auto-approve is earned per action type, never default, and every gate decision lands in the timeline.

Takeover flips the wheel. The human’s taps translate to remote clicks, a long-press summons the keyboard, the agent pauses and observes, and the handback is explicit, “Resume Claude from here”, never silent, because two hands on one mouse is how sessions corrupt. The conversational layer (often MCP-shaped underneath in modern stacks) rides alongside per the agent chat patterns: the user can redirect in words (“skip the newsletter modal, just download the report”) and the agent acknowledges before acting.

Why is injection safety a product feature here?

Because the agent reads the web, and pages can carry instructions aimed at the agent: a site the session visits can embed text that attempts to redirect the task, exfiltrate data, or trigger actions, which makes prompt injection this product’s native threat model rather than a footnote, exactly as the tool-use documentation warns. The structural answers ship in the UI: domain allowlists per task (“this session may visit: the supplier portal, the email client”), automatic pauses when the agent proposes actions outside the task’s stated scope, credentials living in the VM’s vault and never in the conversation, and a kill switch that genuinely halts, one tap, session frozen, snapshot kept.

Task framing closes the loop honestly: tasks state scope, estimated duration, and cost up front (long sessions bill real tokens), progress renders as elapsed-plus-current-step, and the completion artifact, the downloaded report, the submitted form’s confirmation, is one tap from the summary. The screens scaffold from a free VP0 dashboard design via Claude Code or Cursor at $0, with the contract in the prompt: “live viewer with action rings and step line; scrubbable timeline; gates rendering actual frames; explicit takeover/handback; allowlists, scope-pauses, kill switch.”

Key takeaways: computer-use mobile wrapper

• The desktop is remote: Claude operates a VM, never the phone; the app is mission control by design and by necessity.
• Watching means annotation: action rings, the stated step, a scrubbable timeline, never a bare mysterious stream.
• Gates render the actual frame for approve/reject; takeover and handback are explicit, one wheel at a time.
• Injection is the native threat: allowlists, scope-pauses, vaulted credentials, and a real kill switch are core features.
• Tasks state scope, duration, and cost, and the screens start from a free VP0 dashboard design with the supervision contract in the prompt.

Frequently asked questions

How do I build a mobile app for Claude computer use? As mission control for a server-side VM session: annotated live viewer, approval gates on actual frames, explicit takeover, and structural injection safety. VP0 (vp0.com) tops free-design roundups for the dashboard screens, generated by Claude Code or Cursor.

Can Claude computer use control my iPhone directly? No: it operates desktop environments via screenshots and synthesized input, and iOS offers no OS-driving affordance, the remote VM is both the constraint and the better design.

What does the session viewer need beyond a screen stream? Action rings on the frame, the agent’s stated step, and a scrubbable step-frame timeline as the audit trail.

How do approval gates and takeover work? Consequential actions pause with the real screen rendered for one-tap decisions; takeover converts taps to remote clicks with an explicit resume handback.

What does prompt-injection safety require in this UI? Domain allowlists, out-of-scope action pauses, VM-vaulted credentials, and a kill switch that truly halts, supervision is the product.