What is OpenBot?
OpenBot is CopilotKit's open-source template for running AI coworkers inside your own infrastructure. It is in beta, and the README is explicit that it is a template to clone and change, not a hosted product or a package to depend on. Each Bot gets its own container with a Chromium browser, its own logins, a /workspace volume and a shell, and only the tools an administrator grants.
Every browser, file, shell, MCP or component action passes through one gateway that resolves the target, evaluates a CEL policy (deny before allow, a missing policy permits nothing, a broken rule refuses), writes an audit row and only then acts. A person can watch a Bot's screen and take control when it hits a login wall or a 2FA prompt. Any agent that speaks AG-UI can be a Bot, whether built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or by hand.
Threads and memory run on CopilotKit Intelligence, the company's paid service, which OpenBot will not start without. Sign-in supports Google, Microsoft, Okta, and company SAML or OIDC providers.
How much does OpenBot cost?
| Plan | Price | What you get |
|---|---|---|
| OpenBot | Free | MIT; self-hosted with Docker Compose or one container image |
| Intelligence Free | $0 | 1,000 interactions per organisation a month hosted; local Developer Edition is non-production only |
| Intelligence Pay as you go | $49/month | 10,000 interactions included, then graduated rates; hosted or self-hosted |
| Intelligence Annual | Custom | Committed discount, offline deployment, custom SSO |
MIT licence. Requires CopilotKit Intelligence: Free ($0) hosted tier with 1,000 interactions per organisation a month; Pay as you go $49/month with 10,000 interactions included; Annual custom. You supply the model key.
Is OpenBot worth it?
OpenBot's design is more careful than most agent platforms, and its packaging is less finished. The repository was created in August 2026, has about 7,500 GitHub stars and shipped v0.2.0 on 12 October 2026. The README calls it beta and "a template, not a product": nothing is published as a package, and you are expected to replace the example fintech tenant with your own coworkers.
The governance model is the reason to look. Every tool call a Bot makes returns through a server gateway that resolves the target from a snapshot the server holds, checks it against CEL rules that can inspect the URL, the element, the shell command, the MCP tool and what started the run, and writes the audit row before anything happens. Refusals name the rule that caused them, secrets are recorded only by length, and while a person has taken control the Bot's actions are refused rather than queued. Unknown and custom MCP tools are treated as writes by default.
The defaults need attention before anyone else can reach it. `.env.example` ships `OPENBOT_SINGLE_USER=true`, which admits every request as one administrator, and `start.sh` falls back to fixed development values for the computer and supervisor tokens. The supervisor holds the Docker socket, so its token is a shared secret rather than a network boundary, and the docs ask you to keep it on loopback. gVisor isolation is available but optional.
The dependency on CopilotKit Intelligence is the real commitment. The API server refuses to start without an Intelligence URL and key; the free hosted tier covers 1,000 interactions a month, the local Developer Edition is licensed for non-production use only, and production starts at $49 a month for 10,000 interactions. Releases also move fast: v0.2.0 merged three Bot lists into one and moved ten of the twelve starter coworkers out of the default load. Compared with Magentic-UI, which also runs locally and asks for approval before critical actions, OpenBot is far stronger on policy and audit and far heavier to stand up.
Where it earns its place
A platform engineer at a 300-person fintech
Let an expense-checking agent use the browser without giving it free rein over internal systems
Register the team's LangGraph agent as a Bot, write CEL deny rules for payment URLs and shell commands, and review /admin/audit for refusals. The software is MIT; Intelligence costs $49 a month plus graduated usage past 10,000 interactions.
An operations lead running a five-person support team
Have an agent triage tickets and hand over when it reaches a login it should not pass alone
Copy the ticket-triage coworker from examples/fintech/catalog into agents, connect Slack or Teams, and take the wheel when the Bot asks for help; control changes are logged. The free Intelligence tier's 1,000 interactions a month suits a pilot, not a full queue.
A security engineer evaluating agent platforms
Check that an agent cannot act without a record existing first
Run it on a laptop, ask a Bot to fill a test form, then add a deny rule in /admin/boundaries and retry. Turn off single-user mode and set real tokens before it leaves the machine.
Before you commit
- Setup
- Clone, `cp .env.example .env`, `bun install`, connect an Intelligence project with `npx copilotkit@latest login`, add a model key, then `bash scripts/start.sh` and open localhost:3010. Needs Docker and Bun 1.3+; a single published image at ghcr.io/copilotkit/openbot covers deployment without Kubernetes, and a Helm chart exists.
- Integrations
- Any AG-UI endpoint (LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK); OpenAI, Anthropic and Google models with base-URL overrides for gateways; Google Drive, Notion, Parallel, Exa and Firecrawl MCP servers, with Composio for a few hundred more apps; Slack, Microsoft Teams and SMS; Google, Microsoft, Okta, SAML and OIDC sign-in.
- Data and privacy
- Product data, policy, audit and encrypted credentials sit in your PostgreSQL; threads and memory go to CopilotKit Intelligence, hosted or self-hosted. Bot browsers hold real logins and bind to 127.0.0.1 with per-container tokens. The desktop app sends telemetry by default; `COPILOTKIT_TELEMETRY_DISABLED=true` or `DO_NOT_TRACK=1` turns it off.
- Cost at scale
- Each instance needs 2 GB of memory at minimum and 4 GB recommended, with roughly 1 GB more per concurrent browser by Playwright's guidance. Intelligence is $49 a month per organisation with 10,000 interactions included, then graduated rates not published on the pricing page; SSO for Intelligence and offline deployment are Annual only.
- Limits
- Beta, with 27 open issues; replicas share one browser because the supervisor is not in the image; routines have a 15-minute floor and a cap of 20 enabled, and switch off after ten failures in a row.
What's good
- Fail-closed CEL policy checked before every action
- Audit trail names the rule behind each refusal
- One container, browser and workspace per Bot
- Any AG-UI agent, from LangGraph to hand-written
What's not
- Will not start without CopilotKit Intelligence
- Ships single-user admin mode and fixed dev tokens
- Beta template; structure changed between minor releases
- Needs Docker, Bun, Postgres and a model key
Best for
Platform teams that want self-hosted agents with per-action policy and audit, and are prepared to fork and maintain a template.
OpenBot alternatives
OpenBot: common questions
- Is OpenBot worth it?
- OpenBot gets agent governance right, with a fail-closed gateway in front of every action, but it is a beta template tied to CopilotKit's paid memory service rather than something you can install and run. We rate it 3.8 out of 5.
- How much does OpenBot cost?
- MIT licence. Requires CopilotKit Intelligence: Free ($0) hosted tier with 1,000 interactions per organisation a month; Pay as you go $49/month with 10,000 interactions included; Annual custom. You supply the model key.
- What are the downsides of OpenBot?
- Will not start without CopilotKit Intelligence; ships single-user admin mode and fixed dev tokens; beta template; structure changed between minor releases; needs Docker, Bun, Postgres and a model key.
- Who is OpenBot best for?
- Platform teams that want self-hosted agents with per-action policy and audit, and are prepared to fork and maintain a template.
- How much does OpenBot cost for a team or in production?
- Each instance needs 2 GB of memory at minimum and 4 GB recommended, with roughly 1 GB more per concurrent browser by Playwright's guidance. Intelligence is $49 a month per organisation with 10,000 interactions included, then graduated rates not published on the pricing page; SSO for Intelligence and offline deployment are Annual only.
- Is OpenBot safe for company data?
- Product data, policy, audit and encrypted credentials sit in your PostgreSQL; threads and memory go to CopilotKit Intelligence, hosted or self-hosted. Bot browsers hold real logins and bind to 127.0.0.1 with per-container tokens. The desktop app sends telemetry by default; `COPILOTKIT_TELEMETRY_DISABLED=true` or `DO_NOT_TRACK=1` turns it off.
- What are the best OpenBot alternatives?
- The closest alternatives we have reviewed are Magentic-UI (MagenticLite), OpenSandbox and Coze Studio.
Answers checked Oct 28, 2026.