An agent workspace built around permission
OpenBot is a self-hosted workplace where an AI coworker gets a browser, workspace, shell, approved external tools, and a channel where a person can watch. Actions return through a gateway before they happen. It resolves the target, evaluates policy, writes an audit record, and then performs or refuses the action.
That order is the reason to consider OpenBot. Most agent products make oversight feel like a transcript inspected after the model has already acted. OpenBot applies CEL rules to browser destinations, page elements, files, commands, and MCP tools. Deny rules run before allow rules, missing policy permits nothing, and broken rules fail closed. A human can take control for login or 2FA; while that person drives, Bot actions are refused.
Any endpoint speaking AG-UI can become a coworker. The README names LangGraph, Mastra, CrewAI, Pydantic AI, and Google ADK, but a hand-written endpoint works too. OpenBot manages identity, tools, policy, computers, and the interface while the team keeps its preferred agent runtime.
What using it actually involves
The quick start is orderly, but not light. You need Docker, Bun, a CopilotKit Intelligence project and license, and a model credential. After configuration, the startup script starts Docker services, applies migrations, launches the server and app, and checks their health routes.
The local default uses single-user mode, making every request one administrator so a developer can evaluate without registering an identity provider. Before anyone else can reach it, the README says to disable that mode, configure Google, Microsoft, Okta, SAML, or OpenID Connect, and add TLS. PostgreSQL stores product data and the audit trail; CopilotKit Intelligence stores durable threads and memory.
The architecture is substantial. There is a React interface, a Hono API, an agent computer with Chromium and a workspace, example agents, a supervisor that creates computers, PostgreSQL with pgvector, and an external Intelligence service. OpenBot does provide a single-image deployment option, but operating the product still means owning identity, secrets, persistence, model access, and the isolation assumptions around browsers with real logins.
What happened when we ran it
We cloned commit 891df72 into a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, no secrets, and the Node 22 Bookworm image. The repository contained 504 files and about 72,706 lines of source, occupying 4.4 MB checked out. It is a Bun-based Node monorepo with workspaces, Docker and Compose files, four CI workflow files, and a tests directory.
Installation succeeded in 67 seconds, placing 1,168 packages and consuming 1,311 MB on disk. The build succeeded in 35 seconds.
Testing failed with exit code 1 in 16 seconds. The supplied summary records 1,008 passes, 120 failures, and 10 skips out of 1,128 tests. The log tail separately says 1,138 tests ran across 105 files, with one error and 2,239 expectation calls. It names channel-store integration failures around Unicode name truncation and inaccessible or soft-deleted agents. It also names concurrency failures involving creating a channel without a second connection and refusing an agent deleted during creation. The log does not explain why these cases failed, so there is no basis for blaming the container, database, or application code. The useful conclusion is narrower: this checkout installed and built, but its recorded test run was not green.
Strong controls, with unfinished edges
OpenBot's practical details show good instincts. Credentials are encrypted at rest and never returned through the API. Audit entries record that a secret was supplied without its value. Unknown MCP tools are treated as writes unless classified as reads. The browser computer binds to loopback in Compose, and commands receive selected environment variables instead of the deployment's full environment.
Administrators can configure boundaries, credentials, connectors, computers, components, and the audit log. React components let an agent return an interface rather than only prose, with publication and data-function grants checked independently. These pieces make an agent workspace governable instead of merely impressive in a demo.
Still, the issue tracker exposes unfinished work in the exact layer OpenBot is selling. One open report demonstrates an agent endpoint passing the initial address check and then redirecting to a destination that direct validation would refuse. Another explains that grants for withdrawn MCP tools remain in the database and could silently regain effect after a transport change, even though other safeguards currently block the cited writes. A newer report describes a snapshot save racing with a computer reset, restoring stale page state and preventing fresh snapshots from landing after a restart. These are specific alpha defects, not generic caution about young software.
Health and the decision
OpenBot was created on August 17, 2026, published its first alpha release that day, and was pushed again on August 22. Issues and pull requests were still being created and updated on August 22. That is energetic activity, but five days of public history cannot demonstrate operational maturity. GitHub's combined open count includes both issues and pull requests, so it should not be read as a pure bug total.
Documentation is unusually candid. The README covers setup, action policy, identity, deployment, secrets, and the distinction between local convenience and a deployment other people can reach. Separate guides cover architecture, configuration, coworkers, development, deployment, and releases.
OpenBot is worth a sandbox trial for a team that wants portable AG-UI coworkers and considers pre-action policy non-negotiable. Its design is more responsible than granting a browser agent broad credentials and hoping the prompt holds. But the right buying decision today is evaluation, not sensitive production use. Require a clean test run in your environment, and track the endpoint, grant, and snapshot issues before trusting the gate with consequential access.