OpenBot is closing in on 8,200 stars and 1,000 forks, made GitHub Trending on October 30, 2026, and the Trendshift badge in its README ranks it third among the day's repositories. It comes from CopilotKit, the team behind the AG-UI protocol, and the pitch is specific: a ChatGPT-style assistant that runs on your own infrastructure, where every agent gets its own browser and nothing happens without a policy allowing it and an audit row recording it.
What it is and how it works
OpenBot isn't a product you sign up for. It's a template: the README tells you to clone it, replace the example package under examples/ with your own agents, and deploy it. It's in beta, MIT-licensed, with about 590 commits.
The core piece is a gateway that everything an agent does to a computer, a file, an MCP server or a UI component has to go through. For each tool call it resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then acts. There's no path that runs something before the record exists.
Policies are written in CEL and can inspect tool.name, page.host, command, file.*, mcp.* or initiator.*, the last one so a scheduled routine can be refused what a person is allowed. The design fails closed: deny rules are evaluated before allow rules, no policy means nothing is permitted, and a broken rule refuses instead of opening up.
Each person gets their own container (the "computer") with Chromium, a /workspace directory and a browser profile per agent. Mark an agent as Isolated and it gets a container to itself; set COMPUTER_RUNTIME=runsc and they run under gVisor. An agent is any endpoint that speaks AG-UI, so LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or hand-written agents all work.
The stack: a React/Vite UI, a Hono API on Bun, PostgreSQL with pgvector for policy, audit and encrypted credentials, and CopilotKit Intelligence for threads and memory.
How to try it
The quickest route is the published image with embedded PostgreSQL:
docker run -p 3001:3001 --env-file .env \
-e EMBEDDED_POSTGRES=on -v openbot-data:/var/lib/postgresql \
ghcr.io/copilotkit/openbot:latestThe .env needs at least DATABASE_URL (or the embedded Postgres), KEY_ENCRYPTION_KEY, the three CopilotKit Intelligence variables and a model key. For local development the repo ships scripts/start.sh, which brings everything up with Docker Compose (it needs Bun 1.4 or later), and there's a Helm chart under charts/openbot.
One warning before anyone else can reach it: .env.example ships OPENBOT_SINGLE_USER=true, which admits every request as a single administrator with no sign-in. Fine on a laptop, dangerous anywhere else, because these agents drive browsers holding real logins. Delete that line and configure Google, Microsoft, Okta or a SAML/OIDC provider; with none of them, the server refuses to start.
What I like and what I don't
What I like is that governance isn't bolted on. The policy sits on the only path to the tools, credentials are encrypted at rest and never returned by the API, secrets stay out of the transcript (only the fact that one was requested and its length are recorded), and scheduled routines have explicit brakes: a 15-minute minimum interval, at most 20 enabled, and automatic shutdown after 10 consecutive failures. Those are exactly the guarantees a platform team would ask for before giving an agent access to real systems.
What I don't like is the dependency on CopilotKit Intelligence. The server won't start without its variables, and the local option is a macOS-only preview on Docker Desktop with a renewable 30-day licence. The code is MIT, but memory and threads depend on a service from the same company, and the README is peppered with offers to have them deploy it for you. The project also calls itself beta and says to expect things to move.
OpenBot vs Open WebUI
The usual choice for a self-hosted assistant is Open WebUI, with around 157,000 stars.
| OpenBot | Open WebUI | |
|---|---|---|
| Focus | Agents that act (browser, shell, MCP) under policy | Chat UI for local models and OpenAI-compatible APIs |
| Action control | Gateway with CEL policies and per-action audit | RBAC and approval flows in plugins |
| Isolation | Container per person or per agent, optional gVisor | Per-user containers in the Enterprise edition (Terminals) |
| Deployment | Docker, Compose or Helm; needs CopilotKit Intelligence | Docker, pip or Kubernetes, no external service |
| Licence | MIT | Open WebUI License, which requires keeping the branding |
| Maturity | Beta | Established project |
If your team just needs to chat with self-hosted or third-party models, Open WebUI is a single docker run and depends on nobody. OpenBot makes sense when agents are going to touch systems (fill in forms, run commands, use connectors) and you need to answer who did what, under which permission, and why something was refused.