CopilotKit's OpenBot Puts Agents on Your Own Machines, With Every Action Cleared and Logged
Synopsis
CopilotKit released OpenBot, a cloneable self-hosted template for an AI agent workspace in which each coworker agent gets its own browser, logins and files and only the tools it is granted. Any agent speaking the AG-UI protocol joins the same way, and every action on a computer, file, MCP server or component passes through one gateway that decides before and records after. A deployment starts with two configuration-defined coworker agents and ten more fintech examples; the project is in beta, with no hosted version and no published package.
Interpretation
A company can run its whole agent workspace on its own infrastructure and keep the freedom to change any part of it. Comparable assistants are offered as hosted services that users work inside rather than control. Docker Compose brings up every component, data sits in the user's own PostgreSQL, and no model ships in the box; an administrator supplies the credential.
Each coworker agent gets a computer of its own, with its own browser, its own logins and its own files, and only the tools it is granted. Whether an agent may touch company tools depends on being allowed near them, not merely able to call them. Anything a Bot does to a computer, a file, an MCP server or a component goes through one gateway that decides before the action and records it after.
Admission is framework-agnostic: any endpoint speaking AG-UI can arrive as a coworker agent. Governance rides the protocol rather than any single agent framework. Agents built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or written by hand all arrive the same way.
Perspective
The material is written for readers running on a laptop, and every instruction assumes a single machine; OPENBOT_SINGLE_USER=true in .env.example admits every request as one administrator, and sign-in must be turned on before anyone else can reach the deployment. The project describes itself as a template rather than a product, with no hosted version to sign up for and nothing published as a package to depend on; every workspace in the repository is private.
The project describes itself as early and under active development, so rough edges, bugs and movement are expected. The material reports no performance or security measurements, so the gateway's actual interception behavior cannot be judged from what is loaded.