OpenBot is a self-hosted agent workspace from CopilotKit in which each agent (a Bot) works like a coworker: it has its own channel, its own container with a browser, files and a shell, and only the tools an administrator grants. It is published as a template to clone and adapt rather than a hosted product or a package, and it is in alpha.
Any endpoint that speaks AG-UI, the open protocol for agent-to-user interaction, can be a Bot, so agents built with LangGraph, Mastra, CrewAI, Pydantic AI, Agent Development Kit (ADK) or written by hand all join the same way. A deployment starts with two configuration-defined Bots, General Assistant and Knowledge, and ships a catalog of ten more single-purpose examples such as expense-claim review, ticket triage, and release-note drafting. Bots can also be created from the UI.
Every action a Bot takes on a computer, a file, an MCP server, or a UI component passes through one gateway. The gateway resolves the target, evaluates a fail-closed CEL policy (deny before allow, a missing policy permits nothing), writes an audit row, and only then acts or refuses with the rule that refused it. People can watch a Bot's screen beside the conversation, take control at a login wall or 2FA prompt, and hand it back.
The stack is a React and Vite UI, a Hono API server running the CopilotKit runtime, PostgreSQL with pgvector for product data, policy and audit, a supervisor that builds one container per Bot (optionally under gVisor), and a worker for scheduled routines. Durable threads and memory come from CopilotKit Intelligence, managed or self-hosted. No model ships with it: an administrator supplies the credential, and the bundled Bots use OpenAI, with the LangGraph Bot also supporting Anthropic and Google models. It runs with Docker Compose or as a single container image.
Features
- A computer per Bot: each Bot gets its own container with a browser profile, a workspace volume, and a shell, optionally isolated under gVisor
- Policy gateway: every browser, file, shell, MCP, and component action is resolved, checked against CEL rules, and recorded before it runs
- Fail-closed policy: rules can inspect the tool, page host, element, command, file, MCP call, and what started the run, and a broken rule refuses rather than allows
- Take the wheel: a person watches the Bot's screen, takes control at a login or 2FA prompt, and hands it back, with each handover recorded
- Bring your own agent: any AG-UI endpoint becomes a Bot, with endpoint target checks and a write-only auth header
- Governed MCP: Google Drive, Notion, and Parallel Search ship in the catalog, Composio brokers further apps, and custom-server tools are treated as writes
- Knowledge with permissions: answers from Google Drive and OneDrive cite their sources and only use files the asking person can already open
- Components instead of prose: Bots answer with compiled or sandboxed React components, with publishing and per-Bot grants governed by the server
- Skills: personal and admin-owned skills invoked with a slash command, and a skill-creator skill that drafts new ones in conversation
- Sign-in: Google, Microsoft, Okta, or a company SAML or OpenID Connect provider routed by email domain, with people management on the audit trail
- Audit trail: a readable log of permitted, refused, and failed actions, with credentials encrypted at rest and secrets kept out of transcripts
- Routines: scheduled tasks that run as the requesting person in the channel they were asked in, with a 15-minute floor and automatic shut-off after repeated failures
