Agents get hands: pinky and phoneuse put AI on a real phone while devvm and sandbox-mcp hand it a throwaway machine

The repo's one-line pitch is “Let AI agents use your phone, with you in the loop.” It is a Go project under Apache-2.0, created on Nov 6, and it had 1,667 stars at the time of our search, the highest of any new repo in this week's sweep.

Why it matters now: phones hold the accounts, two-factor prompts and apps that no API reaches, so they are where browser-style agents hit a wall. The “with you in the loop” framing is the design question to watch: which taps run unattended and which wait for a human. We are quoting the description and did not run the code.

The description: “See and operate an unmodified iPhone from a Linux PC: AirPlay mirror in, Bluetooth HID mouse/keyboard out, plus a CLI and skill for agents.” Screen mirroring supplies the eyes, a Bluetooth keyboard-and-mouse profile supplies the hands, and a skill wraps it for agent harnesses. It is MIT-licensed with 573 stars at search time.

Why it matters now: it is the second new route in a week to a real iPhone without jailbreaking, after the poki MCP server in the previous edition. Two independent teams converging on standard peripherals (mirroring and HID) suggests the unmodified-phone problem is being solved from the outside in. We describe the stated approach only.

The description calls it an “agent skill that sets up a headless Mac, Linux or Windows machine over SSH, step by step, without ever seeing the admin password.” It is a shell-based MIT repo with 181 stars at search time.

Why it matters now: handing an agent root is the obvious fear when you ask it to provision a machine. A skill that is explicitly designed so the secret never enters the model's context treats credential isolation as a first-class feature rather than a footnote. How well it holds up is for readers to audit; we did not test it.

The tagline: “One VM for every project. An isolated sandbox with your project's toolchain, ready for you or a coding agent to start coding.” It is a Go, MIT-licensed project with 537 stars at search time.

Why it matters now: as agents run longer and with fewer prompts, the blast radius of one bad command matters more than the quality of the next suggestion. Per-project VMs that carry their own toolchain turn “let it run” into a lower-stakes decision. We have not measured start-up time or isolation strength.

The repo describes itself as “Fresh, throwaway Windows machines for testing your apps: an MCP server and CLI that automate Windows Sandbox.” It is MIT-licensed JavaScript with 401 stars at search time, published under the account of Scott Hanselman.

Why it matters now: Windows has been the awkward platform for agent testing, since there is no cheap way to get a clean machine on demand. Wrapping the built-in Windows Sandbox feature in an MCP server means any MCP client can ask for one. The claims here are the repo's own and untested by us.

The description reads “Agent Skill for fine-tuning an agentic model on your own Claude Code sessions with Tinker. Works in Claude Code, Codex and OpenCode.” It is MIT-licensed Python with 304 stars at search time.

Why it matters now: your session history is a dataset of how you actually direct an agent, and this skill treats it as training data. If the loop works, it moves personalisation from prompt files to model weights. Whether the results are better than a good CLAUDE.md is an open question; we did not run it, and anyone using it should check what leaves their machine.

The description: “agent skill that removes AI tells and rewrites text 80% of the way to ASD-STE100 (Simplified Technical English), the method Andrej Karpathy shared.” The repo is MIT-licensed Python with 304 stars at search time, created Nov 9.

Why it matters now: anti-slop skills are a crowded genre, but most chase a vague notion of “sounding human.” Anchoring on an existing controlled-language standard gives the rewrite a checkable rule set instead of a vibe. The Karpathy attribution is the repo's own claim, which we did not verify.

The description: “Session work modes for Claude Code: /work-mode auto | out | wrap, with optional gates.” It is a TypeScript, MIT-licensed repo with 177 stars at search time. We have only the one-line description, so we cannot say precisely what each mode does.

Why it matters now: it fits a pattern of tools that give a session an explicit lifecycle (start, hand off, wrap up) with optional gates a human must pass. The unattended-agent push of the last edition makes those handoff points the interesting part. Treat the specifics as unverified until you read the README.

The repo's description is “Headless 3D and VFX engine for agents. Research preview.” It is written in Rust, was created Nov 5 and had 1,357 stars at search time. We did not confirm a license.

Why it matters now: most 3D tools assume a human in front of a viewport. A headless engine whose interface is designed for an agent to drive is a bet that rendering becomes something models script, check and re-run. “Research preview” is the author's own caution and worth taking at face value.

The description: “Turn one image of anything into a 3D sculpt measured against that image: registered views, map-fitting passes, Blender replay and timelapse. A skill for coding agents.” It is MIT-licensed Python with 230 stars at search time. A sibling repo, Nyxera0x/cutaway, also created Nov 6, is a Claude Code skill that builds a three.js object from one picture and checks it against that picture; it had 164 stars.

Why it matters now: both lean on the same loop, which is generate, compare against the source, then fix. That compare step is what lifts a creative skill from a one-shot demo to something an agent can iterate on. Output quality is for readers to judge; we did not run either.

The description: “Agent skill for narrated cinematic films built entirely from code: one continuous camera over photos, maps and cards, timed to the voice. Claude Code, Codex, Cursor, Gemini CLI.” It is MIT-licensed Python with 139 stars at search time.

Why it matters now: it lists four different agent harnesses in one line. Skills written to one convention and meant to run in several tools are becoming the default, which makes a skill's portability a selling point rather than an afterthought. We did not test the film output.

The description: “NVIDIA Auto Ontology's semantic layer and a personal knowledge base as an MCP server for Claude, ChatGPT and other MCP clients. No LLM API key needed.” It is Apache-2.0 Python with 303 stars at search time. The description refers to NVIDIA's project; we have not established any affiliation between this repo and NVIDIA.

Why it matters now: “no LLM API key needed” means the server hands structure to whichever model the client already runs, instead of calling a model of its own. That keeps cost and data flow with the user. The ontology claim itself is the repo's and untested by us.

The description: “Read-only MCP server for Yandex Metrika: verifiable reports, period comparisons, time series and exports for Claude, Cursor, VS Code and Codex.” It is MIT-licensed TypeScript with 127 stars at search time.

Why it matters now: analytics is a good fit for MCP because the safe default is to read and never write. This server makes that explicit with read-only access and reports meant to be verifiable. It is also a reminder that MCP coverage now reaches regional tools well beyond the usual Western SaaS list.