The Short Answer
CopilotKit released OpenBot 1.0 on 9 November 2026: open-source AI coworkers that work on a computer of their own, with every action decided by a fail-closed policy before it happens and recorded after. The application template is MIT licensed; the CopilotKit Intelligence layer it runs on is licensed separately. On ibl.ai you own all the code and the data, every layer of it.
OpenBot is a serious piece of engineering, and its governance design is worth copying. The buying question it raises is the one this page answers: when an agent stack calls itself open source, which parts do you actually receive?
What is CopilotKit OpenBot?
CopilotKit OpenBot is a self-hostable workspace for AI coworkers, which the project calls Bots. Each Bot uses a browser, files, a shell and tools, and connects to agents through AG-UI, the agent-to-user protocol CopilotKit created.
The OpenBot repository was created on 17 August 2026. v1.0.0 was tagged on 9 November 2026, followed by v1.0.1, v1.0.2 and v1.0.3 by 14 November, when the repository showed just over 12,000 stars.
It ships as a desktop app for Mac and Windows and as a Helm chart for AWS EKS, Azure AKS, Google GKE or any Kubernetes cluster. Bots can be built in OpenBot or brought in from LangGraph, CrewAI, Google ADK, Mastra or a hand-written AG-UI endpoint.
How does OpenBot govern what an AI agent is allowed to do?
OpenBot governs agents with a single gateway. Per the project README, every tool call "resolves the target from a server-held snapshot, evaluates the policy, writes the audit row, and only then calls the computer". There is no path that acts without the record existing first.
Policies are written in CEL and can inspect the tool, the Bot, the person, the page host, the shell command, the file, the MCP server and what started the run. That last one lets a rule refuse a scheduled routine an action it would allow a person.
The policy engine fails closed in three ways: deny is evaluated before allow, a missing policy permits nothing, and a broken rule refuses rather than opens. Refusals carry the rule that caused them in the /admin/audit view.
Other controls are just as concrete. Secrets are recorded by length, never content. Unknown MCP tools are treated as writes. Routines have a 15-minute floor, a cap of 20 enabled routines, and switch off after ten consecutive failures.
Is OpenBot actually open source and self-hostable?
The OpenBot application template is open source under the MIT licence, and it is self-hostable.
The README is explicit that it "uses CopilotKit Intelligence, which is separately licensed", and Intelligence provides the durable conversations, memory, Automatic Learning and enterprise governance services.
| Where OpenBot runs | CopilotKit Intelligence licence required (per the README) |
|---|---|
| Your laptop, personal use and experimentation | Free local licence; desktop setup handles it |
| Kubernetes evaluation | Free trial licence |
| Kubernetes, production | Production licence; OpenBot for Business includes it (plans and pricing) |
So "MIT licensed and self-hostable" is true of the template, and Intelligence can also run on your own infrastructure. What it does not mean is that the whole production stack is MIT.
This is a normal open-core arrangement and CopilotKit states it plainly. The point for a buyer is to price it in before a pilot becomes a production dependency.
Why does governance as architecture matter for enterprise AI agents?
Governance as architecture matters because an agent takes actions, and a control that sits beside the action path can be skipped. A control that sits on the only path cannot.
The pattern OpenBot gets right is ordering: decide, record, then act. An audit trail written after the fact can miss the action that crashed the process; one written before the action is a precondition of it.
Most enterprise agent failures are not exotic.
An agent passes a bad parameter to a tool, a tool fails silently, or an agent acts outside its remit.
Each of those is caught by a boundary in the platform, not by a better model. We made the same argument about agent identity and runtime controls in what actually shipped in enterprise agent security in 2026.
Which layer of an open-source AI agent stack do you actually own?
An agent stack has layers: the interface, the agent runtime, memory and threads, the policy engine, the connectors and the models. "Open source" on the box can apply to any subset of them.
Four questions sort it out quickly:
- Which layers ship under an open licence, and which need a commercial licence in production?
- If the vendor's licence server or pricing changes, which features stop working?
- Can the stack run with no outbound connection at all? OpenBot's free local path needs internet for downloads, sign-in and licence renewal; its pricing page lists offline and air-gapped deployment on the Annual plan.
- Who holds the conversation history and agent memory, and in what format can you take it with you?
None of these is a trick question for CopilotKit, which answers most of them in its own README. They are the questions that separate a template you own from a platform you rent.
How does ibl.ai compare for governed, self-hosted AI agents?
ibl.ai is an Agentic AI Operating System that licenses its full source code, policy engine included, so customers who self-host receive the governance layer rather than renting it as a separate service.
You can self-host every layer inside your own perimeter and pay by usage, with no per-seat pricing.
The governance primitives are platform features: Roles and RBAC for who can do what, Safety settings per agent, MCP connectors scoped to each agent, and an Audit log of every agent configuration change. (Existing ibl.ai capabilities.)
Execution is isolated too. The Sandbox gives an agent a full Linux virtual machine per chat that starts with no network at all; what it may reach is set per agent.
The two approaches are not mutually exclusive.
A team that likes OpenBot's gateway pattern can run it; the question is only which parts of the stack it will own on the day it wants to leave. ibl.ai serves 1.6M+ users across 400+ organizations. ibl.ai is family-owned and operated from New York.
Frequently asked questions about CopilotKit OpenBot
When was OpenBot 1.0 released? CopilotKit tagged OpenBot v1.0.0 on GitHub on 9 November 2026. Point releases through v1.0.3 followed by 14 November 2026.
Which models does OpenBot support? Per its README, OpenAI, Claude, Gemini, or open models through any OpenAI-compatible endpoint, hosted by a provider or on your own infrastructure.
Can OpenBot run fully offline? It can run fully locally with a local model, but the README says initial downloads, account sign-in and local licence renewal need internet access. The pricing page lists offline and air-gapped deployments on the OpenBot for Business Annual plan.