# Direct a local Cursor Agent from iPhone and verify the result

> Hand a local Cursor Agent session to iPhone Remote Control, inspect its permissions, then check the local diff and tests before a commit or PR decision.

By BIGCHANGE.AI Editorial

Published: 2026-10-23T13:02:47.685Z
Updated: 2026-10-23T13:02:47.685Z
Canonical: https://bigchange.ai/blog/cursor-local-agent-iphone-remote-control-guide

![AI-generated conceptual charcoal illustration of one person in a doorway reading an unbranded phone, with an awake desktop computer in the room behind.](https://bigchange.ai/api/media/file/cursor-remote-control-local-computer-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE. No actual Cursor interface, connected session, repository result or BIG CHANGE test is depicted.

Cursor Remote Control lets you continue an existing local Agent session from an iPhone while the agent's tools still run on your computer. This guide takes one authorized repository task through phone supervision, a complete local diff, actual checks and an owner decision about a commit or pull request. It is a documented procedure; BIG CHANGE did not connect a Cursor account or run a repository task for this article.

## The big change

- **What changed:** Cursor's [Remote Control](https://cursor.com/docs/cloud-agent/mobile) hands an Agents Window session to a cloud agent loop that you can direct in the iOS app. Terminal commands, edits, tests and Git tool calls still execute on your available computer.
- **Why it matters:** You can follow the same local task away from the desk without changing its execution location, then return to the repository to judge the actual code and test output.
- **What to watch:** Cloud storage, plan and device access, the computer's availability, local tool permissions and usage charges all affect whether the handoff is appropriate. Cursor's current manual does not say that desktop approval behavior stays identical after handoff.

## 1. Check access, privacy and the task

Use Cursor **3.9.8 or later** in the **Agents Window**. Remote Control requires an account with Cloud Agents access: Cursor currently lists Premium, Super, Ultra, Teams and Enterprise, plus eligible legacy plans. Cursor for iOS requires **iOS 26.0 or later** on iPhone or **iPadOS 26.0 or later** on iPad; Android is planned. Sign in to the same authorized Cursor account on both devices. Teams and Enterprise admins must enable **Cursor Dashboard → Cloud Agents → Self-Hosted** before a member can turn on **Settings → Agents → Remote Control**. A local or Remote SSH workspace is supported, and a Git remote is optional. Keep the computer awake and online for tool calls. [Cursor's mobile manual](https://cursor.com/docs/cloud-agent/mobile) gives the current eligibility and setup details.

Remote Control needs cloud data storage. Cursor says the conversation state and model context move to its cloud and tool results and needed context cross to it; the repository, credentials and tool execution remain on your machine. If your organization has not approved that data path, stop before enabling it. Cursor says a switch from **Privacy Mode (Legacy)** to **Privacy Mode** cannot be reversed. Have the account or policy owner make that decision. Check the selected model, plan and live usage terms in [Cursor's pricing page](https://cursor.com/pricing) and the account before starting; third-party model usage can be billed separately. No fixed task price is established here.

Choose one low-impact issue in a repository you are authorized to edit. On the computer, record the branch, current commit, `git status --short`, the observable problem, the allowed files and the repository's real check command. If the status already contains changes, identify their owner before giving the agent the task. Decide who can accept a commit or propose a PR. Publishing, merging and deployment need their own review.

## 2. Inspect what the local agent can do

Before the handoff, open **Settings → Agents → Approvals & Execution** on the desktop and read the *effective* run mode. Cursor documents **Auto-review**, **Allowlist** and **Run Everything**. An allowlisted call may run without asking; Auto-review uses a best-effort classifier and sandbox rules, while Run Everything runs tool calls automatically. Inspect command, MCP and Fetch approvals, allowlists, local sandbox and network policy, including any user, project or team overrides. List connected external tools and the credentials and network routes this workspace can reach. Remove access the bounded task does not need, or hold the task if you cannot establish its authority. Workspace edits can save immediately to disk. [Agent Security](https://cursor.com/docs/agent/security) and [Run Modes](https://cursor.com/docs/agent/security/run-modes) describe those desktop controls.

The Remote Control manual confirms local tool execution but does not specify whether desktop approvals and phone-side approval behavior carry over unchanged. Record that gate as unresolved until the owner checks the actual setting and observed prompts after handoff. Keep sensitive actions outside this session if their approval path cannot be established. Instructions such as “do not push,” and a stated time or usage cap, guide the agent; they do not enforce permissions or billing. The network controls in Cursor's [cloud-hosted Secrets & Network guide](https://cursor.com/docs/cloud-agent/security-network) concern hosted Cloud Agents and do not prove restrictions for this local worker.

## 3. Start the bounded session and hand it off

Open the repository in Cursor's **Agents Window**. Enable **Remote Control** under **Settings → Agents** only after the account, admin and privacy checks pass. Start or select the local Agent session for the recorded issue. Paste the following task after replacing every bracketed field with your own repository facts. Keep secrets out of the message.

```prompt
Repository/workspace: [authorized local path or Remote SSH workspace]
Branch and baseline commit: [branch] / [commit]
Baseline git status --short: [exact output]
One issue: [observable bug or failing test]
Expected result: [specific behavior or assertion]
Allowed files and areas: [paths]
Local check commands: [real test/lint/build commands for this repository]
Owner-approved time and usage limit: [limit]

Inspect the issue and report the smallest proposed change before editing. Stay within the allowed scope. Run the named local checks and report each command, exit code and relevant output. Stop on permission ambiguity, unexpected existing changes, a failing check or a need to expand scope. Do not push, merge, deploy, change account settings, touch production data or expose secrets. Pause for my review after showing the changed-file list and results.
```

In that session's desktop input, enter `/remote-control` and **send the next message**. Cursor documents both actions as the handoff sequence. Open Cursor for iOS and find the session in the inbox. Compare its task and context with the desktop session before continuing; do not assume an unfamiliar session is the same work. From the phone, send this follow-up to the matched session:

```prompt
Confirm the repository, branch and bounded task from this session. Continue only the approved work. Show the changed-file list and each local check with its exit code and output. Stop and ask if a tool needs authority outside the recorded scope. Pause when the results are ready for my desktop review.
```

Watch the work stream and tool results. Stop or redirect an expanding task. The iOS app can direct and review the session; the full editor, terminal and file browser remain on the computer. A sleeping or offline computer prevents local tool calls from completing. Cursor's manual distinguishes this handoff from **Move to Cloud**, which transfers work to a cloud-hosted agent.

## 4. Verify on the computer before accepting anything

Return to the computer or an authorized repository review surface. Match the session and branch again. Run `git status --short`, inspect every changed file and the complete diff, and compare the result with the baseline and allowed scope. Run the repository's specified local checks yourself or inspect their actual command, exit code and output from a trusted local record. If the issue needs a manual behavior check, perform and record it. An agent message that says “tests passed” cannot replace those results. Check for unexpected network actions, secrets in output or unintended file changes.

Fill this record from observed facts. Keep it in the repository's private review process, not in a public issue if it contains paths or account details.

```text
Gate record, date/time and reviewer:
Cursor desktop version, Agents Window and account plan:
iOS/iPadOS version and same authorized account:
Team admin switch, if applicable:
Settings > Agents > Remote Control state:
Cloud-storage/privacy decision and approving owner:
Computer awake/online and workspace type:
Chosen model and account usage controls:
Effective Settings > Agents > Approvals & Execution mode:
Command/MCP/Fetch approvals, allowlists, local sandbox/network policy:
Connected external tools, reachable credentials and task-needed authority:
Excess access removed, or exact hold reason:
Approval behavior observed after handoff, or unresolved gate and owner decision:
Desktop and phone session identity match:

Result record, completed only from actual readback:
Original branch, commit and git status:
Changed files and complete diff reviewed:
Commands, exit codes and relevant observed output:
Manual behavior result, if required:
Unexpected access, secrets or external side effects:
Usage/billing readback, if available:
Decision: accept locally / propose PR for review / hold and repair:
Commit or PR ID, only if actually created:
Separate merge/deploy approval, if any:
Recovery action and readback, if any:
```

Accept only when the intended behavior, diff and actual checks agree. Commit locally or propose a PR under your repository's normal review process. For a PR, check its exact branch and diff, CI result, reviewers and approval before a merge decision. A visible phone session does not establish that a PR was created, and this guide makes no claim that one was.

## If the handoff or change fails

If the phone cannot find the session, check the desktop version, eligible plan, admin switch, **Remote Control** setting, storage policy, same account and computer connection. Inspect the original session and local Git state before sending the task again: an uncertain tool call may already have run. For an offline computer, restore the connection and read that same state before resuming.

If the agent edits the wrong files, stop it and inspect the diff. Revert only the unwanted edits through source control or a Cursor checkpoint after checking for pre-existing work. Cursor says a [Restore Checkpoint](https://cursor.com/help/ai-features/agent) restores files, not conversation history; it cannot undo an external action. Treat a credential exposed in output through the owner's normal revocation process. Keep the branch unmerged while any test, permission or cost question remains open.

For a different cross-device workflow, [our Codex Cloud environment guide](https://bigchange.ai/blog/codex-cloud-environment-setup-guide) sets up a reusable cloud VM. Cursor Remote Control in this guide continues a local session whose tools need the reader's computer. They are related tasks with different execution and recovery paths.

## Sources & further reading

- [Cursor for iOS and Remote Control](https://cursor.com/docs/cloud-agent/mobile): platform, plan, handoff, local execution, privacy and availability requirements.
- [Cursor Agent Security](https://cursor.com/docs/agent/security) and [Run Modes](https://cursor.com/docs/agent/security/run-modes): local editing and effective desktop tool approvals. The post-handoff approval behavior needs the reader's own readback.
- [Cursor Agent mode](https://cursor.com/help/ai-features/agent): diff, Stop and file-only checkpoint behavior.
- [Cursor pricing](https://cursor.com/pricing): live plan and usage terms; check account-specific entitlement and charges.
- [Cloud-hosted Secrets & Network](https://cursor.com/docs/cloud-agent/security-network): hosted controls for comparison, not a claim about the local Remote Control worker.

## Sources

- [Cursor for iOS](https://cursor.com/docs/cloud-agent/mobile) — Remote Control access, handoff, local execution, cloud context, platform and privacy gates; no page publication date stated.
- [Cursor Agent Security](https://cursor.com/docs/agent/security) — Desktop defaults, immediate edits and configurable approvals; account behavior requires readback.
- [Cursor Run Modes](https://cursor.com/docs/agent/security/run-modes) — Effective desktop command, MCP, Fetch, allowlist, sandbox and network settings; phone inheritance unverified.
- [Cursor Agent mode](https://cursor.com/help/ai-features/agent) — Diff, Stop and file-only checkpoint behavior.
- [Cursor pricing](https://cursor.com/pricing) — Plan and usage context; no account-specific entitlement or charge tested.
- [Cursor Cloud Agents Secrets & Network](https://cursor.com/docs/cloud-agent/security-network) — Hosted environment controls are not assumed for local Remote Control.