OpenBot gives AI coworkers separate computers and clear limits

What this is about

OpenBot by CopilotKit is an open-source platform for AI coworkers that can use a browser, files, a shell, and MCP tools. Its key distinction from a normal agent chat is that every Bot receives a separate computer environment, while a central gateway checks each proposed action against policy and records it.

The repository explicitly labels OpenBot as alpha software. It is therefore aimed mainly at technical teams that want to test agents under controls and are prepared to operate or configure Docker, Bun, PostgreSQL, model access, and CopilotKit Intelligence.

What OpenBot actually does

OpenBot starts a separate container for each Bot, with its own Chromium profile and workspace. An agent can operate websites, process files, run shell commands, and call approved MCP tools. The platform supports agents connected through the open AG-UI protocol, including implementations using LangGraph, Mastra, CrewAI, Pydantic AI, or Google ADK.

Every action passes through a gateway. Teams can use CEL rules to define which tools, websites, files, or commands are allowed. Denials are evaluated before allows, and missing or broken policy is designed to fail closed. The audit trail separates permitted, refused, and failed actions.

When a login or two-factor prompt appears, a person can take control of the browser and later hand it back. Bot actions are refused while the person is driving. Credentials are encrypted at rest and, according to the documentation, are not written in plain text to conversations or audit records.

Why it matters

Agents become risky when they move beyond answering questions and can operate signed-in websites, files, and commands. A confirmation dialog alone is often insufficient for teams: they need isolated identities, repeatable policy, and a trail that can be investigated after a bad decision.

OpenBot brings these controls into one interface. That may be useful for internal research, preparatory administration, compliance checks, or recurring browser workflows. However, the bundled example roles are configurations, not evidence that the product reliably handles a specific business process.

Framework independence also matters. A team can connect an existing AG-UI agent without rebuilding the control layer for every framework. It still remains responsible for model behavior, data sources, and business logic.

In plain language

OpenBot is like a workshop where every new worker gets a separate bench. Tools are not left freely available: a counter checks the work order before every use, refuses prohibited equipment, and records each action in a logbook. That reduces risk but does not guarantee good work.

A practical example

A purchasing team wants to check 40 supplier portals each day for new documents. An OpenBot agent opens every portal in its isolated browser, downloads only PDF files into its own workspace, and writes results to an approved MCP service. Policy blocks payments, profile changes, and shell access.

At the fifth portal, a two-factor prompt appears. An employee briefly takes over the browser, signs in, and returns control. After the test, the team reviews 40 audit entries and compares every downloaded file with its portal. The workflow becomes recurring only after stable results.

Scope and limits

• OpenBot is alpha software. Interfaces, usability, and security assumptions can change, so production use needs independent testing.
• Installation is demanding and requires several services and credentials. This is not a ready-to-use desktop app.
• Policy controls actions but does not automatically validate business correctness. An allowed click can still be wrong.
• A Bot with browser, shell, and MCP access has a large attack surface. Prompt injection, malicious files, and compromised tools remain real risks.
• CopilotKit states that Intelligence has a free plan and a self-hosting option, but actual costs depend on operations, models, and the selected offering.

The sensible next test is a narrowly scoped, read-only workflow on test accounts. Teams should begin with deny-by-default policy, run five known tasks, and manually compare the audit trail with the resulting output.

SEO & GEO keywords

OpenBot, CopilotKit, AI coworkers, AI agents, browser automation, AG-UI, MCP, agent security, audit trail, self-hosted AI, Docker