Give AI colleagues isolated computers with pre-approved actions and full audit trails
While AI reads web pages and handles files, you watch the screen and take over controls only when needed. OpenBot is a tool that lets AI agents perform tasks in isolated computer environments and logs every step to an audit trail. You can connect existing agents via protocol and use them immediately.
Isolated computers and controlled access
Each AI colleague has its own container, browser profile, and file folder. This environment is connected only to localhost by default, making it inaccessible from outside, and is protected by per-container tokens. If the AI gets stuck on login or two-factor authentication, it hands control to the user, who can handle it directly and then pass it back to the AI. During this time, AI actions are rejected immediately rather than queued to prevent confusion. All command executions and file accesses are performed only after policies are evaluated through a gateway, and the reasons for rejection are also recorded.
Connect any agent via the AG-UI protocol
OpenBot is not dependent on a specific framework and accepts any endpoint using the AG-UI protocol as an AI colleague. Agents built with various tools like LangGraph, Mastra, and CrewAI, or those coded directly, are integrated in the same way. Agent endpoints must pass the same security checks as browser navigation, and authentication headers are stored as read-only. This structure allows governance policies to be applied at the protocol level rather than the framework level, enabling consistent control.
Policy-based action restrictions and auditing
You can finely restrict the actions an AI can perform using policy rules written in the CEL language. Various variables such as tool name, intent, bot ID, page URL, and execution command can be used as conditions, and rejection rules are evaluated before permission rules. Even if there are no policies or if rules are broken, the system remains in a closed state rather than open. All allowed, rejected, and failed actions are recorded in the audit log, and rejected actions display the rule that caused the rejection. Stored credentials are encrypted and not returned via the API, and they are masked in audit events.
Execution environment and requirements
To run the open-source template locally, you need Docker, Bun 1.4 or higher, a CopilotKit Intelligence project and license, and a model API key. Docker Compose starts PostgreSQL and supporting services, and model credentials are stored encrypted. The Personal Edition provides installers for Mac and Windows, running the workspace and intelligence locally as a desktop app. The Business Edition offers deployment via Helm charts or a CopilotKit-hosted option, and is currently in the early access stage. When running locally, you can start in admin mode with the OPENBOT_SINGLE_USER=true setting, but you must complete login configuration before allowing access to other users.
Suitable targets and verification items
This is suitable for teams where security and control are important when AI agents interact with actual business tools. It is particularly useful in environments that need a structure to restrict AI actions in advance and audit them afterward. Before adoption, you should check Docker and Bun version requirements and verify the status of the CopilotKit Intelligence license. When running locally, you must accurately set the required variables in the .env file, and specifically, KEY_ENCRYPTION_KEY must be generated directly rather than using public example values. When registering agent endpoints, they must be included in the allowed host list, and private addresses must be explicitly allowed. This tool is designed to meet the needs of organizations that want to increase AI autonomy while maintaining human control.
