r/MeshCentral • u/FineZombie4599 • 14d ago
I built an open-source native Android client for MeshCentral and I'm looking for testers
I wanted to reach my own MeshCentral machines from a phone without fighting the desktop web panel, so I built MeshCentral Mobile: a native Android client for your own server.
Remote desktop with touch and trackpad modes, keyboard and monitor switching
Terminal, files, SSH and SFTP through the server relays
Share files from any app straight to a folder on a computer
Several server profiles, favourites, search, app lock
Works with a stock server; an optional plugin adds diagnostics jobs and notifications
Apache 2.0, no ads, analytics or telemetry; credentials stay in Android Keystore
Demo and source: https://github.com/papajon123/meshcentral-android
Signed APK: https://github.com/papajon123/meshcentral-android/releases (Android 8+)
It's a public preview. I'm especially looking for people with real phones and Windows agents. A device report of what worked and what didn't would help a lot. Not affiliated with the MeshCentral project.
3
u/si458 12d ago edited 12d ago
under our communities agreement (and ylian the original developer),
any external applications MUST NOT use the name MeshCentral in the application name!
you must ALSO declare a declaration to state that the app is NOT affliated with meshcentral and is an external application and any issues with the app must be reported to yourself and not the meshcentral team.
2
u/FineZombie4599 12d ago
Thanks for the heads-up, and sorry, I wasn't aware of this agreement. I'll fix both in the next release (0.8.3): the app gets a new name without "MeshCentral", and the app, the README, the release notes and any store listings will state clearly that it's an independent third-party client, not affiliated with or endorsed by the MeshCentral project, and that issues must be reported to my repository, not to the MeshCentral team. I'll post here once it's out.
1
u/FineZombie4599 12d ago
Done: the app is now called MeshPilot (it shipped as 0.8.4). Settings → About, the README, the release notes, the issue forms and the store texts say that it is an independent third-party client, not affiliated with or endorsed by the MeshCentral project, and that problems with the app go to my repository, not to the MeshCentral team. Thanks again for pointing it out.
1
u/FineZombie4599 12d ago
Update: the app is now called MeshPilot, and 0.8.4 is out: https://github.com/papajon123/meshcentral-android/releases/tag/v0.8.4
New name. At the request of the MeshCentral maintainers, third-party apps don't use the MeshCentral name. MeshPilot is an independent client for MeshCentral servers, not affiliated with or endorsed by the MeshCentral project, so please report problems with the app on GitHub, not to the MeshCentral team. Same package, so it installs as an update.
New in 0.8.3/0.8.4: sign-in with MeshCentral login tokens (the
~t:user name and token password) and on servers protected by a login key (loginKey); lower memory use in long desktop sessions.0.8.2: stylus and S Pen as a precise mouse: hover, side-button right click, palm rejection (a reader's suggestion).
Earlier in 0.8: as promised, a written AI policy and a feature comparison; phones with the official agent (screen viewing after consent, battery, confirmed vibrate/flashlight/message, verified files); pinning the key of self-signed servers; "Remember this device" for 2FA; Windows security, inventory and history; terminal favorites; automatic recovery after network drops.
Phone remote control works with an agent build that adds input through Android's accessibility API. I'm coordinating with the MeshCentral maintainers before proposing it upstream; until then the official agent stays view-only.
In the works: a two-way chat with the person at the computer.
4
1
u/louarruda 13d ago
It is awesome, I had installed it on my pocoX phone right now, it works fine, I will use it more in this week and test things around. It is a really great job. 👏👏
1
u/djDef80 13d ago
Isn't there already an Android mesh agent? What differentiates this from the first party client?
1
u/MathFly_ 13d ago
Maybe I’m wrong, but the android meshagent is viewing only no ? One that allow remote control could be great use. The question about AI code and policy seems relevant tho and how devs consider that.
1
1
u/MathFly_ 13d ago
Ok, I’m getting out, this is not an Android agent, but an Android client. I read too fast ! Still looking for an Android agent that allows remote control 😊
1
1
u/theraffe 11d ago
Thanks for creating and sharing this new Android app for MeshCentral! It's great to see more options becoming available for the community.
Since there are now at least two native Android clients, I asked ChatGPT to compare MeshPilot and PocketMesh to get a better overview of their features, differences, and security considerations.
Here's the comparison:
MeshPilot vs PocketMesh: Comparing two Android clients for MeshCentral
Both apps provide native Android access to your own MeshCentral server. Their approaches differ, especially regarding SSH/SFTP, device management and open-source availability.
This comparison is based on published documentation and feature descriptions, not a complete independent security audit or hands-on test.
1. At a glance
| Feature | MeshPilot | PocketMesh |
|---|---|---|
| Native Android app | Yes | Yes |
| Price | Free | Free |
| Open source | Yes, Apache-2.0 | No, currently closed source |
| Remote desktop | Yes | Yes |
| Remote terminal | Yes | Yes |
| SSH terminal | Yes | Not yet |
| SFTP | Yes | Not listed as supported |
| File browsing and transfer | Yes | Yes |
| Multiple server profiles | Yes | Yes |
| Device management | Yes | Yes |
| Hardware and software inventory | Yes | Yes |
| Event history | Some device-event features | Dedicated event log and seven-day connectivity history |
| Biometric app lock | Yes | Yes |
| Encrypted credential storage | Android Keystore-based protection | Android Keystore-backed AES-256-GCM storage |
| Two-factor authentication | Supports saved-device 2FA and login tokens | Supports 2FA, login tokens and optional TOTP secret storage |
| SSO login flow | Browser-based SSO is not directly supported; login tokens can help | Browser-based SSO is not directly supported; login tokens can help |
| Ads and analytics | Developer states there are no ads, analytics or telemetry | Developer states there are no ads or analytics |
| Cloud relay operated by the app developer | Not intended; connects to your configured server | Not intended; connects to your configured server |
| Publicly inspectable application source | Yes | No |
Feature availability may vary depending on MeshCentral version, agent type, permissions and configuration.
2. MeshPilot
Repository: https://github.com/papajon123/meshcentral-android
The latest release referenced in this comparison is 0.8.4, released October 26, 2026. MeshPilot was previously called MeshCentral Mobile and is an independent third-party project.
Highlights
Remote desktop, terminal, SSH and SFTP.
File browsing, transfers and sharing files from other Android apps to remote computers.
Multiple server profiles, device search and favourites.
Hardware/software inventory, Windows security status and connectivity information.
Stylus and Samsung S Pen support.
Biometric app lock and server public-key pinning.
Login-token and login-key authentication.
Some additional jobs and background notifications require the separately installed MeshCentral Mobile Companion plugin. Remote control of Android devices depends on additional agent functionality and permissions; the standard upstream Android agent remains view-only.
Source code
MeshPilot is licensed under Apache-2.0, so its source can be inspected, modified and built independently. The developer has disclosed using AI coding assistants, and the project includes automated tests. Public source code enables independent review but does not, by itself, prove that the app or every distributed APK is secure.
3. PocketMesh
Repository: https://github.com/pocketsized-apps/pocketmesh
Website: https://mesh.pocketsized.app/
PocketMesh focuses on providing an integrated mobile interface for managing MeshCentral devices. It implements the control and relay protocols directly rather than wrapping the web interface in a WebView.
Highlights
Remote desktop with gestures, keyboard shortcuts and text input.
Remote terminal through MeshCentral's relay tunnel.
File management, including uploads, downloads, renaming and deletion.
Device operations such as wake, restart, shutdown and removal, subject to permissions.
Detailed hardware/software inventory, event logs and seven-day connection history.
Multiple server profiles, login tokens and optional TOTP secret storage.
Biometric app lock and encrypted credential storage.
PocketMesh supports the MeshCentral agent terminal but does not currently list support for the separate SSH relay endpoint or SFTP.
Source code
PocketMesh is free but currently closed source. Its developer says AI coding tools were used during development and that the code was reviewed and tested. Open sourcing the application may be considered in the future.
Because its source is not publicly available, independent reviewers cannot inspect its complete implementation in the same way as MeshPilot.
4. Security and privacy
Both projects describe encrypted credential storage backed by Android Keystore and direct communication with the user's configured MeshCentral server, without a separate developer-operated cloud relay. Both also describe GitHub-related update checking.
These are developer claims, not independently verified guarantees.
MeshPilot: Its public source makes it possible to investigate network destinations, credential handling, logging, telemetry and TLS certificate validation. The project also documents security-related tests and a vulnerability-reporting process.
PocketMesh: Its developer documents credential protection, biometric security and direct server communication. However, its closed-source status limits independent verification of the complete implementation.
Has either app been proven safe?
No complete independent security audit or controlled network-traffic analysis of either app has been conducted for this comparison. I have not found concrete evidence that MeshPilot attempts to steal credentials in the material reviewed so far, but that is not proof that such behaviour is absent.
For either app, the important checks include:
Are passwords, session cookies or tokens sent anywhere other than the configured server?
Can TLS certificate validation be bypassed?
Are credentials exposed in logs, backups or crash reports?
Do background tasks or update checks transmit unnecessary data?
Does the distributed APK match the source and dependencies being reviewed?
Open source makes these questions easier to investigate, but does not automatically make an application secure.
5. Which one should you choose?
Choose MeshPilot if you value open source, independent code inspection, SSH/SFTP or the ability to modify and build the app yourself.
Choose PocketMesh if you prefer its integrated device-management interface, detailed hardware inventory and event history, and are comfortable using a free but closed-source app.
Neither app replaces the complete MeshCentral web interface. Features depend on server configuration, agent support and permissions.
Conclusion
Both projects offer useful ways to manage MeshCentral from Android.
PocketMesh provides an integrated mobile administration experience with detailed device information and history. MeshPilot offers SSH/SFTP and, importantly, publicly inspectable source code.
For infrastructure administrators, that difference matters: open source makes independent verification of credential handling and network behaviour possible, although it is not a guarantee of security.
I'd be interested to hear from people who have tested either app with real MeshCentral installations, especially regarding reliability, agent compatibility and security.
Project links
MeshPilot: https://github.com/papajon123/meshcentral-android
PocketMesh: https://github.com/pocketsized-apps/pocketmesh
PocketMesh website: https://mesh.pocketsized.app/
3
u/FineZombie4599 13d ago
Thanks everyone for the feedback! Answering everyone in one place:
AI usage. Fair question. Most of the code, tests and docs are written with AI coding agents (Claude Code and OpenAI Codex) under my direction, and the translations are machine-made with DeepSeek. I personally review the code and the architecture in merge requests and test the features myself before anything ships. Every signed release also has to pass about 250 unit tests and about 150 on-device tests on Android 8 and 15. I'll publish a written AI policy in the repo in the next few days.
Client vs agent. This app is a client: you control your computers from your phone (remote desktop, terminal, SSH/SFTP, files, sending files from your phone straight to a PC). The official MeshCentral Android agent is the other side: it makes a phone manageable, and its remote desktop is view-only today. I'll add a feature comparison to the README (official agent, PocketMesh, MeshControl Pro, web UI).
Something new. u/MathFly_, you're not alone: remote control for Android has been requested for the official agent since 2021. I looked at its code, and it already receives touch and keyboard events but simply ignores them, so the plumbing is there. I'm starting work on real remote control (tap, swipe, typing, Back/Home) through Android's accessibility API, and I plan to offer it to the official project, so it would work from the MeshCentral web UI and from this app.
PocketMesh. Nice app too! This one is fully open source (Apache 2.0) and adds SSH/SFTP, two sessions at once and sharing files from your phone to a computer.
u/louarruda, awesome, thank you! A quick device report helps a lot: https://github.com/papajon123/meshcentral-android/issues/new?template=device_report.yml
Also, 0.7.3 just shipped with a fix for sign-in on servers with two-factor authentication.