CopilotKit/OpenBot

OpenBot is a self-hosted template for running AI coworkers: agents that get their own container with Chromium, a /workspace volume and a browser profile, while every tool call passes through one gateway that resolves the target, checks policy, records an audit row, and only then acts. It fits teams that want an assistant on their own infrastructure and are willing to operate it; the author describes it as a template to clone and customize, in beta, with no hosted signup and no published package README.

How the work proceeds

A Bot can be any endpoint speaking AG-UI, whether built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or by hand, so governance rides the protocol rather than the framework README. From /bots you register an endpoint or use the built-in system-prompt agents; the deployment starts with General Assistant and Knowledge, and one example package holds ten more single-job coworkers. You then talk to a coworker in a channel, watch its screen, and take control when it hits a login wall or 2FA prompt.

Policy is the distinguishing part. Rules written in CEL can inspect tool name, intent, bot and actor ids, page URL and host, DOM element, key, command, file and MCP fields, and who initiated the run. Deny outranks allow, a missing policy permits nothing, and a broken rule refuses rather than opens. Each refusal in /admin/audit names the rule behind it, and while a person is driving a computer the Bot's actions are refused, not queued.

Bots can also run shell commands in their workspace, use governed MCP connectors (including Drive, Notion and web-research providers), and answer with sandboxed React components published from /admin/playground. Skills are instructions attached to Bots, not new capabilities.

Requirements and setup paths

A local clone needs Docker (PostgreSQL and the shipped Bots), Bun 1.4+ (some tests fail on 1.3), a CopilotKit Intelligence project and licence, and a model key (OpenAI for the proof-of-concept Bot; OpenAI, Anthropic or Google for the LangGraph one) README. Managed Intelligence needs no separate licence token; running Intelligence locally is a 30-day renewable preview on macOS with Docker Desktop, not a production installation README.

For deployment, a single image contains the app, API, browser and optionally PostgreSQL and serves everything on port 3001, with a Docker Compose path for development on port 3010 README. EMBEDDED_POSTGRES can be omitted in favour of an existing database; the deployment docs cover minimum sizes and multi-replica behaviour.

Constraints that matter

.env.example ships OPENBOT_SINGLE_USER=true, which admits every request as one administrator. Removing it requires one of Google, Microsoft or Okta, plus INITIAL_ADMIN_EMAILS; with neither, startup is refused rather than admitting everyone README. Put TLS in front of anything non-local, since sign-in cookies want a secure context. Computers bind to loopback with per-container tokens, and the supervisor holds the Docker socket, so it should stay local. Credentials go through /admin/credentials and are encrypted at rest; secret values are never written to the transcript. Routines run on a 15-minute floor, cap at 20 enabled, and switch off after ten consecutive failures.

The project is MIT-licensed and the maintainer describes it as early in a 2026 HN thread HN comment. The README also notes rough edges and active development.