OpenBot: AI Coworkers You Can Trust with Real Work
Each AI coworker gets its own computer (browser, files, tools) and every action is decided before it happens and recorded after.
Evidence shows clear least-privilege design: CI workflows default to read-only permissions, agent-computer binds to loopback, requires token, supports gVisor sandbox. User confirmation exists: when control is taken, Bot actions are refused, requiring human confirmation. Data flow transparency: audit log records all actions, including refusals and failures. Sensitive data handling: credentials encrypted at rest, not in transcript, redacted in audit. Dependency security: zizmor security check exists, but no dependency vulnerability scan results provided. External effects: policy controls browser, file, MCP actions, but no rollback mechanism provided. Rollback: not mentioned. Source attribution: no clear source attribution mechanism.
Self-consistency: documentation and code consistent, architecture description clear. Dependency availability: depends on external services like CopilotKit Intelligence, but no offline or degradation plan. Failure messages: clear error handling, e.g., refusals name the rule, but no user-visible failure message examples.
Audience and scenarios: developer-oriented, multiple deployment options. Capability boundaries: clearly defined via policy and permissions. Trigger precision: precise control via CEL policy. Environment fit: supports multiple identity providers and deployment environments.
Information architecture: clear documentation structure, architecture diagram. Install notes: quick start and deployment guide provided. Naming stability: version number exists, but no naming convention. Examples and FAQ: examples provided, but no FAQ. Known limitations: explicitly marked Alpha. License: MIT. Versioning changelog: CHANGELOG.md exists. Maintenance responsibility: maintainer not clearly identified.
Output usability: components and audit log provided. Marginal value: unique features like computer isolation. Cost benefit: requires multiple external services, high cost.
Claim traceability: claims in documentation supported by code and tests. Cross-source corroboration: no external verification. Fact-inference separation: documentation distinguishes facts and inferences.
- Alpha status, potential undiscovered bugs and security issues.
- Dependency on external service (CopilotKit Intelligence) may affect availability and cost.
- No rollback mechanism provided, recovery after failed operations may be difficult.
- Publisher identity unverified, evaluate with caution.
What does this agent do, and when should you use it?
OpenBot is an open-source AI agent platform that lets you hand real work to AI coworkers while maintaining strict control and auditability. Each agent is given its own containerized environment with a separate Chromium browser, workspace, and files. All actions go through a single gateway that decides each action based on policy and records an audit log before execution. The platform is built on the AG-UI protocol, so you can bring any AG-UI agent (e.g., LangGraph, Mastra, CrewAI, etc.) and govern them uniformly. OpenBot runs inside your own infrastructure via Docker Compose, with data stored in your PostgreSQL, and the model is yours to choose (no built-in model). It includes features like browser automation, file operations, MCP integration, component-based responses, skills, and granular access control. The project is in alpha and actively developed.
OpenBot works by having you talk to the server, which sends the turn to an AG-UI agent (Bot). All tool calls made by the Bot (e.g., browser navigation, file operations, shell commands) go through a gateway that resolves the target, evaluates CEL policy, writes an audit row, and then only acts or refuses. If refused, the rule name is returned. Each Bot is managed by the supervisor service and gets its own container, workspace, and browser profile. You can create coworkers from the /agents page, specifying name, title, role, optional AG-UI endpoint, and visibility. You can view audit logs at /admin/audit, configure policies at /admin/boundaries, and manage Bot computers at /admin/computers.
- A financial risk team uses the built-in Risk Analyst coworker to automate risk assessments while ensuring all actions comply with internal policy and are auditable.
- A company wants to automate browser-based workflows (e.g., form filling, website navigation) with an AI agent, but requires a full audit trail and policy enforcement.
- An organization deploys a Knowledge coworker to answer employee questions about company policies and data, with access controlled by a governance policy.
- A developer wants to integrate an existing AG-UI agent (e.g., built with LangGraph or Pydantic AI) into a governed, containerized environment with minimal code changes.
- An admin needs to grant different AI agents varied permissions, such as blocking certain websites or restricting specific shell commands, while keeping a record of all attempts.
What are this agent's strengths and limitations?
- Each agent has its own containerized environment with dedicated browser and workspace, providing strong isolation.
- Unified gateway enforces policy and audit logging: every action is decided and recorded before execution, ensuring traceability.
- AG-UI protocol allows integration with multiple agent frameworks (LangGraph, Mastra, etc.), avoiding framework lock-in.
- MCP support with built-in Google Drive and Notion connectors, plus the ability to add custom MCP servers.
- Flexible deployment: Docker Compose or a single Docker image with embedded PostgreSQL option.
- Alpha stage; may have rough edges and bugs, not yet suitable for production-critical workloads.
- Depends on CopilotKit Intelligence service, which requires a project license; although self-hosting is possible, it is not fully standalone.
- Setting up real user sign-in requires configuring multiple environment variables and OAuth clients, which adds initial complexity.
- Model and API keys must be provided by the administrator; there is no built-in model, requiring external API keys or costs.
- Documentation does not explicitly list all supported platforms, so some environments may have issues.
How do you install or deploy this agent?
Prerequisites: Docker, Bun 1.3+, a CopilotKit Intelligence project and license (free plan available), and a model API key (e.g., OpenAI). Steps: 1) Copy .env.example to .env; 2) Run 'npx --yes copilotkit@latest login', 'project select', and 'license --write' to get Intelligence credentials; put the 'cpk-...' key from 'project select' as INTELLIGENCE_API_KEY in .env (the license command writes COPILOTKIT_LICENSE_TOKEN automatically); 3) Fill in other required values like OPENAI_API_KEY; 4) Run 'bun install' and 'bash scripts/start.sh'; 5) Open http://localhost:3010.
How do you use this agent?
After installation, access the UI at http://localhost:3010. With the default OPENBOT_SINGLE_USER=true, every request is admitted as an administrator. You can create new coworkers from /agents, or use the built-in ones (General Assistant, Knowledge, Risk Analyst). Chat directly at /bot, or start a channel with a coworker at /channel. Configure policies at /admin/boundaries, review audit logs at /admin/audit, and manage encrypted credentials at /admin/credentials. For production, set up an identity provider (Google, Microsoft, Okta, etc.) and specify INITIAL_ADMIN_EMAILS to grant admin roles.