IntroducingOpenBot
An enterprise agent platform that runs inside your own infrastructure. Company knowledge with real permissions, computer use, and any agent that speaks AG-UI — the protocol we wrote.
OpenBot
Start a new channel
Goes to General Assistant. Type @ to reach somebody else.
Explore agents
Message agents like teammates
Every agent gets its own channel, the way a colleague gets their own thread. Ask for something, watch the work happen, and come back to it later with the whole history intact.
- One thread per agent
- Context stays where the work happened instead of scrolling away in a single shared window.
- Skills on a slash
- Each agent exposes only the skills it has been granted, and they are discoverable from the composer.
Answers from your company's documents
Connect Google Drive and OneDrive and your agents answer from what your company already wrote down — with the sources attached, so an answer can be checked rather than trusted.
- Permissions are fail-closed
- An agent only ever sees files the person asking is already allowed to open. When permissions are unclear, it returns nothing rather than guessing.
- Cited, not asserted
- Every answer names the documents behind it, so the reader can go and read them.
Agents that use your tools
When there is no API worth using, an agent signs in and drives the interface the way a person would. You can watch the screen while it works, and take the wheel whenever you want to.
- Watch it work
- The screen opens beside the conversation, so the work is visible rather than something you are told about afterwards.
- Take the wheel
- Step in mid-task without losing the thread, then hand it back.
Give each agent a job
An agent is a role, not a chatbot. Publish the ones your company needs, grant each only the skills and sources its job requires, and let people talk to them by name.
Company knowledge
Answers policy and process questions from the documents your company already wrote, and names its sources.
Warehouse analyst
Queries the analytics warehouse and draws the answer rather than describing it. Read-only by construction.
Desk research
Gathers context from the open web and drafts from it, keeping contradictory sources rather than quietly picking one.
Tool operator
Signs in and works inside the tools that have no API worth using, with the screen open so you can watch.
Inbox triage
Reads what arrived, drafts the replies that are obvious, and leaves the ones that are not for you.
Onboarding buddy
Answers the questions a new starter asks in week one, from the handbook rather than from memory.
From the team behind the protocol
AG-UI is the Agent–User Interaction Protocol: the open, event-based standard for how an agent talks to the application a person is actually looking at. We wrote it, we maintain it, and we ship the reference implementation.
Adopted by
MCP is context
How an agent pulls in tools and external knowledge.
A2A is coordination
How agents hand work to one another.
AG-UI is interaction
How the work becomes something a person can watch, question and interrupt. It is the leg the other two do not cover.
For you this means no bet on a single framework. Any agent that speaks AG-UI — LangGraph, Mastra, PydanticAI, or one your team writes — is registered as an endpoint and gets a channel.
Runs on your infrastructure
The reason most AI pilots stall is not the model. It is that nobody can say where the data went. OpenBot runs where your other internal systems run, and the answers below are the ones your security review will ask for.
- One deployment, one company
- No shared tenant and no seats to count. Docker Compose stands up a demo; Helm is the supported path to production.
- Your content never leaves
- Documents, vectors, permissions and conversations live in your Postgres. Nothing is sent anywhere you did not configure.
- Your models, your keys
- Admins hold the provider credentials. Keys are encrypted at rest with your key-encryption key, never returned, never logged, and revocable.
- No bundled model
- The built-in agent stays unavailable until an admin configures a provider. Nothing silently falls back to somebody else's LLM.
- Retrieval fails closed
- Permissions from the source normalise to allow and deny principals, deny wins, and a document with an ambiguous mapping is not returned at all.
- Tool calls are gated
- Sensitive MCP calls go through a gateway with an explicit per-tool allowlist, and every call and outcome is recorded.
Questions
See it running inside your company
The source is open, so you can read exactly how permissions, tool gating and the channel model work before you talk to anybody. When you want it standing up on your own infrastructure, that is the conversation to have with us.
