Open Cowork
A sandboxed desktop workspace for running multi-model AI tasks against files, documents, and desktop applications.
- Source repo
- OpenCoworkAI/open-cowork
- Stars
- ★ 2.3k
- Last updated
- 17d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 65/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformClaude Code · OpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- An operations specialist who needs a five-slide PowerPoint summary from financial_report.csv in a chosen folder can submit that request through the desktop chat.
- Not a fit if
- Linux desktop users: prebuilt installers cover only Windows and macOS
- Users wanting VM isolation without installing WSL2 or Lima
- Source review
- 65/100 · Some gaps
What does this agent do, and when should you use it?
Open Cowork is an open-source AI agent desktop application for Windows and macOS, available through prebuilt installers or from source. Its desktop interface combines an Electron main process, a React and Tailwind renderer, and IPC communication, with claude/agent-runner.ts handling agent execution. After a user selects a workspace and configures a model API, it can manage workspace files and use built-in Skills to generate or process PPTX, DOCX, XLSX, and PDF outputs. The project also documents MCP Connectors, GUI operation, remote control through Feishu (Lark) and Slack, and a Trace Panel for reasoning and tool execution. Its security model combines workspace path restrictions with optional WSL2 isolation on Windows and Lima isolation on macOS.
A user enters an API Key, Base URL, and model name in Settings, selects a permitted workspace, and submits a task in the desktop chat. claude/agent-runner.ts runs the agent; tools/tool-executor.ts handles tool calls; and sandbox/path-resolver.ts constrains file access, while config, session, memory, and db directories handle their respective application state. The app can read, write, and organize files in the workspace, then invoke the pptx, docx, pdf, xlsx, and skill-creator workflows under .claude/skills/ to produce office documents. MCP Connectors extend tasks to browsers, Notion, and custom apps, while TracePanel displays reasoning and tool activity. When available, WSL2 or Lima runs Bash commands in an isolated Linux VM.
- An operations specialist who needs a five-slide PowerPoint summary from financial_report.csv in a chosen folder can submit that request through the desktop chat.
- A Windows or macOS user who wants AI-assisted folder cleanup while limiting access to one workspace can use the path guard and optional VM isolation.
- A team member preparing Word, spreadsheet, PDF, or PowerPoint deliverables from local source material can use the bundled document Skills.
- A user with Anthropic, OpenRouter, GLM, MiniMax, or Kimi access can configure the relevant API Key, Base URL, and model to run desktop tasks.
- Someone whose local workflow must work with a browser, Notion, or another supported desktop service can configure MCP Connectors.
- A collaboration team receiving remote requests through Feishu (Lark) or Slack can use the documented remote-control integrations.
How do you install or deploy this agent?
On macOS, run:
brew tap OpenCoworkAI/tap
brew install --cask --no-quarantine open-coworkWindows and Apple Silicon macOS installers are also available as .exe and .dmg files from Releases. To build from source, use Node.js 18+:
git clone https://github.com/OpenCoworkAI/open-cowork.git
cd open-cowork
npm install
npm run rebuild
npm run devRun npm run build to build an installer locally.
How do you use this agent?
Open the app, select Settings in the lower-left corner, and enter the API Key, Base URL, and model name for your provider. The documentation lists Anthropic, OpenRouter, GLM, MiniMax, and Kimi; OpenRouter uses https://openrouter.ai/api as its Base URL. Select a workspace, then enter a task such as “Read the financial_report.csv in this folder and create a PowerPoint summary with 5 slides.” For stronger command isolation, install WSL2 on Windows or run brew install lima on macOS; the app detects an available VM and uses it.
What are this agent's strengths and limitations?
- Offers prebuilt installers for Windows and macOS while retaining a documented source-build path.
- Supports Anthropic, OpenAI-compatible APIs, and documented GLM, MiniMax, and Kimi configurations instead of requiring one model provider.
- Combines workspace path restrictions with WSL2 or Lima VM execution for layered command isolation.
- Bundles Skills for PPTX, DOCX, XLSX, and PDF work and supports creating or deleting custom Skills.
- Documents MCP Connectors, GUI operation, and Feishu (Lark) and Slack integrations for workflows beyond local files.
- Prebuilt installers are documented only for Windows and Apple Silicon macOS; Linux users must build from source.
- Users must supply their own model-provider API key and pay the selected provider's API charges.
- VM isolation depends on WSL2 or Lima being installed; without either, the app falls back to native command execution with path-based restrictions.
- The documentation warns that authorized file modifications and deletions can still carry risk.
- The Notion connector requires both an integration token and connections added on a root page.
How does this agent compare with similar options?
The README's feature table compares Open Cowork with Claude Cowork and OpenClaw: all three are marked for MCP and Skills; Open Cowork and OpenClaw are marked for remote control; and only Open Cowork is marked for GUI operation. The project describes itself as an open-source implementation of Claude Cowork and highlights multi-model support, remote control, and VM isolation.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Open Cowork This agent | 65 · Some gaps | Desktop appFree + model costs | ★ 2.3k | 17d ago | TypeScript | Claude Code · OpenAI API · Claude API |
| Abu Desktop Assistant | 61 · Some gaps | Desktop appFree + model costs | ★ 419 | 5d ago | TypeScript | OpenAI API · Claude API |
| Skales | 36 · Major gaps | Desktop appFreemium | ★ 2.2k | 3d ago | — | ChatGPT · OpenAI API · Claude API |
| TuriX | 34 · Major gaps | CLIFree + model costs | ★ 3.2k | 1mo ago | Python | Claude.ai |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: README explicitly mentions sandbox isolation (WSL2/Lima) and path guarding, restricting file operations to workspace, reflecting least privilege. User confirmation: user selects workspace and authorizes, PermissionDialog component exists. Data flow transparency: README states data only sent to configured AI API, not to Open Cowork servers. Sensitive data handling: SECURITY.md recommends storing API keys in credential store, avoiding plaintext. Dependency security: CI includes npm audit, package.json has overrides for known vulnerabilities. External effects: sandbox and path guarding limit external impact. Rollback: not explicitly mentioned, but session management and database may support, insufficient evidence. Source attribution: README and LICENSE clearly attribute copyright. Deductions: rollback evidence insufficient, dependency security relies on audit and overrides, not deep analysis.
Evidence shows: test files cover agent-runner history rebuild and compaction, indicating internal consistency. Dependency availability: package.json lists dependencies, CI installs them, but availability not verified. Failure messages: tests handle error cases like tool_result error marking, but not comprehensive. Deductions: dependency availability not actually verified, failure message coverage limited.
Evidence shows: README clearly defines target users (no programming knowledge) and scenarios (file management, PPT generation). Capability boundaries: README describes supported features and limitations (e.g., Linux only source compile). Trigger precision: user triggers via instructions, clear skills and MCP integration. Environment fit: supports Windows/macOS, sandbox configuration explained. Deductions: capability boundaries not detailed enough, trigger precision relies on user instructions, no explicit automation triggers.
Evidence shows: README well-structured with TOC and architecture diagram. Install notes detailed, including Homebrew and source compile. Naming stability: package name and version clear. Examples and FAQ: README has demo videos and FAQ. Known limitations: README mentions Linux support limited, sandbox fallback mode. License: MIT license file complete. Versioning changelog: package.json has version, but no CHANGELOG. Maintenance responsibility: SECURITY.md and contribution guide clarify. Deductions: missing CHANGELOG, version change records insufficient.
Evidence shows: output usability: README describes generated document types (PPTX etc.), tests verify serialization output. Marginal value: adds multi-model and remote control compared to Claude Cowork, differentiated. Cost benefit: open-source free, users only pay API fees. Deductions: output usability not actually tested, marginal value based on README claims, not independently verified.
Evidence shows: README feature claims have test support (e.g., history rebuild tests). Cross-source corroboration: README consistent with package.json and test files. Fact-inference separation: README clearly distinguishes feature claims and roadmap. Deductions: some claims (e.g., sandbox isolation) not directly verified in tests, rely on README description.
- Sandbox isolation and path guarding implementation not detailed in provided files; further code review needed.
- Dependency security relies on npm audit and overrides; no vulnerability details or mitigations provided.
- Rollback mechanism not explicit; user actions may not be reversible, caution advised.
- Remote control (Feishu/Slack) may introduce external attack surface; ensure secure configuration.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
First patch release after v3.3.0 stable. Ships 10 PRs over 35 days, focused on security hardening and provider / installer reliability. Features - feat(permissions): gate local-agent tool calls through PermissionDialog 🔒 - PR: #165 - feat(loop-guard): tool-call loop detection (PR #175 maintainer rescue) - PR: #225 Bug Fixes - fix(security): close path traversal bypass in Lima/WSL sandbox 🔒 - PR: #136 - fix(agent-runner): preserve thinking blocks when rebuilding cold-start history - PR: #224 - fix: preserve DeepSeek V4 thinking replay - PR: #186 …View on GitHub ↗ -
Release notes excerpt
Open Cowork v3.3.0 — First Stable Release 🎉 The first stable release of the 3.3.x series, graduating from 9 beta iterations. This release brings security hardening, improved multi-model support, remote control enhancements, and a fully automated PR review pipeline. Highlights - Stable & Verified: All builds pass launch-level smoke tests on both platforms — the app starts and loads correctly before publishing - Security Hardened: Zip-slip and path traversal protections, model probe error handling improvements …View on GitHub ↗ -
Release notes excerpt
What's New in v3.3.0-beta.8 Build Reliability Overhaul This release introduces a three-layer defense system to ensure packaged builds work correctly after installation: Pre-build verification — A new check runs before electron-builder to validate that all required resources (MCP servers, Node.js binaries, sandbox agents) exist. Missing resources now fail the build immediately instead of silently producing broken packages. …View on GitHub ↗