{"slug": "show-hn-open-bot-an-open-source-grok-bot-that-works-with-any-agent-harness", "title": "Show HN: Open Bot – an open-source Grok Bot that works with any agent harness", "summary": "CopilotKit released Open Bot, an open-source agent platform that runs on a user's own machine and lets any AG-UI agent operate a real browser, files, and tools through a governance gateway that decides and records every action. The alpha release includes Docker Compose setup, PostgreSQL storage, and three configurable coworkers (General Assistant, Knowledge, Risk Analyst), with support for agents built on LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK, or hand-written. Open Bot requires a CopilotKit Intelligence license and a model key, and is available at copilotkit.ai/openbot.", "body_md": "**AI coworkers you can hand real work to, and actually trust with the access.** Each gets a computer of its own: a real browser with its own logins, its own files, and only the tools you grant. Every action decided before it happens and recorded after.\n\n[ copilotkit.ai/openbot](https://copilotkit.ai/openbot) ·\n\n[·](#quick-start)\n\n**Quick start**[·](#features)\n\n**Features**[·](#bring-your-own-agent)\n\n**Bring your own agent**[·](#architecture)\n\n**Architecture**\n\n**Docs**## demo-openbot.mp4\n\nBring any AG-UI agent, written on a framework or by hand, and it arrives as a coworker with a channel of its own. Watch it work on its own screen, take the wheel when it reaches something it should not do alone, then hand it back. It answers with components rather than only prose, and the whole thing runs on your own machine.\n\nAlpha, and under active development.OpenBot is early. Expect rough edges and bugs, and expect things to move. Issues and pull requests are welcome.\n\nRuns on your machine.Everything below is written for a laptop. Out of the box OpenBot runs with`OPENBOT_DEV_NO_AUTH`\n\n, which skips signing in and admits every request as one administrator.[Google sign-in]can be wired up instead.\n\nAn agent platform that runs inside your own infrastructure. Docker Compose brings up every part of it, the data sits in your PostgreSQL, and the model is yours to choose: no model ships in the box, and an administrator supplies the credential, which is encrypted at rest and never logged.\n\nThree coworkers ship in the example package, and they are configuration rather than code: **General Assistant** for everyday work, **Knowledge** for company questions, **Risk Analyst** for risk and compliance. Add your own by editing `agents.yaml`\n\nor from `/agents`\n\nin the UI.\n\nAnything a Bot does to a computer, a file, an MCP server or a component goes through one gateway that decides and records it. That is the difference between an agent that can use your tools and an agent you can let near them.\n\nMore at [copilotkit.ai/openbot](https://copilotkit.ai/openbot).\n\nA Bot is any endpoint speaking [AG-UI](https://github.com/ag-ui-protocol/ag-ui), the open protocol for agent-to-user interaction, so OpenBot is not tied to a framework and neither are you. Agents built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or written by hand all arrive the same way, and the governance rides the protocol rather than the framework.\n\n- Docker, for PostgreSQL, browser computers, the supervisor, and the shipped Bots.\n[Bun](https://bun.sh)1.3+, for the app and API server.- A CopilotKit Intelligence project and license.\n- A model key. The proof-of-concept Bot uses OpenAI; the LangGraph Bot can use OpenAI, Anthropic, or Google.\n\n-\nCreate\n\n`.env`\n\n:\n\n```\ncp .env.example .env\n```\n\n-\nGet CopilotKit Intelligence credentials:\n\n```\nnpx --yes copilotkit@latest login\nnpx --yes copilotkit@latest project select\nnpx --yes copilotkit@latest license --write\n```\n\nPut the\n\n`cpk-...`\n\nruntime key from`project select`\n\nin`.env`\n\nas`INTELLIGENCE_API_KEY`\n\n.`license --write`\n\nwrites`COPILOTKIT_LICENSE_TOKEN`\n\ninto the existing`.env`\n\n. -\nFill the remaining required values:\n\n`OPENAI_API_KEY`\n\nKeep the managed Intelligence URLs from\n\n`.env.example`\n\nunless you run Intelligence yourself. The example`KEY_ENCRYPTION_KEY`\n\nis public and fine locally; generate your own with:\n\n```\nopenssl rand -base64 32\n```\n\n-\nInstall and run:\n\n```\nbun install\nbash scripts/start.sh\n```\n\n-\nOpen\n\n[http://localhost:3010](http://localhost:3010).\n\n`scripts/start.sh`\n\nstarts Docker services, applies migrations, starts the API server on port 3001, starts the app on port 3010, and checks that the services answer their own health routes before printing next steps.\n\n- Open\n`/bot`\n\nand ask:`Open news.ycombinator.com and tell me the top story.`\n\n- Ask the Bot to fill out\n[https://httpbin.org/forms/post](https://httpbin.org/forms/post), then inspect`/admin/audit`\n\n. - Open\n`/admin/boundaries`\n\n, add a deny rule or preset, and retry the same browser action. - Create a coworker from\n`/agents`\n\n, give it a standing role, and start a channel with it.\n\n| Route | Purpose |\n|---|---|\n`/` |\nStart and browse channels. |\n`/agents` |\nCreate, edit, duplicate, hide, delete, and launch coworkers. |\n`/channel/:id` |\nConverse with one coworker and view its live screen/profile panel. |\n`/bot` |\nDirect chat with a Bot; `?agent=<id>` selects one. |\n`/skills` |\nCreate and enable personal skills. |\n`/settings` |\nUser preferences. |\n`/admin/connectors` |\nConfigure deployment knowledge sources. |\n`/admin/credentials` |\nStore write-only encrypted credentials. |\n`/admin/computers` |\nView, stop, and reset Bot computers. |\n`/admin/boundaries` |\nConfigure browser/file/MCP action policy. |\n`/admin/components` |\nPublish components and govern which Bots may use them. |\n`/admin/playground` |\nDraft and publish sandboxed components in the browser. |\n`/admin/plugins` |\nConfigure MCP servers, MCP grants, and deployment skills. |\n`/admin/audit` |\nReview permitted, refused, and failed actions. |\n\n**A computer per Bot**: the supervisor gives each Bot its own container, its own`/workspace`\n\nvolume and its own browser profile. Set`COMPUTER_RUNTIME=runsc`\n\nto run them under gVisor where the host supports it.**The gateway is the only way in**: it resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer. There is no path that acts without the record existing first.**CEL policy, fail closed**: rules can inspect`tool.name`\n\n,`intent`\n\n,`bot.id`\n\n,`actor.id`\n\n,`page.url`\n\n,`page.host`\n\n,`element.*`\n\n,`key`\n\n,`file.*`\n\nand`mcp.*`\n\n. Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens.**Take the wheel**: a Bot that hits a login wall or a 2FA prompt asks for help. Control is handed over in the same panel and recorded as`computer.help_requested`\n\n,`computer.control_taken`\n\nand`computer.control_released`\n\n. While a person is driving, Bot actions are refused rather than queued.**Secrets never enter the transcript**: the trail records that a secret was requested and how long it was, not what it said.** Bring your own agent**: any AG-UI endpoint is a Bot, on a framework or hand written. Endpoints are validated with the same target checks used for browser navigation, and an auth header is stored write-only.**Components instead of prose**: compiled React components live in`app/src/components/gallery/`\n\n, sandboxed ones are authored in`/admin/playground`\n\nand published with no deployment. Every call asks the server whether the component exists, is published, and is not withheld from that Bot. Data functions are granted per component.**Governed MCP**: a curated catalogue ships for Atlassian, Box, Slack, Salesforce and ServiceNow. Custom servers must pass URL checks, and any tool not positively classified as a read is treated as a write.**Skills are instructions, not capabilities**: personal skills attach only to Bots their author owns, deployment skills are admin-owned, and both are invoked with`/`\n\nin the composer.**An audit trail you can read**:`/admin/audit`\n\nlists what was permitted, what was refused and what failed, and every refusal carries the rule that caused it.**Credentials encrypted at rest**: stored through`/admin/credentials`\n\n, never returned by an API, and redacted from audit events.**Loopback by default**: computers bind to`127.0.0.1`\n\nand require a per-container token, so nothing reaches a logged-in browser by knowing its port.**Durable threads and memory**: conversations survive restarts through CopilotKit Intelligence, and each deployment stamps the threads it owns.\n\nAny AG-UI endpoint can be a Bot.\n\nFrom `/agents`\n\n, create a coworker with:\n\n- name, title, and role description;\n- private or public visibility;\n- optional AG-UI endpoint;\n- optional write-only authorization header.\n\nThe server validates agent endpoints with the same target checks used for browser navigation. If no custom endpoint is set, product-created coworkers use `MANAGED_AGENT_AG_UI_URL`\n\n.\n\nTenant package agents are declared in `agents.yaml`\n\nas either:\n\n`built-in`\n\n, with a system prompt; or`remote-ag-ui`\n\n, with an endpoint.\n\nSee [docs/configuration.md](/CopilotKit/openbot/blob/main/docs/configuration.md) and [docs/coworkers.md](/CopilotKit/openbot/blob/main/docs/coworkers.md).\n\n`.env.example`\n\nis the source template. The API server refuses to start without:\n\n`DATABASE_URL`\n\n`KEY_ENCRYPTION_KEY`\n\n`MANAGED_AGENT_AG_UI_URL`\n\n`INTELLIGENCE_API_URL`\n\n`INTELLIGENCE_GATEWAY_WS_URL`\n\n`INTELLIGENCE_API_KEY`\n\n`COPILOTKIT_LICENSE_TOKEN`\n\nSettings worth knowing:\n\n| Variable | Use |\n|---|---|\n`OPENBOT_DEV_NO_AUTH` |\nAdmits every request as one administrator. How OpenBot runs today. |\n`COMPUTER_TOKEN` |\nSecret every Bot computer request must present. `start.sh` sets one. |\n`SUPERVISOR_TOKEN` |\nSecret the supervisor requires. `start.sh` sets one. |\n`COMPUTER_SUPERVISOR_URL` |\nGives each Bot a computer of its own instead of one shared computer. |\n`COMPUTER_RUNTIME` |\nSet to `runsc` to run computers under gVisor, where the host has it. |\n`AGENT_COMPUTER_POLICY` |\nJSON action policy. Malformed JSON stops server startup. |\n`AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS` |\nLets a Bot reach this machine's own services. |\n`TENANT_PACKAGE_DIR` |\nDirectory containing tenant YAML. Defaults to `../examples/fintech` . |\n`DEPLOYMENT_ID` |\nNames this deployment when two share one Intelligence project. |\n\nFull reference: [docs/configuration.md](/CopilotKit/openbot/blob/main/docs/configuration.md).\n\n| Service | Port | Purpose |\n|---|---|---|\n`app` |\n3010 | React/Vite UI. |\n`server` |\n3001 | Hono API, CopilotKit runtime, auth, policy, audit, plugins, components, coworkers, and channels. |\n`agent-computer` |\n4100 | Chromium plus `/workspace` and browser profile. |\n`agent-bot` |\n4200 | Proof-of-concept AG-UI Bot. |\n`agent-langgraph` |\n4201 | LangGraph AG-UI Bot. |\n`supervisor` |\n4500 host / 4300 container | Creates and manages one computer per Bot. |\n| PostgreSQL with pgvector | 5432 | Product data, policy, audit, credentials, grants, channels, knowledge, and component metadata. |\n| CopilotKit Intelligence | external | Durable threads and memory. |\n\nThe server gateway is the product/API path for Bot browser and file tool calls.\nIt resolves the target, evaluates policy, writes an audit row, and then calls\n`agent-computer`\n\n. The computer also exposes lower-level token-protected service\nendpoints; keep them private and do not use them to bypass the gateway.\n\nMore detail: [docs/architecture.md](/CopilotKit/openbot/blob/main/docs/architecture.md).\n\n`OPENBOT_DEV_NO_AUTH`\n\nis the default because it needs no OAuth credentials and no consent screen. To sign in for real instead, create a Google OAuth client and set all four of these together:\n\n```\nBETTER_AUTH_URL=http://localhost:3001\nBETTER_AUTH_SECRET=        # openssl rand -base64 32, at least 32 characters\nGOOGLE_OAUTH_CLIENT_ID=\nGOOGLE_OAUTH_CLIENT_SECRET=\n```\n\nThen set the two that decide who gets in and from where:\n\n`TRUSTED_ORIGINS`\n\n— where the app is served from,`http://localhost:3010`\n\nlocally. It defaults to`http://localhost:3000`\n\n, which is not where`start.sh`\n\nserves the app.`INITIAL_ADMIN_EMAILS`\n\n— comma separated. An address listed here becomes an administrator the first time it signs in; everybody else becomes a user.\n\nRemove `OPENBOT_DEV_NO_AUTH`\n\n, then restart: the sign-in button is written into the app's generated config at startup, so it appears only once all four settings are present. Accounts, sessions and roles are stored in the same PostgreSQL database as everything else.\n\nA partial set is refused rather than ignored: the server will not start with `BETTER_AUTH_SECRET`\n\nor `BETTER_AUTH_URL`\n\nbut no client credentials, or with a secret shorter than 32 characters.\n\n`agent-computer`\n\ndrives a browser holding real logins.`docker-compose.yml`\n\nbinds it to loopback; leave it there.- Store credentials through\n`/admin/credentials`\n\n, which encrypts them. Do not put credential values in tenant YAML or in committed files. `AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS`\n\nlets a Bot reach services on this machine. Unset it if you would rather it could not.\n\n```\nbun run format:check\nbun run lint\nbun run typecheck\nbun run test\nbun run build\n```\n\nAfter changing the Drizzle schema:\n\n```\nbun run --filter server db:generate\nbun run --filter server db:migrate\n```\n\nUse `bash scripts/start.sh`\n\nfor the whole stack. Use `bun run dev`\n\nonly when you want the app and server without the Docker Bots and computers.\n\n[copilotkit.ai/openbot](https://copilotkit.ai/openbot)[docs/README.md](/CopilotKit/openbot/blob/main/docs/README.md)[docs/architecture.md](/CopilotKit/openbot/blob/main/docs/architecture.md)[docs/configuration.md](/CopilotKit/openbot/blob/main/docs/configuration.md)[docs/development.md](/CopilotKit/openbot/blob/main/docs/development.md)[docs/coworkers.md](/CopilotKit/openbot/blob/main/docs/coworkers.md)\n\n- Open an issue or coordinate before starting substantial work.\n- Keep changes focused and update docs when setup, configuration, architecture, or user behavior changes.\n- Keep secrets, service-account JSON, customer data, and local transcripts out of the repository.\n- Run the checks in\n[Development](#development)before opening a pull request.\n\n[MIT](/CopilotKit/openbot/blob/main/LICENSE) © CopilotKit", "url": "https://wpnews.pro/news/show-hn-open-bot-an-open-source-grok-bot-that-works-with-any-agent-harness", "canonical_source": "https://github.com/copilotkit/openbot", "published_at": "2026-08-19 18:45:48+00:00", "updated_at": "2026-08-19 18:59:26.061321+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "ai-infrastructure", "ai-safety"], "entities": ["CopilotKit", "Open Bot", "AG-UI", "LangGraph", "Mastra", "CrewAI", "Pydantic AI", "Google ADK"], "alternates": {"html": "https://wpnews.pro/news/show-hn-open-bot-an-open-source-grok-bot-that-works-with-any-agent-harness", "markdown": "https://wpnews.pro/news/show-hn-open-bot-an-open-source-grok-bot-that-works-with-any-agent-harness.md", "text": "https://wpnews.pro/news/show-hn-open-bot-an-open-source-grok-bot-that-works-with-any-agent-harness.txt", "jsonld": "https://wpnews.pro/news/show-hn-open-bot-an-open-source-grok-bot-that-works-with-any-agent-harness.jsonld"}}