What is OpenWorker?
OpenWorker is an open-source desktop agent from Andrew Ng's GitHub account that takes a task (review this codebase for vulnerabilities, prepare a customer brief, triage an inbox) and returns a finished file or message rather than a chat reply. It runs a local Python agent server under a Tauri desktop shell, is built on Ng's aisuite library, and ships specialist security coworkers first.
It is model-agnostic: OpenAI, Anthropic, Gemini, Azure OpenAI, DeepSeek, Kimi, Qwen, Mistral and more through your own key, OpenRouter, or local models through Ollama, llama.cpp, vLLM or LM Studio. It reaches more than 25 apps (GitHub, Slack, Jira, Notion, Linear, HubSpot, Gmail, Google Calendar) plus any MCP server, and can run its shell and file tools inside an NVIDIA OpenShell container, the macOS sandbox or a hidden Windows account.
The repository was created on 20 July 2026, is MIT-licensed and has about 18,800 GitHub stars. The README calls it an open beta; v0.3.1 shipped on 5 October 2026, and the macOS build is signed while the Windows build is not yet.
Is OpenWorker worth it?
OpenWorker's governance design is its best argument, and the project's age is its biggest caveat. Writes, sends and shell commands are approval-gated by default; a set of irreversible operations is human-only in every mode, including full auto-approve; and one-off approvals can graduate into standing rules and then config allowlists, each step visible and revocable. In auto-approve mode a reviewer model passes routine actions and escalates the rest, and repeated denials trip a circuit breaker that hands control back. The README is candid that reviewer verdicts are judgements, not guarantees, and that the hard floors and audit trail are the real backstop.
The security coworkers are more careful than the usual agent demo. Findings come from deterministic scanners such as semgrep plus model reasoning, and proposed fixes are re-scanned and diff-reviewed before you approve them, so the agent that writes the fix is never its only checker. Commands can run in an OpenShell container that holds the session's folders and an allow-listed network and nothing else; the agent loop, model keys and connector tokens stay outside it, so a prompt injection that reaches a shell lands in an empty box. Unattended scheduled runs never self-approve; their requests wait in an inbox.
Most of the work stays on your machine. Conversations, connector tokens and model keys live in a local secret store; the only cloud component brokers OAuth handshakes, and the app works signed out with keys you create yourself. Signing in turns on a content-free telemetry event (which coworker type started, and when) by default, with an opt-out; signed out, nothing is sent, according to the source.
The weight is maturity. The repository is three months old, carries about 374 open issues and pull requests, and is still at version 0.3.1. The contributing notes warn that pull requests adding features already under internal development, or outside the maintainers' vision, may be declined, which makes this a product with an open licence more than a community project. Against OpenBot, which has a stricter policy engine but needs a paid memory service, OpenWorker is the easier install for one person; against Goose it is narrower but far more opinionated about approvals.
Where it earns its place
An application security engineer at a 60-developer company
Review a service and its dependencies for real vulnerabilities and get fixes ready
Point the security coworker at the repository; semgrep findings plus model reasoning come back with proposed fixes that are re-scanned and diff-reviewed before approval. Free software; cost is model tokens on your own key, or none with a local model.
A customer success manager handling 40 accounts
Prepare a call brief from the CRM and inbox before each meeting
Connect HubSpot and Gmail through the optional OAuth broker or your own credentials and ask for a brief; sends and calendar changes wait for approval. A scheduled morning brief lands in the app with a full transcript.
An on-call engineer at a 20-person startup
Gather context across Jira, GitHub and Slack during an incident and draft the timeline
Run the incident-triage coworker with shell commands inside an OpenShell or macOS sandbox, so diagnostic commands touch only the session folder and allow-listed hosts. Each tool call is logged as auto-approved, user-approved or denied.
Before you commit
- Setup
- Download the signed macOS 12+ build or the unsigned Windows 10/11 build, add a model key or point it at Ollama, and give it a task. From source it needs Python 3.10+, Node 20+ and Rust for the desktop shell.
- Integrations
- More than 25 connectors including GitHub, Slack, Jira, Notion, Linear, HubSpot, Outlook, monday.com, Gmail and Google Calendar, plus any MCP server with per-tool control; a Slack mention opens a desktop session and replies in the thread. Built on aisuite.
- Data and privacy
- Agent loop, conversations, keys and connector tokens stay in a local secret store; only an OAuth broker runs in the cloud. Signed-in users send a content-free session telemetry event by default, with an opt-out. MIT licence.
- Cost at scale
- No paid edition. Cost is model usage per task on your own provider account; a local model through Ollama removes it, though the project only vouches for the models on its curated list for tool-calling work.
- Limits
- Beta with about 374 open issues and pull requests; Windows installer unsigned; reviewer-model approvals are judgements, not guarantees; PRs outside the maintainers' roadmap may be declined.
What’s good
- Hard human-only floors no auto-approve mode can lower
- Security fixes re-scanned and diff-reviewed before approval
- OpenShell, macOS or Windows sandbox for agent commands
- Any model by key, OpenRouter or local through Ollama
What’s not
- Open beta, three months old, about 374 open issues and PRs
- Windows build not yet code-signed
- Maintainers may decline features outside their own plan
- Signed-in telemetry is on by default
Best for
Security engineers and individual knowledge workers who want a local agent that asks before it acts and keeps a record of who approved what.
OpenWorker alternatives
OpenWorker: common questions
- Is OpenWorker worth it?
- OpenWorker puts the approval gates and audit trail where they belong, in the architecture, but it is a three-month-old beta whose roadmap is set by an internal list rather than its contributors. We rate it 3.9 out of 5.
- How much does OpenWorker cost?
- Free and open source (MIT). No paid plan; you pay your model provider, or nothing with a local model. An optional free account brokers OAuth for connectors.
- What are the downsides of OpenWorker?
- Open beta, three months old, about 374 open issues and PRs; windows build not yet code-signed; maintainers may decline features outside their own plan; signed-in telemetry is on by default.
- Who is OpenWorker best for?
- Security engineers and individual knowledge workers who want a local agent that asks before it acts and keeps a record of who approved what.
- How much does OpenWorker cost for a team or in production?
- No paid edition. Cost is model usage per task on your own provider account; a local model through Ollama removes it, though the project only vouches for the models on its curated list for tool-calling work.
- Is OpenWorker safe for company data?
- Agent loop, conversations, keys and connector tokens stay in a local secret store; only an OAuth broker runs in the cloud. Signed-in users send a content-free session telemetry event by default, with an opt-out. MIT licence.
- What are the best OpenWorker alternatives?
- The closest alternatives we have reviewed are OpenBot, goose, Hermes Agent and Magentic-UI (MagenticLite).
Answers checked Oct 31, 2026.