A key line in the OpenBot README is about ordering. When a Bot acts on its computer, the gateway resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer. In the README's words, there is no path that acts without the record existing first.
The tagline says every action is "decided before it happens and recorded after." The Features section is more specific, and the specifics locate that trust claim in the single gateway used for computer, file, MCP server and component actions.
One gateway, one order of operations
Anything a Bot does to a computer, a file, an MCP server or a component "goes through one gateway that decides and records it," and the README frames that as the difference between an agent that can use your tools and an agent you can let near them.
The decision step uses CEL policy. Rules can inspect tool.name, intent, bot.id, actor.id, page.url, page.host, element.*, key, file.* and mcp.*. Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens. The README calls this fail closed. When the gateway refuses, it names the rule that did it.
Shell commands pass through the same gate. A Bot can run commands in its workspace and install what it needs, and a rule can refuse a shell outright or refuse particular commands, and the command is on the record either way. It inherits PATH, locale, terminal and proxy variables, not the rest of the deployment's environment.
What gets recorded, and what does not
The README limits what the trail records when a Bot requests a secret. The trail records that a secret was requested and how long it was, not what it said. The Activity tab shows what a Bot ran, read and saved, with the output, but a saved file shows its path and size rather than its contents. Administrators review permitted, refused and failed actions at /admin/audit.
Human intervention lands in the record too. A Bot that hits a login wall or a 2FA prompt asks for help, and control is handed over in the same panel, logged as computer.help_requested, computer.control_taken and computer.control_released. While a person is driving, Bot actions are refused rather than queued. That detail is easy to skim past.
The computer behind the gate
The supervisor gives each Bot its own container, its own /workspace volume and its own browser profile, so logins belong to one coworker. Setting COMPUTER_RUNTIME=runsc runs those containers under gVisor where the host supports it.
Bots arrive over AG-UI, so an agent built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or by hand arrives the same way. The governance rides the protocol rather than the framework. Endpoints you bring are validated with the same target checks used for browser navigation, and their auth header is stored write-only. MCP follows suit: Google Drive and Notion ship in the catalogue, reached as the person asking, custom servers must pass URL checks, and unknown tools and custom-server tools are treated as writes.
Read the fine print before you deploy it
OpenBot is candid about what it is. The README calls it "a template, not a product." There is no hosted version, nothing is published as a package to depend on, and you are expected to replace the example tenant package under examples/ with your own coworkers, channels and skills. It is also marked alpha, with rough edges and moving parts expected.
The default configuration deserves a look. .env.example sets OPENBOT_SINGLE_USER=true, which admits every request as one administrator so a fresh clone works without registering an OAuth client. Sign-in turns that off, and the README says it is required before anybody else can reach the deployment.
The README's own walkthrough shows the gateway: ask a Bot at /bot to fill out a test form, inspect /admin/audit, then add a deny rule or preset at /admin/boundaries and retry the same browser action. Running it locally takes Docker, Bun 1.3 or later, a CopilotKit Intelligence project and a model key, and scripts/start.sh starts the services, applies migrations and checks health routes before printing next steps.
GitHub: https://github.com/CopilotKit/OpenBot
Curated by Agent Palisade — practical AI for small and mid-sized businesses.
Top comments (0)