pymobiledevice3 remote

Create and browse RemoteXPC tunnels (RSD/tunneld) for developer services.

tunneld

Start Tunneld service for remote tunneling

pymobiledevice3 remote tunneld [OPTIONS]

Options:

Option	Description
--host <str>	Address to bind the tunneld server to. [default: 127.0.0.1]
--port <int>	Port to bind the tunneld server to. [default: 49151]
--upstream <str>	URL of another tunneld to federate (repeatable). Its devices appear in this instance's listing, and connections to them are relayed through it, so clients need a route to this tunneld only.
-d, --daemonize	Run tunneld in the background.
-p, --protocol <tcp\|quic>	Transport protocol for tunneld (default: TCP on Python >=3.13, otherwise QUIC). [default: quic]
--usb / --no-usb	Enable USB monitoring [default: usb]
--wifi / --no-wifi	Enable WiFi monitoring [default: wifi]
--usbmux-address <str>	Address of the usbmuxd daemon (unix socket path or HOST:PORT). Defaults to the platform usbmuxd if omitted. [env var: PYMOBILEDEVICE3_USBMUX, USBMUXD_SOCKET_ADDRESS]

Accepts the connection options: --usbmux, --mobdev2.

browse

browse RemoteXPC devices (remotepairingd on macOS by default, bonjour elsewhere)

pymobiledevice3 remote browse [OPTIONS]

Options:

Option	Description
--timeout <float>	Browse timeout (in seconds) [default: 3]
--native / --no-native	Browse via Apple's remotepairingd (the remoted tunnel daemon) instead of bonjour; no root, macOS only, and the default there. --no-native forces the bonjour browse.

rsd-info

show info extracted from RSD peer

pymobiledevice3 remote rsd-info [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode, and remoted is left running (so it coexists with Xcode/devicectl). Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

auxiliary-metadata

show device auxiliary metadata (decoded deviceKVSData), keyed by preference domain

e.g. com.apple.WebInspector.EnableRemoteInspection (Web Inspector on/off). Reliably populated on the macOS --native transport; empty or partial on others (see the network-stacks guide).

pymobiledevice3 remote auxiliary-metadata [OPTIONS]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode, and remoted is left running (so it coexists with Xcode/devicectl). Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.

start-tunnel

start tunnel (Apple's native tunnel on macOS by default — no root; classic tunnel elsewhere)

pymobiledevice3 remote start-tunnel [OPTIONS]

Options:

Option	Description
-t, --connection-type <usb\|wifi>	Connection interface to tunnel (USB, WiFi, etc.). [default: usb]
--secrets <path>	File to write TLS secrets for Wireshark decryption.
--script-mode / --no-script-mode	Print only HOST and port for scripts instead of formatted output. [default: no-script-mode]
--max-idle-timeout <float>	Maximum idle time before QUIC keepalive pings are sent. [default: (30.0)]
-p, --protocol <tcp\|quic>	Transport protocol for the tunnel. [default: (TCP on Python >=3.13, otherwise QUIC)]
--native / --no-native	Piggyback Apple's remoted tunnel via remotepairingd and publish its RSD address instead of creating a new tunnel; no root, macOS only, and the default there. --no-native forces the classic (root) tunnel, as does passing any of the classic-tunnel options.

Accepts the connection options: --udid.

pair

start remote pairing for devices which allow

pymobiledevice3 remote pair [OPTIONS]

Options:

Option	Description
--name <str>	Device name for a specific device to look for

pair-host

Advertise as a pairable host and accept a device-initiated pairing (iOS 27+).

The device does not browse for pairable hosts automatically. On the device, enable Developer Mode and open Settings > Developer > Paired Macs; this host then appears under "Other Devices". Tap it and enter the 6-digit code printed here. The resulting pairing record is reused by remote start-tunnel afterwards.

pymobiledevice3 remote pair-host [OPTIONS]

Options:

Option	Description
--name <str>	Name shown on the device (defaults to this machine's hostname)
--model <str>	Hardware model identifier shown on the device [default: Mac17,7]
--port <int>	TCP port to listen on (0 = pick a free port) [default: 0]
--timeout <float>	Give up after this many seconds if no device starts pairing

delete-pair

Delete a pairing record

pymobiledevice3 remote delete-pair [OPTIONS] {udid}

Arguments:

Argument	Description
udid	[required]

service

Start an ipython shell for interacting with given service

pymobiledevice3 remote service [OPTIONS] {service_name}

Arguments:

Argument	Description
service_name	[required]

Options:

Option	Description
--native	macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode, and remoted is left running (so it coexists with Xcode/devicectl). Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]

Accepts the connection options: --rsd, --tunnel, --userspace.