OpenBot - CopilotKit: An open-source enterprise-grade AI agent platform

What is OpenBot?

OpenBot is an open-source enterprise-grade AI agent platform based on CopilotKit, positioned as a "digital colleague you can entrust with real work." Each agent is equipped with its own dedicated "computer." An independent Docker container contains a Chromium browser, login session, and file workspace; all operations must be audited by a single gateway according to the CEL policy before execution, with fail-closed operations being rejected by default; for login or 2FA (Automatic Application Assistance) issues, a human can "take over the steering wheel" to complete the manual steps. The platform is based on the AG-UI protocol, compatible with any framework such as LangGraph, and is fully self-managed, emphasizing an isolated, auditable, and controllable agent governance foundation.

Main functions of OpenBot

• Each agent has a dedicated computer.Supervisor creates a separate Docker container for each bot, containing a Chromium browser (in an independent login state)./workspace File workspace; supports gVisor kernel-level isolation.
• Unified Audit GatewayAll operations on browsers, files, MCPs, and components go through a single gateway, which first parses the target, evaluates the policy, writes it to the audit log, and then executes or rejects it—there is no path to bypass the log.
• CEL Strategy Engine (fail-closed)Rules can be written by fields such as tool name, bot, user, URL, page element, file, MCP operation, etc.; deny takes precedence, no policy defaults to full denial, and denies instead of allowing when the rule is wrong.
• Take the wheel (manual takeover)When encountering a login barrier or 2FA, the bot will proactively request assistance, allowing the user to take over operations from the same panel. During the takeover, any actions taken by the bot will be directly rejected, and the entire process will be recorded.
• Framework independent (AG-UI protocol)Any endpoint that uses AG-UI can be connected as a bot, supporting LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK, or handwritten agents.
• Component-based outputAgent responses are not limited to text; they can render interactive React components (built-in components + sandboxed components for deployment-free deployment), and component permissions can be managed individually.
• Shell execution capabilitiesBots can execute commands, install dependencies, and process files in their own workspace, and commands are also audited by the gateway.
• Key security managementCredentials are stored in an encrypted manner; APIs never return responses; audits only record the key length, not the content; and the key is not entered into the session log.
• Governance MCP IntegrationBuilt-in Google Drive connector; custom MCP servers require URL verification; tools not explicitly categorized as "read" are treated as "write".
• Enterprise-level identity and permissionsSupports Google/Microsoft/Okta login and runtime registration SAML/OIDC (routing by email domain). Administrators can upgrade or downgrade permissions, remove access, and terminate sessions immediately.
• Readable Audit Center：/admin/audit List all allowed, denied, and failed operations, with each denial accompanied by specific rules to be triggered.
• Fully self-hostedDocker Compose can be launched with one click, and the data is stored in its own PostgreSQL database. The model key is configured by the administrator, and single container deployment is also supported.

Follow us on WeChat and reply with "open source",join inAI open source project discussion group

How to use OpenBot

• Environmental preparationInstall Docker (for PostgreSQL and Bot containers) and Bun 1.3+ (for the front end and API server), and prepare a large model API Key (such as an OpenAI Key).
• Clone the repository and initialize the configuration.:implement git clone https://github.com/CopilotKit/openbot.gitAfter entering the directory cp .env.example .env Create an environment variable file.
• Obtain Intelligence credentialsRun sequentially npx --yes copilotkit@latest login、project select、license --write, will generate cpk-... Runtime key input .env of INTELLIGENCE_API_KEY (Intelligence offers a free plan, or you can self-host).
• Fill in the necessary environment variables:exist .env Fill in the middle OPENAI_API_KEYProduction environment requires openssl rand -base64 32 Generate your own KEY_ENCRYPTION_KEY(Example values available for local testing).
• One-click start:run bun install Install dependencies, then bash scripts/start.shThe script will automatically start the Docker service, perform database migration, launch the API server (port 3001) and frontend (port 3010), and check the health status of each service.
• Access the main interfaceOpen in browser http://localhost:3010You can then see the channel list and the three preset "colleagues" (General Assistant, Knowledge, Risk Analyst).
• First Impressions:exist /bot The page prompts the bot to open Hacker News, read the headlines, fill out the httpbin test form, and then... /admin/audit Review the audit logs.
• Test strategy management:Enter /admin/boundaries Add a deny rule or preset, retry the same browser operation, and observe the bot being denied and the rule that was triggered.
• Create custom colleagues:exist /agents Create a new Bot on the page, configure its name, role description, and AG-UI endpoint, or... agents.yaml After the announcement, you can open a private channel with it.
• Manual takeover collaborationWhen a bot encounters a login firewall or actively seeks help via 2FA, it takes over its browser on the same panel to complete authentication, then returns control to continue automatic execution.
• Daily Management:pass /admin/computers View/reset the bot's computer./admin/credentials Encrypted storage of credentials/admin/plugins Configure MCP server/admin/people Manage member permissions.

OpenBot's core advantages

• Reconstructing the trust model from the ground upInstead of relying on the "self-discipline" of agents, it transforms the question of "whether or not to let agents access production systems" from a trust issue into an engineering problem through computational isolation and mandatory auditing.
• True environmental isolationEach bot has an independent container, an independent browser login state, and an independent file system. Agents are not visible to each other, so if one bot has a problem, it will not affect others, thus eliminating the risk of serial number and data leakage caused by a shared environment.
• Audit first, then executeUnlike the traditional "operate first, log later" approach, all actions are written to the audit log before execution. Even if the execution crashes or the agent tries to bypass it, the intent is still recorded, and no operation path can skip the record.
• fail-closed safe defaultThe approach shifts from "defaulting to allow and then plugging the loophole" to "defaulting to deny and then granting permission" in terms of security stance: no policy, defaulting to deny and then granting permission when the rule is written incorrectly, and prioritizing deny over allow.
• Seamless human-machine collaborationTake the Wheel standardizes the process by making "humans complete one step of authentication and then it is fully automated afterwards." During the takeover period, Bot actions are directly rejected instead of being queued, thus avoiding conflicts between human and machine operations.
• Frame-independent and unlockableBased on the open AG-UI protocol, any framework such as LangGraph, CrewAI, Google ADK, and even handwritten agents can be connected. The governance logic runs at the protocol layer, so governance capabilities are not lost when switching frameworks.
• Data is completely independent and controllableFully self-hosted, with data residing in its own PostgreSQL database, and model keys configured by the administrator (encrypted storage, not logged, and not recorded in conversation history), with no vendor lock-in.

OpenBot project address

• GitHub repository：https://github.com/CopilotKit/openbot

Comparison of OpenBot and similar competing products

Application scenarios of OpenBot

• Enterprise Knowledge Q&A AssistantAccess internal company knowledge sources (such as Google Drive connectors) to allow "knowledgeable colleagues" to answer employees' questions about company policies and documents, with all access activities leaving an auditable record.
• Risk and Compliance AnalysisThe pre-installed Risk Analyst can perform tasks such as risk monitoring, transaction review, and compliance checks, while the policy gateway ensures that it can only access authorized data and systems.
• Internal system automation operationThe "manual takeover" mode handles scenarios that require logging into the enterprise intranet system and completing 2FA authentication. After the human completes the authentication step, the Agent automatically executes the subsequent processes.
• Financial/Operations Data ProcessingThe bot executes scripts, processes spreadsheet files, and installs necessary dependencies in its own workspace. All commands and file operations are audited by the gateway (the example package is for a fintech tenant scenario).
• AI Assistants in Sensitive Data EnvironmentsThis feature features encrypted storage of credentials, keys not being entered into the conversation log, and auditing only recording the length of data, not the content. It is suitable for industries with strict data security requirements, such as finance and healthcare.
• Multi-Agent Collaboration WorkbenchBots with different functions (general assistant, knowledge base, analyst) each have their own dedicated channels and independent computers, and employees can collaborate with multiple agents in parallel, just like @ colleagues.