Agent Mobile Apps
Use your Hub-hosted agents from a phone after the agent is installed, configured, and reachable from that phone. OpenClaw has official iOS and Android clients. Hermex is an independent iPhone client with a different server requirement.
| Agent | Mobile client | Current CI support |
|---|---|---|
| OpenClaw | Official iOS and Android apps | Supported with CI-OpenClaw |
| Hermes | Hermex for iOS | Requires a separate hermes-webui server; it does not currently connect to CI-Hermes |
Set up Tailscale first (recommended)
Tailscale gives the phone private access to Hub without opening router ports. Install it on the phone and connect Hub and the phone to the same tailnet before pairing an agent app.
Connect Hub to Tailscale
During Hub onboarding, use the Private VPN step and click Log In with Tailscale. If onboarding is already complete, go to Settings → Network → Private VPN and click Log In with Tailscale there instead.
Finish authentication in the Tailscale window. Hub’s built-in sidecar joins the tailnet automatically; you do not need to install Tailscale separately on the Hub host.
Install Tailscale on the phone
Install Tailscale from the iOS App Store or Google Play using the buttons above. Open it, join the same tailnet as Hub (with the same sign-in identity or an invited account), and approve the phone’s request to add a VPN configuration.
Confirm that both the phone and the Hub node appear connected in Tailscale. Hub also shows its Tailscale status under Settings → Network.
Approve Tailscale Serve prerequisites
Open the agent’s settings in Hub and select Private VPN. The first time you publish an app this way, Hub may show an Enable Tailscale Serve link for the Hub node. Open that node-specific link and approve the requested HTTPS settings as a tailnet owner or admin.
Serve requires MagicDNS and HTTPS certificates. The approval flow normally enables both; if Hub still reports that HTTPS is unavailable, follow the Tailscale Serve troubleshooting steps.
Publish the agent over Private VPN
In Hub, open OpenClaw or Hermes → Settings, choose Private VPN, and save. If Serve was enabled after the first attempt, toggle Private VPN off and back on or restart the app so Hub recreates the mapping.
Hub displays a generated URL similar to:
https://<your-hub>.<tailnet>.ts.net:<app-port>Verify access from the phone
Keep Tailscale connected on the phone and open the generated URL in Safari or Chrome. Do not continue to native-app pairing until the agent page loads in the phone browser.
Public HTTPS alternative
If you do not want to use Tailscale, pair Hub with your CI Account, enable the Cloudflare Gateway, and expose the agent using Hub’s Web mode. Confirm its generated HTTPS URL loads on the phone before continuing.
Do not expose an agent by forwarding a plain HTTP or WebSocket port from your
router. Remote OpenClaw pairing requires a secure wss:// gateway, and agent
dashboards contain powerful controls and credentials.
OpenClaw on iOS and Android
Install and configure CI-OpenClaw
Choose OpenClaw during the Hub onboarding wizard, or install OpenClaw from the Hub App Store. Open it once and complete the model-provider setup before trying to pair a phone.
Make CI-OpenClaw reachable
Complete the Tailscale setup above, then open the generated CI-OpenClaw URL on the phone and confirm the Control UI loads. You can use the public HTTPS alternative instead if required.
Generate a mobile pairing code
In the OpenClaw Control UI:
- Select Nodes.
- Find the Devices card.
- Click Pair mobile device.
OpenClaw displays a QR code and a copyable setup code. The setup code contains a short-lived credential, so handle it like a password while it is valid.
Connect the phone
In the OpenClaw mobile app, open Settings → Gateway. Scan the QR code or paste the setup code, then connect.
The official iOS and Android clients normally approve themselves. If the Control UI shows a pending device, review its role and scopes before approving it.
Verify the connection
Confirm the mobile app shows the connected gateway, then send a test chat. Voice, approvals, camera, location, and other device capabilities remain off until you grant the corresponding phone permissions.
OpenClaw troubleshooting
- Pair mobile device is disabled — the current Control UI session does not
have
operator.admin; reopen CI-OpenClaw from Hub and retry with the administrator session. - The QR code uses
ws://— remote mobile pairing rejects insecure Tailnet or public WebSocket URLs. Re-enable the app through Hub’s Private VPN or Web exposure and confirm its public endpoint is HTTPS/WSS. - The phone cannot reach the gateway — test the generated app URL in the phone’s browser and verify Tailscale or Cloudflare is connected first.
- A request remains pending — approve it from Nodes → Devices only after checking the requested role and scopes.
Hermes on iPhone
Hermex is not currently a CI-Hermes client. Hermex is developed and tested
against the separate, third-party nesquena/hermes-webui API. CI-Hermes runs
the official Nous Research hermes dashboard, so entering a CI-Hermes URL in
Hermex is not a supported setup.
Supported mobile access to CI-Hermes today
CI-Hermes includes a responsive web terminal and dashboard. To use it from an iPhone:
- Enable Private VPN or Web for Hermes in its Hub settings.
- If using Private VPN, complete the Tailscale setup above and keep Tailscale connected on the iPhone.
- Open the generated Hermes URL in Safari.
- Sign in through the normal Hub access flow.
- Optionally add the page to the Home Screen for app-like access.
This path keeps the existing CI-Hermes runtime, Companion Memory integration, and Hub access controls intact.
Using Hermex with its supported backend
If you separately operate a compatible hermes-webui server, set a strong
HERMES_WEBUI_PASSWORD, make that server reachable over Tailscale or HTTPS,
then enter its server URL and password in Hermex. That server is separate from
the CI-Hermes app and does not automatically inherit CI-Hermes configuration or
Companion Memory integration.