Tag: Mika

A Trust Audit of a Phone Agent: The Static Review of Mika, the Honest Stratification of Permissions, and the Demolition of the Writing-It-Yourself Myth

A full static review of the open-source phone agent Mika (wangzan101/Mika, 2.5k stars, Kotlin+Compose): cloned and executed zero code, passed through five dimensions — permissions, network egress, prebuilt binaries, dependency sources, exposure surface — with no telemetry, official-only dependencies, MCP bound to loopback behind Bearer auth and rate limiting, and Keystore-encrypted credentials; the verdict is no malicious behavior, with the risk living in the product essence (accessibility equals whole-phone visibility); the version matrix (Android 12 threshold, 14 ideal, arm64 mandatory), the tiered trial plan and the cleanliness of uninstall were all settled alongside; and the soul question — would building our own be safer — received a three-layer answer: from-scratch is likely less safe (security engineering is precisely where mistakes live), forking-and-tightening is viable but heavy, and the shrunken build (no phone operation) is the only genuinely safer road.