OpenBot: AI Coworkers You Can Trust with Real Work
Each AI coworker gets its own computer (browser, files, tools) and every action is decided before it happens and recorded after.
- Source repo
- CopilotKit/OpenBot
- Stars
- ★ 6.7k
- Last updated
- 2d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 57/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A financial risk team uses the built-in Risk Analyst coworker to automate risk assessments while ensuring all actions comply with internal policy and are auditable.
- Not a fit if
- Teams needing production-ready software: the project is alpha with rough edges and bugs.
- Teams wanting a fully standalone self-host: it requires a CopilotKit Intelligence project and license.
- Teams unwilling to supply their own model keys: no model ships in the box.
- Source review
- 57/100 · Major gaps
What does this agent do, and when should you use it?
OpenBot is an open-source AI agent platform that lets you hand real work to AI coworkers while maintaining strict control and auditability. Each agent is given its own containerized environment with a separate Chromium browser, workspace, and files. All actions go through a single gateway that decides each action based on policy and records an audit log before execution. The platform is built on the AG-UI protocol, so you can bring any AG-UI agent (e.g., LangGraph, Mastra, CrewAI, etc.) and govern them uniformly. OpenBot runs inside your own infrastructure via Docker Compose, with data stored in your PostgreSQL, and the model is yours to choose (no built-in model). It includes features like browser automation, file operations, MCP integration, component-based responses, skills, and granular access control. The project is in alpha and actively developed.
OpenBot works by having you talk to the server, which sends the turn to an AG-UI agent (Bot). All tool calls made by the Bot (e.g., browser navigation, file operations, shell commands) go through a gateway that resolves the target, evaluates CEL policy, writes an audit row, and then only acts or refuses. If refused, the rule name is returned. Each Bot is managed by the supervisor service and gets its own container, workspace, and browser profile. You can create coworkers from the /agents page, specifying name, title, role, optional AG-UI endpoint, and visibility. You can view audit logs at /admin/audit, configure policies at /admin/boundaries, and manage Bot computers at /admin/computers.
- A financial risk team uses the built-in Risk Analyst coworker to automate risk assessments while ensuring all actions comply with internal policy and are auditable.
- A company wants to automate browser-based workflows (e.g., form filling, website navigation) with an AI agent, but requires a full audit trail and policy enforcement.
- An organization deploys a Knowledge coworker to answer employee questions about company policies and data, with access controlled by a governance policy.
- A developer wants to integrate an existing AG-UI agent (e.g., built with LangGraph or Pydantic AI) into a governed, containerized environment with minimal code changes.
- An admin needs to grant different AI agents varied permissions, such as blocking certain websites or restricting specific shell commands, while keeping a record of all attempts.
How do you install or deploy this agent?
Prerequisites: Docker, Bun 1.3+, a CopilotKit Intelligence project and license (free plan available), and a model API key (e.g., OpenAI). Steps: 1) Copy .env.example to .env; 2) Run 'npx --yes copilotkit@latest login', 'project select', and 'license --write' to get Intelligence credentials; put the 'cpk-...' key from 'project select' as INTELLIGENCE_API_KEY in .env (the license command writes COPILOTKIT_LICENSE_TOKEN automatically); 3) Fill in other required values like OPENAI_API_KEY; 4) Run 'bun install' and 'bash scripts/start.sh'; 5) Open http://localhost:3010.
How do you use this agent?
After installation, access the UI at http://localhost:3010. With the default OPENBOT_SINGLE_USER=true, every request is admitted as an administrator. You can create new coworkers from /agents, or use the built-in ones (General Assistant, Knowledge, Risk Analyst). Chat directly at /bot, or start a channel with a coworker at /channel. Configure policies at /admin/boundaries, review audit logs at /admin/audit, and manage encrypted credentials at /admin/credentials. For production, set up an identity provider (Google, Microsoft, Okta, etc.) and specify INITIAL_ADMIN_EMAILS to grant admin roles.
What are this agent's strengths and limitations?
- Each agent has its own containerized environment with dedicated browser and workspace, providing strong isolation.
- Unified gateway enforces policy and audit logging: every action is decided and recorded before execution, ensuring traceability.
- AG-UI protocol allows integration with multiple agent frameworks (LangGraph, Mastra, etc.), avoiding framework lock-in.
- MCP support with built-in Google Drive and Notion connectors, plus the ability to add custom MCP servers.
- Flexible deployment: Docker Compose or a single Docker image with embedded PostgreSQL option.
- Alpha stage; may have rough edges and bugs, not yet suitable for production-critical workloads.
- Depends on CopilotKit Intelligence service, which requires a project license; although self-hosting is possible, it is not fully standalone.
- Setting up real user sign-in requires configuring multiple environment variables and OAuth clients, which adds initial complexity.
- Model and API keys must be provided by the administrator; there is no built-in model, requiring external API keys or costs.
- Documentation does not explicitly list all supported platforms, so some environments may have issues.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| OpenBot: AI Coworkers You Can Trust with Real Work This agent | 57 · Major gaps | Self-hosted serviceFree + model costs | ★ 6.7k | 2d ago | TypeScript | — |
| Auto Browser | 62 · Some gaps | Self-hosted serviceFree + model costs | ★ 908 | today | Python | OpenAI API · Claude API |
| SandBase Harness | 52 · Major gaps | CLIFree + model costs | ★ 639 | 7d ago | TypeScript | OpenAI API · Claude API |
| Kontext | 83 · Good | CLIFreemium | ★ 225 | 4d ago | Go | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows clear least-privilege design: CI workflows default to read-only permissions, agent-computer binds to loopback, requires token, supports gVisor sandbox. User confirmation exists: when control is taken, Bot actions are refused, requiring human confirmation. Data flow transparency: audit log records all actions, including refusals and failures. Sensitive data handling: credentials encrypted at rest, not in transcript, redacted in audit. Dependency security: zizmor security check exists, but no dependency vulnerability scan results provided. External effects: policy controls browser, file, MCP actions, but no rollback mechanism provided. Rollback: not mentioned. Source attribution: no clear source attribution mechanism.
Self-consistency: documentation and code consistent, architecture description clear. Dependency availability: depends on external services like CopilotKit Intelligence, but no offline or degradation plan. Failure messages: clear error handling, e.g., refusals name the rule, but no user-visible failure message examples.
Audience and scenarios: developer-oriented, multiple deployment options. Capability boundaries: clearly defined via policy and permissions. Trigger precision: precise control via CEL policy. Environment fit: supports multiple identity providers and deployment environments.
Information architecture: clear documentation structure, architecture diagram. Install notes: quick start and deployment guide provided. Naming stability: version number exists, but no naming convention. Examples and FAQ: examples provided, but no FAQ. Known limitations: explicitly marked Alpha. License: MIT. Versioning changelog: CHANGELOG.md exists. Maintenance responsibility: maintainer not clearly identified.
Output usability: components and audit log provided. Marginal value: unique features like computer isolation. Cost benefit: requires multiple external services, high cost.
Claim traceability: claims in documentation supported by code and tests. Cross-source corroboration: no external verification. Fact-inference separation: documentation distinguishes facts and inferences.
- Alpha status, potential undiscovered bugs and security issues.
- Dependency on external service (CopilotKit Intelligence) may affect availability and cost.
- No rollback mechanism provided, recovery after failed operations may be difficult.
- Publisher identity unverified, evaluate with caution.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Before upgrading. Two things change for an existing deployment: - Migration 0052_shared_brokered_accounts copies every Composio connection into a new brokered_connections table and leaves composio_connections in place, unwritten. Rolling back to 0.1.2 works, but accounts connected after the upgrade are invisible to it. - A handoff now records what started the run it came from. Older remote Bots' signed runs carry no such record for up to ten minutes after the upgrade, and calls they make to a Shared app in that window are refused. …View on GitHub ↗ -
Release notes excerpt
CopilotKit 1.77 and AG-UI 1.0 OpenBot now runs on CopilotKit 1.77.0 (@copilotkit/runtime, react-core and a2ui-renderer, from 1.73.1), which carries the Intelligence client, and on AG-UI 1.0 (@ag-ui/core and @ag-ui/client 1.0.1, from 0.0.59). A managed Intelligence project needs nothing changed; it is the client in the server that moved. Among what comes with it: thread naming falls back to the first message, the realtime connection keeps its place across a repeated checkpoint, an interrupt resume …View on GitHub ↗ -
Release notes excerpt
- A password given to curl as -uuser:password, --user=user:password or -u "user:pass word" is now redacted in a Bot's recorded shell command. Only -u user:password with a space and no quotes was recognised, so the other spellings kept the password in the command that was stored or exported. - A password, token or API key sent as a JSON field in a shell command is now redacted before the command is kept or exported. curl -d '{"password":"x"}' was recorded with the secret in clear, because only NAME=value and --name value forms were recognised and a quoted JSON key was …View on GitHub ↗