scrcpy shows your Android phone's screen in a window on Linux, Windows or macOS and lets you use it with the computer's keyboard and mouse. It connects over USB or over Wi-Fi (TCP/IP), needs no root and no app installed on the phone, and leaves nothing behind when you disconnect. Latency is around 35 to 70 ms and the first frame appears in about a second, so it is quick enough to type, play and demo in real time.
Mirroring is only the start. It forwards audio on Android 11 and later, records to a file, copies and pastes in both directions, can mirror the phone's camera instead of its screen, opens apps in a separate virtual display, and on Linux can expose the phone camera as a webcam. There is no account, no ads and no internet connection involved.
It is made by Genymobile, Apache-2.0, with about 153,000 stars and v5.0.1 at scan time. The limits are small: USB debugging has to be switched on, some phones (Xiaomi in particular) need an extra security option before they accept keyboard and mouse input, and Linux distribution packages tend to be out of date.
- Repository: github.com/Genymobile/scrcpy
- Licence: Apache-2.0 (Apache License 2.0)
- Language: C. Stars: 153.2K. Forks: 14K. Last push: Oct 24, 2026.
- Scan: safe, Oct 26, 2026, commit a60891a
Who it is for
Developers testing Android apps, anyone who would rather answer messages with a real keyboard, and people presenting or recording a phone screen without a capture card.
Getting started
1. macOS (Homebrew; it also needs adb: brew install --cask android-platform-tools)
brew install scrcpy2. Windows (winget; Chocolatey and Scoop also work)
winget install --exact Genymobile.scrcpy3. With USB debugging on and the phone plugged in, start mirroring
scrcpyOn Linux the project recommends building the latest release with its install_release.sh script rather than the outdated apt or snap packages; the script asks for sudo for the final install step. The README warns that the GitHub repository is the only official source, so do not download builds from other sites that use the name.
Safety scan
We cloned Genymobile/scrcpy at commit a60891a on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no bare-IP URLs across about 54,000 lines of C and Java.
- install_release.sh, the 22-line Linux install route, downloads the prebuilt phone-side server from the project's own GitHub release, checks its SHA-256 before use, builds the client and runs sudo ninja install to copy it into system folders. That is the only use of sudo.
- One committed binary: gradle/wrapper/gradle-wrapper.jar, the standard Gradle wrapper for building the Android server component.
- No lockfiles, so the advisory check had nothing to query. The client relies on FFmpeg, SDL and libusb, which come from your package manager or are bundled in the Windows release.
- One workflow, no pull_request_target; its single third-party action is not pinned to a commit. Licence present; no security policy, contributing guide or Dependabot. OpenSSF Scorecard 4.1 of 10, lost on process items such as code review and branch protection rather than anything in the code.
- scrcpy works through adb, so the phone's USB debugging prompt is the real permission. Only accept it on computers you trust, and revoke USB debugging authorisations in developer options after using a shared machine.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script (one can call sudo) |
| Committed binaries | 1 executable or compiled object committed; listed under the raw findings. |
| CI workflows | 1 workflow. None use pull_request_target. 1 of 1 third-party action pinned to a tag rather than a commit. |
| Network hosts | 20 distinct hosts referenced from source; most often github.com, android.googlesource.com, www.usb.org, source.android.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has licence file. Missing security policy, automated dependency updates, CodeQL, contributing guide. |
| OpenSSF Scorecard | 4.1 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- install_release.sh, 22 lines, uses sudo; talks to github.com
Committed binaries (1)
gradle/wrapper/gradle-wrapper.jar: JAR, 59 KB
By the numbers
| Stars | 153.2K |
|---|---|
| Forks | 14K |
| Contributors | 187 |
| Commits | 3,210 |
| Open issues | 2,831 |
| Open pull requests | 108 |
| Releases | 54 |
| Latest release | v5.0.1 |
| Licence | Apache-2.0 |
| Main language | C |
| Project age | 8 years |
| Last push | Oct 24, 2026 |
| Tracked files | 387 |
| Lines of code | 54.2K |
| Checkout size | 2 MB |
Lines by language: C 26.9K, Java 13.3K, C/C++ header 8,354, Markdown 3,942, Shell 1,013, YAML 651.
Questions
Is scrcpy free?
Yes. scrcpy is free and open source under Apache-2.0, with no ads, no account and no paid tier. Get it from the GitHub repository or a package manager; the README warns against downloading it from other websites.
Does scrcpy need root or an app on the phone?
No. It needs Android 5.0 or later with USB debugging enabled, but no root and no app. A small server is pushed to the phone over adb while scrcpy runs, and nothing is left installed afterwards. Audio forwarding needs Android 11 or later.
Can scrcpy work wirelessly?
Yes. As well as USB it can connect over TCP/IP when the phone and computer are on the same network; the connection guide in the repository (doc/connection.md) covers the steps.
Does scrcpy work with iPhones?
No. It is built on Android's debugging bridge (adb), so it only works with Android devices.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.