OpenBot, an open source project from CopilotKit released under the MIT license, gives each AI agent its own containerized browser, isolated file workspace and a defined set of tools. It runs entirely on a team's own infrastructure through Docker Compose, according to the project's GitHub repository.
Every agent action is checked against configurable policy in a central governance gateway before it executes and logged afterward, with policies written in the CEL policy language, the repository states. The project accepts any agent built on the AG-UI protocol, including agents built with LangGraph, Mastra or CrewAI, and supports Model Context Protocol servers such as Google Drive and Notion with audited access.
Data persists in PostgreSQL with encryption at rest, and the project integrates with CopilotKit's own memory layer for durable agent threads, according to the repository. The project remains in alpha and has drawn 3,800 stars and 470 forks on GitHub.
The pitch, in the README, is agents you can "hand real work to, and actually trust with the access," each one getting a real browser with its own logins rather than shared credentials.
Sandboxing and per-action policy checks are exactly the kind of infrastructure the AIR funding round above says is missing across the industry. Teams giving agents browser access without this kind of isolation and audit trail are the ones a firewall like AIR's, or a self-hosted gateway like this one, is built to catch.