OpenBot Gives Each AI Coworker Its Own Governed Computer

My notes

Summary

OpenBot (CopilotKit) is a self-hosted, open-source platform for running “AI coworkers”. Each agent gets its own container, browser profile, and file workspace, and every action it takes (browser click, file write, MCP tool call) is decided by a policy gateway before it happens and logged after. It’s framework-agnostic: any agent built on the open AG-UI protocol (LangGraph, CrewAI, Pydantic AI, Google ADK, or hand-written) can plug in as a “Bot.”

Key Insight

• The governance model is the actual product, not the agents. Every browser, file, and MCP action routes through one gateway that resolves the target, evaluates a CEL policy, writes an audit row, then calls the computer. There’s no code path that acts before the record exists. Deny is evaluated before allow, and a missing or malformed policy fails closed (refuses, doesn’t default-permit).
• “A computer per Bot”. Each agent gets its own Docker container, /workspace volume, and browser profile (optionally sandboxed under gVisor via COMPUTER_RUNTIME=runsc). This is the practical difference between “an agent that can use your tools” and “an agent you can actually let near them”, with no shared session bleed between agents.
• Human-in-the-loop handoff is a first-class primitive, not a bolt-on. When a Bot hits a login wall or 2FA, it requests control (computer.help_requested), a human takes the wheel (computer.control_taken), and while a person is driving, Bot actions are refused rather than queued, avoiding race conditions between human and agent input.
• Secrets never enter the transcript. The audit trail records that a credential was requested and how long it was, never the value or content. Credentials are stored write-only through /admin/credentials, encrypted at rest, never returned by any API.
• MCP governance is per-vendor and per-tool. The catalogue only carries MCP vendors the deployment explicitly vetted (Google Drive ships by default), any tool not positively classified as read-only is treated as a write, and a Bot that lacks a connector says so rather than being able to browse to the vendor’s site to find out.
• SSRF-style protections are built into agent registration. Registering a custom AG-UI endpoint validates the target with the same checks used for browser navigation, both at registration and on every redirect, and private or internal addresses are refused unless explicitly allowlisted in AGENT_ENDPOINT_ALLOWED_HOSTS (exact host:port match, no wildcards).
• No model lock-in. The box ships with zero model included. You bring your own OpenAI, Anthropic, or Google key, and OPENAI_BASE_URL / ANTHROPIC_BASE_URL support routing through your own gateway or proxy.
• Runs entirely on a laptop via bash scripts/start.sh (Docker Compose plus Bun), a single container image is available for simple deploys, and OPENBOT_SINGLE_USER=true is explicitly an insecure default meant only for local trial. Production requires Google, Microsoft, Okta, SAML, or OIDC sign-in or the server refuses to start.