Skip to main content
← All news
AI Agents

OpenBot gives each bot a computer. Memory still needs CopilotKit.

By AgentRiot Editorial

CopilotKit’s MIT alpha is a fail-closed gateway in front of per-bot Chromium. Threads live in CopilotKit Intelligence, and there is no degraded mode.

OpenBot v0.0.1 CopilotKit official lockup
OpenBotCopilotKitAG-UIAI Agents

CopilotKit did not ship a chat wrapper.

OpenBot is an alpha coworker platform: each Bot gets its own container, its own Chromium with its own logins, and its own /workspace. Anything that Bot does to a page, a file, an MCP server, or a UI component has to pass a gateway that writes an audit row first. The README’s line is the product: every action is decided before it happens and recorded after.

The public repo was created on 17 August 2026. Tag v0.0.1 landed the same day. GitHub listed 1,003 stars and 97 forks on 20 August 2026. Two days after the tag, CopilotKit CEO Atai Barkai posted the launch on X as an open-source “Grok Bot” for companies. That post is the signal. The README, the release notes, and .env.example are the source of record.

AgentRiot already covered xAI’s Grok Bot and Rakazo, a different self-hosted product. OpenBot is CopilotKit’s object: AG-UI on the front, a policy gateway in the middle, and CopilotKit Intelligence underneath the threads.

What actually runs

Docker Compose brings up PostgreSQL with pgvector, a supervisor, per-Bot computers, a proof-of-concept Bot, a LangGraph Bot, and a Hono API. Bun 1.3+ runs the app on port 3010 and the API on 3001. No model ships in the box. An administrator supplies a key, which the project says is encrypted at rest and never logged.

Three example coworkers are configuration, not special binaries: General Assistant, Knowledge, and Risk Analyst, declared in agents.yaml. You add more from /agents or by editing that file.

The surfaces that matter:

  • /channel/:id for a coworker with a live screen
  • /bot for direct chat
  • /admin/boundaries for CEL policy
  • /admin/audit for permitted, refused, and failed actions
  • /admin/computers to stop or reset a Bot’s machine
  • /admin/plugins for MCP grants

A Bot that hits a login wall or 2FA is supposed to stop and ask. Control is handed over in the same panel and recorded as computer.help_requested, computer.control_taken, and computer.control_released. While a person is driving, Bot actions are refused rather than queued.

The gateway is the product

Computer use is not the novel claim. Isolation plus a fail-closed policy is.

Rules inspect tool.name, intent, bot.id, actor.id, page.url, page.host, element.*, key, file.*, and mcp.*. Deny is evaluated before allow. A missing policy permits nothing. A broken rule refuses rather than opens. Secrets requested through the vault show up in the trail as a request and a length, not as the secret.

MCP is gated the same way. A catalogue ships for Atlassian, Box, Slack, Salesforce, and ServiceNow. Custom servers have to pass URL checks, and any tool not positively classified as a read is treated as a write. Skills are instructions, not capabilities: they attach to Bots you own and are invoked with / in the composer.

Optional hardening is already in the README: computers bind to 127.0.0.1 with a per-container token, and COMPUTER_RUNTIME=runsc will run them under gVisor where the host has it.

Bring any AG-UI agent. Then keep it on a leash.

A Bot is any endpoint that speaks AG-UI, CopilotKit’s Agent–User Interaction protocol. The README lists LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK, or a hand-written server. Register the endpoint from /agents. The server validates it with the same target checks used for browser navigation. An auth header is stored write-only.

That is the honest “Grok Bot” comparison. OpenBot is not trying to be a single closed harness. It is trying to be the company-facing shell around whatever harness you already have, as long as that harness speaks AG-UI.

The part that is not optional

The MIT license covers the OpenBot tree. Starting the API is another matter.

The server refuses to boot without INTELLIGENCE_API_URL, INTELLIGENCE_GATEWAY_WS_URL, INTELLIGENCE_API_KEY, and COPILOTKIT_LICENSE_TOKEN. The checked-in env template is blunt: CopilotKit Intelligence owns durable threads and memory, a deployment without it forgets every conversation, and there is no degraded mode. The default URLs point at CopilotKit’s managed service. The comments say not to run Intelligence yourself; the CLI (npx copilotkit@latest login / project select / license --write) provisions a free licence for that managed path. Running Intelligence on your own cluster is documented as an Enterprise Intelligence Platform Helm chart, and is not self-serve.

So the coworker UI can sit on your laptop, and the Bot computers can sit in Docker on loopback, while conversation memory still depends on CopilotKit’s Intelligence control plane unless you are on that enterprise self-host path.

The marketing page calls OpenBot an enterprise platform that runs inside your infrastructure. The v0.0.1 notes are narrower: local only, no hosted OpenBot deployment yet. There is no Helm chart in the OpenBot repository. Helm, in CopilotKit’s docs, is for Intelligence.

Alpha means the edges move

The README badge is orange for a reason. Default auth is OPENBOT_DEV_NO_AUTH, which admits every request as one administrator. Production is documented to refuse that flag, and to refuse the example encryption key.

On 20 August 2026, maintainers merged “Take back the two features that only worked on one machine”. An in-process approval registry and a repetition counter had shipped, then been pulled, because both lived in a process Map. Behind more than one server they would fail quietly: an approval raised on one replica looking expired on another, a repeat.count >= 10 rule that never fires. They kept the stall watchdog, which belongs on the stream that is actually wedged.

That is a better signal than the star count. The project is already arguing with itself about what a company deployment is allowed to pretend.

How to try it

From the release notes:

cp .env.example .env
npx --yes copilotkit@latest login
npx --yes copilotkit@latest project select
npx --yes copilotkit@latest license --write
# put OPENAI_API_KEY and INTELLIGENCE_API_KEY in .env
bun install
bash scripts/start.sh

Then open http://localhost:3010. The README’s first probe is ordinary: ask /bot to open news.ycombinator.com and name the top story, then inspect /admin/audit.

Bring your own model key. Expect bugs. If you need a Bot that keeps its memory after you kill Docker, you are also signing up for CopilotKit Intelligence.

Sources