TL;DR
OpenBot is CopilotKit’s MIT-licensed answer to the “AI coworker” products: a self-hosted platform where every agent gets its own computer — a Chromium container with its own logins, a /workspace volume, and a shell — and where every browser, file, shell, and MCP action passes through one gateway that decides against a policy and writes an audit row before anything happens. Launched August 19, 2026, it hit 5,107 stars in a month and ships a release every few days. Key facts as of September 18, 2026:
- Any AG-UI agent is a Bot: LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK, or a hand-written endpoint — governance rides the protocol, not the framework
- CEL policy engine, fail closed: rules inspect
page.host,command,file.path,mcp.tool,initiator.kind; deny runs before allow, a missing policy permits nothing, a broken rule refuses - “Take the wheel”: a human grabs a Bot’s browser mid-task (2FA, login walls) and hands it back; every handover is audited
- Since v0.0.5: Google Drive + Notion connectors, bot-to-bot handoff, scheduled routines, smart message routing, SSO (Google/Microsoft/Okta/SAML/OIDC), a Helm chart; v0.0.12 (Sep 15) adds Composio for a few hundred SaaS apps
- Caveats up front: it’s alpha, it’s a template to clone (no npm package, no hosted version), and durable threads/memory depend on CopilotKit Intelligence — free plan, self-hostable, but required
If you want the Grok Bot / Claude Cowork experience without handing a vendor your team’s browser sessions, OpenBot is the most complete open-source attempt so far — provided you’re comfortable running an alpha.
Quick Reference
| Repo | github.com/CopilotKit/OpenBot |
| Stars | 5,107, 649 forks, 17 open issues (repo created August 17, 2026) |
| Version | v0.0.12 (September 15, 2026) — five releases in the preceding nine days |
| License | MIT |
| Stack | Bun 1.3+, Hono API, React/Vite app, PostgreSQL + pgvector, Docker per-Bot computers, TypeScript |
| Protocol | AG-UI (CopilotKit’s open agent↔user protocol) |
| Models | Bring your own: OpenAI, Anthropic, or Google keys; *_BASE_URL for proxies and local gateways |
| Deploy | scripts/start.sh locally, one ghcr.io/copilotkit/openbot image, or the Helm chart |
| Status | Alpha, “a template, not a product” |
Why OpenBot Is Trending Now
CopilotKit CEO Atai Barkai announced OpenBot on August 19 as “an open source Grok Bot that works with ANY agent harness, designed for real companies,” and within days it was the go-to link in r/AI_Agents and r/cursor threads complaining about Grok Bot’s price and lock-in — “free & self-hostable… you can plug in whatever harness you want (hermes, langgraph, your own),” as one commenter put it. Trendshift ranked it the #3 repository of the day; it crossed 3,500 stars by September 1.
The deeper reason it stuck is that hosted “AI coworker” products share one enterprise blocker: a security team cannot say where the browser session went, what the agent clicked, or which rule would have stopped it. CopilotKit’s landing page makes exactly that pitch — “the reason most AI pilots stall is not the model. It is that nobody can say where the data went.” OpenBot is built audit-trail-first and chat-UI-second, and that ordering separates it from the dozens of browser-agent repos we’ve reviewed. CopilotKit also authors the AG-UI protocol, so OpenBot is effectively its reference deployment.
How It Actually Works
The architecture is a hub with one door. You talk to the server (Hono, port 3001), which sends the turn to a Bot over AG-UI. Every tool call the Bot wants — click a button, save a file, run a command, call an MCP tool, render a component — comes back through the server’s gateway, which:
- resolves the target from a server-held page snapshot (the Bot can’t invent an element reference);
- evaluates the current action policy;
- writes an audit row for the decision;
- only then calls the Bot’s computer, a container with its own Chromium, browser profile, and
/workspacevolume created by the supervisor; - writes a second row if the forwarded action fails.
Three things fall out of that. There’s no path that acts without a record existing first. The Bot framework is irrelevant to governance — a LangGraph agent gets the same gate as a 40-line hand-written AG-UI endpoint. And because a Bot has a real shell, PostgreSQL sits on a separate Docker network that only the server and migrations can reach, so a Bot talked into running psql finds nothing to connect to.
The shipped example package (examples/fintech/) defines coworkers as YAML rather than code:
agents:
- id: general-assistant
name: General Assistant
title: Everyday Work
type: built-in
system_prompt: You are a helpful general assistant. Give clear, concise, and accurate answers.
skills:
- bot-creator # lets this Bot create other coworkers in conversation
- skill-creator # lets it interview you and save a new skill
- id: knowledge
name: Knowledge
title: Company Knowledge
type: built-in
system_prompt: >-
Answer from the sources you can reach with the tools you have been given, and cite what you
used. If you have no tool for a source, or a tool tells you it is not connected, say that plainly.
skills:
- find-a-document
- check-a-claimA detail worth copying even if you never run OpenBot: skills are instructions, not capabilities. Listing find-a-document on the Knowledge Bot loads nothing until an admin connects Google Drive and grants those tools. The tool set offered on every run is the intersection of the skill’s tool list and the Bot’s grants — which is also how v0.0.5’s “smarter tool use” works: a Bot with fifty connected tools is only offered the handful relevant to the message.
Installation: Three Keys and One Script
.env.example has ten blank keys; only three are yours to fill. start.sh generates the rest.
git clone https://github.com/CopilotKit/OpenBot.git && cd OpenBot
cp .env.example .env
# 1. CopilotKit Intelligence (durable threads + memory; free plan)
npx --yes copilotkit@latest login
npx --yes copilotkit@latest project select # → paste the cpk-... key as INTELLIGENCE_API_KEY
# 2. A model key: OPENAI_API_KEY (or ANTHROPIC_API_KEY / GOOGLE key for the LangGraph Bot)
# 3. Optional but do it: KEY_ENCRYPTION_KEY=$(openssl rand -base64 32)
bun install
bash scripts/start.sh
# → Docker services up, migrations applied, API on :3001, app on :3010start.sh also mints COMPUTER_TOKEN, SUPERVISOR_TOKEN, and AGENT_TOOL_TOKEN — per-container secrets that stop anything on your LAN from reaching a logged-in Chromium just by knowing its port. scripts/stop.sh tears everything down, Bot computers included, without deleting volumes.
For a server, one image with optional embedded Postgres:
docker run -p 3001:3001 --env-file .env \
-e EMBEDDED_POSTGRES=on -v openbot-data:/var/lib/postgresql \
ghcr.io/copilotkit/openbot:v0.0.12OPENBOT_SINGLE_USER=true ships on, admitting every request as one administrator. Delete that line and configure Google, Microsoft, or Okta OAuth plus INITIAL_ADMIN_EMAILS before anyone else can reach it; a half-configured provider refuses to start rather than defaulting open. SAML/OIDC providers are registered at runtime under Admin → Identity providers, routed by email domain.
Nothing is documented on hardware, but count on Postgres, server, app, supervisor, and one Chromium container per Bot. The Helm chart suspends idle computers (keeping their logins) to control that cost on Kubernetes.
Real Code: A Policy That Actually Refuses Things
The policy engine is the reason to install OpenBot. Policy is JSON with deny and allow arrays of CEL expressions, set via AGENT_COMPUTER_POLICY or saved from /admin/boundaries. The shipped default is permissive (deny: [], allow: ["true"]); a missing or empty policy permits nothing.
{
"mode": "enforce",
"deny": [
"tool.name == 'shell' && command.contains('rm -rf')",
"page.host.matches('.*\\.(bank|payroll)\\.example\\.com$')",
"file.extension == 'env' || file.path.contains('.ssh')",
"mcp.effect == 'write' && initiator.kind == 'routine'",
"tool.name == 'browser.type' && element.type == 'password'"
],
"allow": [
"bot.id == 'knowledge' && (tool.name.startsWith('mcp.') || tool.name.startsWith('browser.'))",
"bot.id == 'general-assistant'"
]
}That blocks destructive shell commands, keeps every Bot off finance hosts, stops file tools touching secrets, refuses any MCP write when a scheduled routine started the run (but permits the same write when a person is watching), and prevents Bots from typing into password fields at all — which pairs with “take the wheel,” since a human is supposed to handle logins. Deny is evaluated first; a broken deny denies and a broken allow doesn’t permit.
initiator.kind is the field we haven’t seen elsewhere. Every audit row records both whose authority an action carried (actor.id) and what caused it: person, deployment, routine, or handoff. A routine runs as its owner, so actor.id alone can’t distinguish “Andrew typed this” from “Andrew’s 9 a.m. schedule fired with nobody there.” The docs call that “the case worth being able to find,” and the policy language lets you treat it differently. Since v0.0.5, admins can dry-run a rule against past audit activity before saving it — not a luxury given how easy it is to write a CEL expression that refuses everything.
Bring your own agent
Any AG-UI endpoint is a Bot:
- id: risk-analyst
name: Risk Analyst
title: Risk & Compliance
type: remote-ag-ui
endpoint: http://agents.internal:9000/ag-ui
role_description: Review vendor contracts and flag compliance risk.Private addresses are refused unless listed in AGENT_ENDPOINT_ALLOWED_HOSTS=agents.internal,10.0.0.42:9000 — exact matches, no wildcards — and the endpoint is re-validated on every redirect (PR #38). The repo ships a proof-of-concept Bot, a LangGraph Bot, and a LlamaIndex Bot. Since v0.0.10 the LangGraph Bot tells its model when a tool call was refused by policy rather than reporting “the tool returned nothing” — a subtle fix, since the old behaviour had Bots confidently telling users nothing existed.
Routines, Handoffs, and the Coworker Layer
What separates OpenBot from a governed browser library is the coworker layer added in v0.0.5:
- Routines: “every weekday at nine, post the standup notes here.” Runs with its creator’s permissions in the channel it was asked in; 15-minute floor, 20 enabled per deployment, self-disables after ten consecutive failures.
- Bot-to-bot handoff: a Bot asked something outside its role hands the question to the right Bot, or to a person if none fits. Admins whitelist which Bot may ask which.
- Smart routing: an untagged message goes to the coworker whose purpose best matches it; the choice and reason are recorded.
@-mentions still win. - Take the wheel: grab a Bot’s browser at any point; the Bot pauses, actions during human control are refused rather than queued, and the handover lands in the audit log as
computer.control_taken/computer.control_released. - Components instead of prose: Bots answer with React components from a gallery or ones drafted in
/admin/playground; every render checks the component is published and not withheld from that Bot.
Connectors are curated: Google Drive (read-only) and Notion (read/write) ship first-party, each person connects their own account so a Bot sees only what that person can, and v0.0.12 adds Composio as a broker. Custom MCP servers must pass URL checks, and unknown tools are classified as writes.
What the Community Is Saying
Reception is enthusiastic but shallow — mostly people recommending it in threads about commercial alternatives rather than production reports:
- The recurring Reddit pitch is cost and lock-in: “when i saw the price i was like what the heck lol… i found one open source alternative called openbot which lets you plug any agent harness and any model” (r/AI_Agents, August 19).
- Third-party writeups (Cyber Ivy, explainx.ai) lead with the governance angle — isolated browsers, audit trail, “decided before it happens” — rather than agent quality. That’s the correct read: the agents are whatever you bring.
- The issue tracker reads like a security review in progress: “Block credential material in MCP tool arguments” (#436), “Flag high-risk content before MCP tool calls” (#448), “Stop a decrypted OAuth client from being quoted back by its own parser” (#480). A Slack bridge (#297) is an open PR.
- The most instructive early bug (#59): the Knowledge Bot shipped with no connector and a prompt telling it to deny access — which made it deny access even after Drive was connected. The fix, and the long YAML comment explaining prompt-vs-tool truthfulness, is a small masterclass.
We found no Hacker News thread with meaningful discussion and no independent benchmark of task completion.
Honest Limitations
- Alpha means alpha. Five releases in nine days is great velocity and poor stability. Pin
:v0.0.12, not:latest. - It’s a template, not a dependency. Nothing is published to npm. You clone it, replace
examples/fintech, and now own a fork of a fast-moving codebase. - CopilotKit Intelligence is required. The server refuses to start without
INTELLIGENCE_API_KEY,INTELLIGENCE_API_URL, andINTELLIGENCE_GATEWAY_WS_URL. If you’re here because you don’t want a vendor in the loop, budget time to self-host Intelligence too. - No local models out of the box.
OPENAI_BASE_URLgets you to Ollama or vLLM, but nothing is documented or tested for it. - Agent quality is not the product. The proof-of-concept Bot is a demo; real work means bringing an agent you already trust over AG-UI.
- One Chromium per Bot adds up fast on a laptop.
- Policy authoring is on you. The default allows everything; the docs give the field list without a cookbook.
- No Slack/Teams surface yet. Coworkers live in OpenBot’s own web channels.
Who Should Use This
Good fit: teams with agents already on LangGraph, Mastra, CrewAI, Pydantic AI, or ADK that need to put them in front of non-engineers with browser access and an audit trail; anyone whose security review killed a hosted coworker pilot over data residency; platform engineers who want a reference implementation of policy-gated tool calls — the gateway design is worth reading even if you build your own.
Not a fit: solo developers who want a personal agent — OpenClaw or Goose get there with far less infrastructure; anyone allergic to alpha software or maintaining a fork; pure browser automation — Browser Use is the library, OpenBot is the building around it.
How It Compares
| OpenBot | Grok Bot / Claude Cowork | FrontierAgent | Cua | |
|---|---|---|---|---|
| License | MIT | Proprietary, hosted | Open source | Open source |
| Where it runs | Your infra (Docker/Helm) | Vendor cloud | Local CLI/TUI | Local VMs |
| Agent framework | Any AG-UI endpoint | Vendor’s | Its own | Its own |
| Per-agent isolated browser | Yes, one container each | Vendor-managed | No | Yes (full OS VM) |
| Policy engine + audit | CEL, fail-closed, every action | Vendor-managed | No | No |
| Human takeover mid-task | Yes, audited | Varies | N/A | Manual |
| Scheduled runs | Routines (15-min floor) | Yes | No | No |
| SSO / admin roles | Google/Microsoft/Okta/SAML/OIDC | Yes | No | No |
| Maturity | Alpha (1 month) | GA | Early | Stable |
OpenBot competes with the hosted products on governance, not with the open-source frameworks on capability. It wants to host those frameworks.
FAQ
Is OpenBot free for commercial use? Yes — MIT, with no enterprise tier gating SSO, SAML/OIDC, audit, or the Helm chart. Durable threads and memory go through CopilotKit Intelligence, which has a free plan and a self-hosted option; check plan limits for team use.
Does OpenBot work with Claude or local models?
The LangGraph Bot accepts OpenAI, Anthropic, or Google keys, and ANTHROPIC_BASE_URL / OPENAI_BASE_URL / GOOGLE_GENERATIVE_AI_BASE_URL redirect calls to a proxy — your path to Ollama or vLLM via an OpenAI-compatible endpoint. Nothing local is officially tested as of v0.0.12.
How is OpenBot different from Browser Use or Playwright MCP? Those give an agent a browser. OpenBot gives each agent its own browser container with persistent logins, puts a policy gateway and audit log between agent and browser, adds files, shell, and MCP tools under the same gate, and wraps it in a multi-user chat product with SSO. Platform, not library.
What is AG-UI and do I have to use it? AG-UI is CopilotKit’s open protocol for streaming events between an agent and a UI. Yes, it’s the whole integration surface — but LangGraph, Mastra, CrewAI, Pydantic AI, and Google ADK have adapters, and a hand-written endpoint is small.
Can a Bot handle 2FA or a login page? No, by design. It asks for help, you take the wheel in the same panel, log in, and hand back. The browser profile persists, so it stays logged in for future runs. Every handover is recorded.
How does OpenBot keep secrets out of the model?
Credentials are stored write-only via /admin/credentials, encrypted with KEY_ENCRYPTION_KEY, never returned by an API, and redacted from audit events — the trail records that a secret was requested and its length, not its value. Recent PRs also block credential-looking material in MCP tool arguments.
Verdict
OpenBot is the first open-source project we’ve reviewed that treats agent governance as the product rather than a checkbox. The gateway-before-action design, the fail-closed CEL policy with initiator.kind, the audited human takeover, and the “skills are instructions, grants are capabilities” split are decisions enterprise platform teams end up rebuilding themselves — here they’re in an MIT repo with a healthy issue tracker and a release cadence measured in days.
The cost: it’s a month old, it’s a template you fork, and it needs CopilotKit Intelligence running somewhere. If you have an agent on any AG-UI-speaking framework and a security team that keeps saying no, clone it, pin v0.0.12, write three deny rules in /admin/boundaries, ask the General Assistant to fill out httpbin.org/forms/post, then open /admin/audit. Whether that page is something your compliance lead would sign off on is the whole evaluation — and it takes about an hour.
Sources: CopilotKit/OpenBot README, docs/architecture.md and docs/configuration.md (v0.0.12, September 15, 2026); examples/fintech/agents.yaml; CopilotKit blog: OpenBot v0.0.5 (September 1, 2026); GitHub releases v0.0.8–v0.0.12 and issues/PRs #38, #59, #297, #436, #448, #480; r/AI_Agents and r/cursor threads; star counts from the GitHub API on September 18, 2026.
Related reading on andrew.ooo: