OpenBot (CopilotKit)

Alpha agent-platform template with AG-UI coworkers and computer tools, not a finished managed product. The local example admits every request as one administrator; fix sign-in before sharing it.

No product visual on file

Choose it when

You want a runnable starting point you can customize, and can own the stack. Replace the single-user example with real sign-in and proper secrets before anyone else can reach it. MIT governs repository code; required CopilotKit Intelligence service/licensing and model access are separate. Exact costs and entitlements remain unassessed.

Skip it when

You need a turnkey managed product, safe multi-user exposure from the fresh local configuration, or proven isolation without checking the computer supervisor and deployment shape.

01 / Classification

Autonomy evidence

This is our classification, not a vendor badge. The record says what the product normally does. The gaps stay visible.

How we classify it

Tool use + multi-step plans, still human-gated per session.

Runs unattended

Yes — that capability is documented in this brief.

Trigger

Normal work starts in a human conversation. Unattended=true means configured routines only, with granted scheduling tools, an owner and a running separate worker/sweep. Persistence and a next-run display don't prove execution or delivery.

State

PostgreSQL holds product data, grants and audit; CopilotKit Intelligence holds durable threads and memory. The supervisor provides per-bot workspace/browser volumes when configured. Storage continuity isn't a tested recovery guarantee.

Tools

AG-UI agents use the gateway for browser/file actions, shell commands and granted MCP tools. Policy and audit mediate actions; this is a runnable agent platform, not just a UI library. No tool enforcement was exercised here.

Human control

Documented policy, approval settings and computer takeover govern work, not a guaranteed fresh approval for every action. The single-user example makes every requester an administrator. Turn it off, configure real identity and replace local example/dev secrets before sharing. The operator owns grants, backups, worker health and failure recovery.

02 / Operations

Control reality

Useful agents eventually touch something real. This is the operational picture we have, not a promise hidden in a sales page.

Where it runs

Alpha application template for your own infrastructure, not a vendor-operated finished product. Laptop Compose and deployed containers differ: per-bot computers require a supervisor; a one-container deployment shares its browser and needs an external routine sweep. Intelligence is a required separate service, managed or self-hosted; model inference is another dependency.

Data boundary

PostgreSQL product data, Intelligence threads/memory, selected model providers and connectors are distinct data boundaries. Desktop telemetry is on by default; COPILOTKIT_TELEMETRY_DISABLED or DO_NOT_TRACK opt-out is documented. This isn't a full server/privacy/retention audit or a zero-egress promise.

Identity & permissions

OPENBOT_SINGLE_USER=true in the local example admits every request as one administrator. Real sign-in and proper secrets are prerequisites before others reach it. Deployment docs describe refusal for declared public origins in that mode but warn private networks can still admit everyone. Routines run as their creator with that person's grants, not automatically as an admin.

What it can write

Browser, workspace files and shell commands · Granted MCP tools and channel messages

Surfaces

Web channels and computer view · Optional desktop installation

Export / lock-in

Database persistence and workspace/browser volumes need operator-owned backups. A redeploy without the database volume loses its audit trail. Complete backup/restore, cross-deployment portability and Intelligence export weren't tested or established here.

03 / Receipts

Evidence ledger

Here is what this brief is built on. “Documented” means we found a source. “Tested” means this desk actually ran it. Those are different things.

Evidence status

documented

Source set

5 primary sources

Evidence review

2026-10-27

Sources on file

Corrections

Not recorded yet. If we change a material claim, the correction belongs here.

04 / Change log

Related coverage

The brief tells you what the product is. Payloads track the changes that may alter the decision.

No linked change coverage on file yet.