CopilotKit/OpenBot

OpenBot is a self-hosted agent platform that gives each AI agent its own isolated computer: a dedicated container running Chromium, a private /workspace volume, and its own browser profile with its own logins. The isolation is not cosmetic. Every browser action, file operation, shell command, and MCP tool call routes through a single gateway that evaluates a CEL policy, writes an audit row, and only then executes — or refuses and names the rule that stopped it. The audit record exists before the action happens, not after. There is no side path.

The policy engine is worth understanding in detail. Rules can inspect the tool name, the declared intent, the bot's identity, the acting user, the current page URL and host, element attributes, file metadata, and MCP fields. Deny is evaluated before allow. A missing policy permits nothing. A broken rule refuses rather than falls through. That last point is the meaningful one: most access-control systems fail open when misconfigured; this one fails closed by design.

The protocol underneath is AG-UI, an open agent-to-user interaction spec. That means any AG-UI endpoint — built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK, or written from scratch — arrives as a first-class agent without modification. Governance rides the protocol rather than any particular framework, so swapping the agent implementation does not change what the platform can observe or enforce.

Three example agents ship as configuration in agents.yaml, not as compiled code: a general assistant, a knowledge agent, and a risk analyst. Adding a fourth is editing that file or using the /agents UI. Custom agents pointing at private network addresses require explicit allowlisting via AGENT_ENDPOINT_ALLOWED_HOSTS, with exact host matching — no wildcards, no suffix patterns.

The human-in-the-loop story is practical rather than theoretical. When an agent hits a login wall or a two-factor prompt, it asks for help. The operator takes the wheel in the same panel; bot actions are refused rather than queued while a person is driving. Control transfer is recorded as distinct audit events. Secrets requested during a session appear in the transcript as a redacted entry showing only that a secret was used and how long it was.

The project is explicitly alpha. It requires a CopilotKit Intelligence project for durable thread storage — a free plan exists, and self-hosting is documented — plus a model key from OpenAI, Anthropic, or Google. No model ships in the box. The single-user mode in .env.example is a local development shortcut; any real deployment needs an OAuth provider configured before it will start.

The architecture is a Hono API server, a React/Vite frontend, per-bot Chromium containers managed by a supervisor, and PostgreSQL with pgvector for everything persistent. Docker Compose brings it up. A single image handles deployment without Kubernetes. The loopback binding on agent computers is a deliberate security choice, not a convenience default.