Read the whole setupGet it running this afternoon.
Drop your email and the rest opens: the six commands, the five lines that turn the rules on, how to prove it worked in under a minute, the first week of handing it real work, and the two ways it refuses to start.
One email. No follow-up unless I ship something that fits.
WHAT YOU NEED- Docker with Compose.
start.sh calls docker compose for PostgreSQL and the shipped Bots - Bun 1.3.14, pinned in
package.json - Node, only so
npx can fetch the CopilotKit key - A CopilotKit account. Free is enough
- A model key. OpenAI by default. Anthropic works with three lines, in CONFIGURE below
INSTALLSix commands, two values that are yours
.env.example has ten blank keys. Two are yours to fill: INTELLIGENCE_API_KEY from project select, and OPENAI_API_KEY. start.sh generates MANAGED_AGENT_TOKEN and AGENT_TOOL_TOKEN and writes them back. Everything else is already right for a laptop.
The install
terminala clone, not the desktop app
$ git clone https://github.com/CopilotKit/OpenBot.git && cd OpenBot $ cp .env.example .env $ npx --yes copilotkit@latest login $ npx --yes copilotkit@latest project select → the cpk-... key goes in .env as INTELLIGENCE_API_KEY, your OpenAI key as OPENAI_API_KEY $ bun install $ bash scripts/start.sh → PostgreSQL up, API on 3001, app on 3010, worker started, health routes answered
Open http://localhost:3010. bash scripts/stop.sh takes it all down, including each Bot's computer, and deletes nothing: the database, files and browser profiles are volumes.
Prove itcurl -s localhost:3001/api/capabilities should return JSON with "mode":"intelligence". Then open /bot and ask it to open news.ycombinator.com and tell you the top story. Watch the screen, then open /admin/audit: every click it made is a row. That row is the product.
CONFIGUREFive lines out of a long file
.env is the whole configuration, and docs/configuration.md names every variable. These five decide whether you have a governed deployment or a demo. The first three are the ones the README's own pitch depends on, and all three ship off.
.envmy values, laptop
# openssl rand -base64 32, pasted in KEY_ENCRYPTION_KEY= OPENBOT_SINGLE_USER=true COMPUTER_SUPERVISOR_URL=http://localhost:4500 AGENT_COMPUTER_POLICY={"mode":"dry-run","deny":["(intent == \"activate\" && contains(element.name, \"submit\")) || ((tool.name == \"computer_key\" || tool.name == \"computer_type\") && key == \"Enter\")"],"allow":["true"]} BOT_PROVIDER=anthropic BOT_MODEL=claude-sonnet-4-5
| Setting | Default | Why I change it |
|---|
| AGENT_COMPUTER_POLICY | unset: permits acting tools, forbids nothing | The shipped example refuses form submits and the Enter key. I run it in dry-run first: it decides and records without refusing, so a week of /admin/audit shows what a rule would have blocked before it blocks anyone. Then enforce. |
| COMPUTER_SUPERVISOR_URL | blank: one shared computer | Blank means every Bot uses one Chromium and one set of logins. The supervisor on 4500 gives each Bot its own container, so one Bot cannot read another's files or use its sessions. |
| OPENBOT_SINGLE_USER | true | Every visitor is an administrator. Keep it on localhost. Delete the line and configure Google, Microsoft or Okta before anyone else gets the URL; with neither, it refuses to start rather than admitting everybody. |
| KEY_ENCRYPTION_KEY | a public example value | It encrypts stored credentials. Production refuses to start with the example, so generate one now and you never migrate a vault. |
| BOT_PROVIDER and BOT_MODEL | openai, gpt-5.5 | On Anthropic set both together with ANTHROPIC_API_KEY. Compose defaults BOT_MODEL to an OpenAI model, so setting the provider alone means a Bot that fails on an unknown model. |
The orderdeny is evaluated before allow, an empty allow permits nothing, and a rule that fails to parse refuses rather than opens. Malformed JSON stops the server at startup. A refusal in /admin/audit names the rule that caused it.
DAILY DRIVINGThe first week, in cost order
Start with the browser, because that is where the audit trail earns its keep. Add a rule only after you have read a day of rows. Give a Bot a standing role last, once you trust the record.
in a channelplain words, not tool calls
› Open news.ycombinator.com and tell me the top story. › Fill out the form at httpbin.org/forms/post. › Every weekday at 8am, open our status page and tell me if anything is red.
- Browse first.
/bot for a direct chat. Ask for something visible on a public page, then read /admin/audit for the rows it left. - Then a rule.
/admin/boundaries: add a deny rule or preset, retry the same action, and watch the refusal name the rule. - Then a coworker.
/agents: name, title, role, private or public, and an optional AG-UI endpoint. Start a channel with it and watch its screen. - Then a routine. Ask in a channel for something on a schedule. A 15-minute floor, 20 enabled routines at most, and ten failures in a row switch one off.
When a Bot hits a login wall or a 2FA prompt it asks for help. You take the wheel in the same panel, it is recorded as computer.control_taken, and Bot actions are refused, not queued, until you hand it back.
WHEN IT DRIFTSTwo failures, both at startup
It refuses to start and names a variable
That is the design: it will not run half-configured. Missing: INTELLIGENCE_API_KEY means you skipped project select. No identity provider is configured means you deleted OPENBOT_SINGLE_USER=true without adding Google, Microsoft or Okta. A bad KEY_ENCRYPTION_KEY wants openssl rand -base64 32.
A port is taken
start.sh names the port and the process. Re-run with APP_PORT= or SERVER_PORT= set to a free one, or stop the other process. PORT and SERVER_PORT must agree when both are set.
Starting over/admin/computers stops and resets one Bot's computer. bash scripts/stop.sh deletes nothing. To truly start fresh, remove the Compose volumes, and your database, files and browser profiles go with them.
THE SHAPE OF ITWhere everything lives
.envten blank keys, two yours, four generated by start.sh examples/fintech/the tenant package: agents.yaml, agents/, channels.yaml, skills server/the Hono API: gateway, policy, audit, auth, plugins agent-computer/Chromium plus /workspace, port 4100 agent-langgraph/ and twelve more agent-*/one AG-UI Bot per framework
Making it yours is a copy of examples/fintech and one TENANT_PACKAGE_DIR line, relative to server/. The database, files and browser profiles are Docker volumes; back those up and the deployment moves.
That is the whole setupSix commands, five lines in `.env`, one rule in dry-run for a week. When security asks what the agent can touch and who saw it, you open `/admin/audit` and scroll, instead of writing the answer in a document.
Open on GitHub →
↑ Unlocks the moment you submit the form above.
