Kayco OpenBot

AI coworkers you can hand real work to, and actually trust with the access. Each gets a computer of its own: a real browser with its own logins, its own files, and only the tools you grant. Every action decided before it happens and recorded after.

Fork policy · Quick start · Features · Bring your own agent · Architecture · Docs

Kayco product fork. This repository is maintained independently from CopilotKit OpenBot. Product changes belong here; upstream improvements arrive through reviewed synchronization merges. See the fork ownership and synchronization policy.

demo-openbot.mp4

Bring any AG-UI agent, written on a framework or by hand, and it arrives as a coworker with a channel of its own. Watch it work on its own screen, take the wheel when it reaches something it should not do alone, then hand it back. It answers with components rather than only prose, and the whole thing runs on your own machine.

Alpha, and under active development. OpenBot is early. Expect rough edges and bugs, and expect things to move. Issues and pull requests are welcome.

Runs on your machine. Everything below is written for a laptop. Out of the box OpenBot runs with OPENBOT_DEV_NO_AUTH, which skips signing in and admits every request as one administrator. Google sign-in can be wired up instead.

What it is

An agent platform that runs inside your own infrastructure. Docker Compose brings up every part of it, the data sits in your PostgreSQL, and the model is yours to choose: no model ships in the box, and an administrator supplies the credential, which is encrypted at rest and never logged.

Three coworkers ship in the example package, and they are configuration rather than code: General Assistant for everyday work, Knowledge for company questions, Risk Analyst for risk and compliance. Add your own by editing agents.yaml or from /agents in the UI.

Anything a Bot does to a computer, a file, an MCP server or a component goes through one gateway that decides and records it. That is the difference between an agent that can use your tools and an agent you can let near them.

More at copilotkit.ai/openbot.

Built on AG-UI

A Bot is any endpoint speaking AG-UI, the open protocol for agent-to-user interaction, so OpenBot is not tied to a framework and neither are you. Agents built with LangGraph, Mastra, CrewAI, Pydantic AI, Google ADK or written by hand all arrive the same way, and the governance rides the protocol rather than the framework.

Requirements

• Docker, for PostgreSQL, browser computers, the supervisor, and the shipped Bots.
• Bun 1.3+, for the app and API server.
• A CopilotKit Intelligence project and license.
• A model key. The proof-of-concept Bot uses OpenAI; the LangGraph Bot can use OpenAI, Anthropic, or Google.

Quick start

1. Create .env:

   cp .env.example .env

2. Get CopilotKit Intelligence credentials:

   npx --yes copilotkit@latest login
   npx --yes copilotkit@latest project select
   npx --yes copilotkit@latest license --write

   Put the cpk-... runtime key from project select in .env as INTELLIGENCE_API_KEY. license --write writes COPILOTKIT_LICENSE_TOKEN into the existing .env.

3. Fill the remaining required values:

   • OPENAI_API_KEY
   • MANAGED_AGENT_TOKEN (generate with openssl rand -base64 32)

   Keep the managed Intelligence URLs from .env.example unless you run Intelligence yourself. The example KEY_ENCRYPTION_KEY is public and fine locally; generate your own with:

   openssl rand -base64 32

4. Install and run:

   bun install
   bash scripts/start.sh

5. Open http://localhost:3010.

scripts/start.sh starts Docker services (including the connector worker), applies migrations, starts the API server on port 3001, starts the app on port 3010, and checks that the services answer their own health routes before printing next steps.

Try it

• Open /bot and ask: Open news.ycombinator.com and tell me the top story.
• Ask the Bot to fill out https://httpbin.org/forms/post, then inspect /admin/audit.
• Open /admin/boundaries, add a deny rule or preset, and retry the same browser action.
• Create a coworker from /agents, give it a standing role, and start a channel with it.

Main surfaces

Route	Purpose
/	Start and browse channels.
/agents	Create, edit, duplicate, hide, delete, and launch coworkers.
/channel/:id	Converse with one or more coworkers, select who answers, and view that Bot's live screen/profile panel.
/work	Run the durable queue, routines, monitors, external channels, reviewed learning, fallbacks, handoffs, projects, notifications, and inspectable memory.
/bot	Direct chat with a Bot; ?agent=<id> selects one.
/skills	Create and enable personal skills.
/settings	User preferences.
/admin/connectors	Configure deployment knowledge sources.
/admin/credentials	Store write-only encrypted credentials.
/admin/computers	View, stop, and reset Bot computers.
/admin/boundaries	Configure browser/file/MCP action policy.
/admin/components	Publish components and govern which Bots may use them.
/admin/playground	Draft and publish sandboxed components in the browser.
/admin/plugins	Configure MCP servers, MCP grants, and deployment skills.
/admin/audit	Review permitted, refused, and failed actions.

Features

• A computer per Bot: the supervisor gives each Bot its own container, its own /workspace volume and its own browser profile. Set COMPUTER_RUNTIME=runsc to run them under gVisor where the host supports it.
• The gateway is the only way in: it resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer. There is no path that acts without the record existing first.
• CEL policy, fail closed: rules can inspect tool.name, intent, bot.id, actor.id, page.url, page.host, element.*, key, file.* and mcp.*. Deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens.
• Fast, visible computer use: actions return the changed page and fresh controls together, Bot computers are prewarmed, and one reconnecting live stream powers the resizable watch/full-screen experience without duplicate screenshot polling.
• Take the wheel: a Bot that hits a login wall or a 2FA prompt asks for help. Control is handed over in the same panel and recorded as computer.help_requested, computer.control_taken and computer.control_released. While a person is driving, Bot actions are refused rather than queued. Keyboard focus, paste, and direct file upload stay on the remote page and out of the model conversation.
• A conversation workspace: Ctrl/⌘ K opens commands, channel search jumps between matching messages, unsent text survives a reload, and messages can carry files and durable reactions. A Bot can also pin a point-in-time screenshot into the transcript.
• Multi-Bot Workrooms: a channel can hold up to six coworkers while an explicit responder switch keeps tool, model, and computer ownership unambiguous.
• Continuity you can inspect: Context Vault searches an owner-scoped transcript projection, Bots can recover exact prior details with anchored search, and long threads receive extractive recovery snapshots instead of silently losing their middle.
• Workspace Time Machine: every Bot text write creates a pre-write checkpoint. File-selective rollback preserves later human edits by default and creates an inverse checkpoint so the rollback itself can be undone.
• Visible model context: built-in Codex coworkers show their selected model, reasoning level, allowance windows, and reported token usage. Kayco does not invent a dollar cost when the connected subscription does not provide one.
• Secrets never enter the transcript: the trail records that a secret was requested and how long it was, not what it said.
• Bring your own agent: any AG-UI endpoint is a Bot, on a framework or hand written. Endpoints are validated with the same target checks used for browser navigation, and an auth header is stored write-only.
• Components instead of prose: compiled React components live in app/src/components/gallery/, sandboxed ones are authored in /admin/playground and published with no deployment. Every call asks the server whether the component exists, is published, and is not withheld from that Bot. Data functions are granted per component.
• Governed MCP with OAuth: a curated catalogue ships for Atlassian, Box, Slack, Salesforce and ServiceNow. Servers can use a write-only bearer token or OAuth discovery, dynamic registration and PKCE; encrypted tokens, grants, policy, approvals and audit stay server-side.
• Skills are instructions, not capabilities: personal skills attach only to Bots their author owns, deployment skills are admin-owned, and both are invoked with / in the composer. Authors can record which connected tools a skill expects without granting access to any of them.
• Durable work control center: /work combines queued and active runs, reusable manual/scheduled/webhook routines, user-to-Bot and Bot-to-Bot handoffs, shared project artifacts, and actionable notifications. A leased executor adds heartbeats, bounded attempts, timeout budgets, retries and crash recovery.
• Governed autonomy without a second runtime: proactive monitors stay quiet when nothing needs attention; paired Telegram, Slack, Discord, and signed webhook messages use the ordinary task queue and a retrying outbox; skill and memory learning stays in review; transient model failures can follow a visible fallback route; and large tool catalogs/results are bounded without bypassing grants or policy.
• Shared project teams: assign several coworkers to a project, open one team channel, and explicitly choose which coworker answers each turn. Computers, credentials, and browser sessions remain isolated per Bot.
• Portable team templates: export a team's names and standing roles, then import them as new private coworkers. Templates never carry ids, endpoints, credentials, grants, messages, ownership, or visibility.
• Inspectable memory: stable user, coworker, and project context is stored in PostgreSQL with scope, source, confidence, and pinning. People can inspect, edit, or remove it; relevant user and coworker memory is supplied to the active conversation.
• Bounded autonomy programs: reviewed tool programs sequence existing grants without creating a new execution path; nested handoffs enforce depth, parallelism, runtime, review, and stop-tree limits; deterministic routines can run an approved program without a model call.
• Healthy, portable behavior: skill hashes, versions, usage, pinning, archive, and rollback make learned behavior reviewable. Bot bundles move configuration while rejecting credentials, grants, sessions, transcripts, and memory.
• Permission-aware company knowledge: the connector worker syncs Google Drive into lexical/vector chunks, keeps source ACLs beside them, and filters results in SQL before a Bot sees a citation.
• An audit trail you can export: /admin/audit lists what was permitted, refused and failed and downloads a redacted SHA-256-chained evidence bundle.
• Operational readiness: liveness and readiness endpoints surface database, model, task-lease and connector health without leaking details publicly.
• Credentials encrypted at rest: stored through /admin/credentials, never returned by an API, and redacted from audit events.
• Loopback by default: computers bind to 127.0.0.1 and require a per-container token, so nothing reaches a logged-in browser by knowing its port. The supervisor binds there too, because it holds the Docker socket and its token is a shared secret rather than a network boundary.
• Durable threads and governed context: conversations survive restarts through CopilotKit Intelligence, while the inspectable memory and work records owned by this deployment stay in PostgreSQL.

Bring your own agent

Any AG-UI endpoint can be a Bot.

From /agents, create a coworker with:

• name, title, and role description;
• private or public visibility;
• optional AG-UI endpoint;
• optional write-only authorization header.

The server validates agent endpoints with the same target checks used for browser navigation. If no custom endpoint is set, product-created coworkers use MANAGED_AGENT_AG_UI_URL.

Tenant package agents are declared in agents.yaml as either:

• built-in, with a system prompt; or
• remote-ag-ui, with an endpoint.

See docs/configuration.md and docs/coworkers.md.

Configuration

.env.example is the source template. The API server refuses to start without:

• DATABASE_URL
• KEY_ENCRYPTION_KEY
• MANAGED_AGENT_AG_UI_URL
• MANAGED_AGENT_TOKEN
• INTELLIGENCE_API_URL
• INTELLIGENCE_GATEWAY_WS_URL
• INTELLIGENCE_API_KEY
• COPILOTKIT_LICENSE_TOKEN

Settings worth knowing:

Variable	Use
OPENBOT_DEV_NO_AUTH	Admits every request as one administrator. How OpenBot runs today.
OPENAI_BASE_URL	Answers the OpenAI-shaped calls from somewhere else: a gateway, a proxy.
ANTHROPIC_BASE_URL, GOOGLE_GENERATIVE_AI_BASE_URL	The same, for those two APIs.
COMPUTER_TOKEN	Secret every Bot computer request must present. start.sh sets one.
SUPERVISOR_TOKEN	Secret the supervisor requires. start.sh sets one.
COMPUTER_SUPERVISOR_URL	Gives each Bot a computer of its own instead of one shared computer.
COMPUTER_RUNTIME	Set to runsc to run computers under gVisor, where the host has it.
AGENT_COMPUTER_POLICY	JSON action policy. Malformed JSON stops server startup.
AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS	Local-only access to this machine's services; refused in production.
TENANT_PACKAGE_DIR	Directory containing tenant YAML. Defaults to ../examples/fintech.
DEPLOYMENT_ID	Names this deployment when two share one Intelligence project.

Full reference: docs/configuration.md.

Architecture

Service	Port	Purpose
app	3010	React/Vite UI.
server	3001	Hono API, CopilotKit runtime, auth, policy, audit, plugins, components, coworkers, and channels.
connector-worker	internal	Google Drive synchronization, embeddings, ACL persistence, leases, and retries.
agent-computer	4100	Chromium plus /workspace and browser profile.
agent-bot	4200	Proof-of-concept AG-UI Bot.
agent-langgraph	4201	LangGraph AG-UI Bot.
supervisor	4500 host / 4300 container	Creates and manages one computer per Bot.
PostgreSQL with pgvector	5432	Product data, policy, audit, credentials, grants, channels, work, inspectable memory, knowledge, and component metadata.
CopilotKit Intelligence	external	Durable conversation threads and realtime gateway.

The server gateway is the product/API path for Bot browser and file tool calls. It resolves the target, evaluates policy, writes an audit row, and then calls agent-computer. The computer also exposes lower-level token-protected service endpoints; keep them private and do not use them to bypass the gateway.

More detail: docs/architecture.md.

Sign in with Google

OPENBOT_DEV_NO_AUTH is the default because it needs no OAuth credentials and no consent screen. To sign in for real instead, create a Google OAuth client and set all four of these together:

BETTER_AUTH_URL=http://localhost:3001
BETTER_AUTH_SECRET=        # openssl rand -base64 32, at least 32 characters
GOOGLE_OAUTH_CLIENT_ID=
GOOGLE_OAUTH_CLIENT_SECRET=

Then set the two that decide who gets in and from where:

• TRUSTED_ORIGINS — where the app is served from. Unset outside production, that is http://localhost:3010, which is where start.sh serves the app.
• INITIAL_ADMIN_EMAILS — comma separated. An address listed here becomes an administrator the first time it signs in; everybody else becomes a user.

Remove OPENBOT_DEV_NO_AUTH, then restart: the sign-in button is written into the app's generated config at startup, so it appears only once all four settings are present. Accounts, sessions and roles are stored in the same PostgreSQL database as everything else.

A partial set is refused rather than ignored: the server will not start with BETTER_AUTH_SECRET or BETTER_AUTH_URL but no client credentials, or with a secret shorter than 32 characters.

Keeping it to your machine

• agent-computer drives a browser holding real logins. docker-compose.yml binds it to loopback; leave it there.
• Store credentials through /admin/credentials, which encrypts them. Do not put credential values in tenant YAML or in committed files.
• AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS lets a Bot reach services on this machine during local development. The server refuses to start with it enabled in production.

Development

bun run format:check
bun run lint
bun run typecheck
bun run test
bun run build

After changing the Drizzle schema:

bun run --filter server db:generate
bun run --filter server db:migrate

Use bash scripts/start.sh for the whole stack. Use bun run dev only when you want the app and server without the Docker Bots and computers.

Documentation

• copilotkit.ai/openbot
• docs/README.md
• docs/architecture.md
• docs/configuration.md
• docs/development.md
• docs/coworkers.md
• docs/fork.md

Contributing

• Open an issue or coordinate before starting substantial work.
• Keep changes focused and update docs when setup, configuration, architecture, or user behavior changes.
• Keep secrets, service-account JSON, customer data, and local transcripts out of the repository.
• Run the checks in Development before opening a pull request.

License

MIT — upstream copyright remains with CopilotKit; this product fork is maintained by Kayco.

Some adapted UI components retain their original Apache-2.0 terms. See THIRD_PARTY_NOTICES.md for source and license details.