OpenBot at 2,432 Stars: the Landing Page Sells 'Your Claude Plan', the Repository Rates That Risk 'Not Clear' to 'High'

OpenBot is a desktop workspace where several AI coding agents live side by side: Codex, Claude Code, Gemini, Grok, Cursor, Cline, OpenCode, each with its own workspace, its own conversation, a shared task queue, and an embedded browser the agents can drive. It appeared on GitHub on 12 August 2026. By 28 October it had 2,432 stars, 251 forks, 221 open issues, and 103 version headings in its changelog — v0.52.1 landed on day 76.

That velocity is the first thing worth checking, because it decides how to read everything else. The most recent 300 commits all fall on six calendar days, including 79 commits on 27 October alone. A project moving this fast will have documents that disagree with each other; the question is which disagreements matter to you.

Three of them do, and all three are quotable from the vendor’s own files: a subscription sign-in path that the repository itself grades from “Not clear” to “High”, a landing page that says “OpenBot is open source” next to a licence that forbids commercial use, and a privacy story that promises your browser data stays local while the analytics contract reports every domain your agents visit.

The numbers, before the arguments

Ten watchers against 2,432 stars is worth pausing on. Watchers are the people who asked to be notified about every issue and pull request; stars are a bookmark. A 0.41% ratio is what you see when a repository gets distributed through a launch post rather than accumulated by people reading its code. That is not a criticism of the software — it is a warning about how much of the star count is evidence of anything.

Claim one: “with the plans you already pay for”

The landing page repeats this in four places. The hero: “Run Codex, Claude, Gemini and Grok with the plans you already pay for, or your own model.” The pricing block: “$0 — OpenBot is free. No hidden fees. No locked features. Your agents use the AI plans you already pay for.” A later section: “Use the AI plan you have.” Then the FAQ, asked directly:

Can I use my ChatGPT or Claude plan? Yes. Codex signs in with your ChatGPT plan, and Claude Code with your Claude plan. Gemini uses a Google AI Pro or Ultra plan. OpenCode has free models that need no account.

Now open docs/provider-terms.md in the repository. It is 4,695 bytes, it was last revised around 6 October, and it is the most honest document in the project. It begins:

OpenBot does not sell, resell or pay for model usage. Each provider CLI signs in with your own account or key, and your agreement with that provider applies to all usage. OpenBot does not check that your use agrees with a provider’s terms, and a provider can limit or close an account that breaks them.

Then it quotes Anthropic’s legal and compliance page, read on 6 October 2026:

“Developers building products or services that interact with Claude’s capabilities, including those using the Agent SDK, should use API key authentication through Claude Console or a supported cloud provider. Anthropic does not permit third-party developers to offer Claude.ai login into their own applications, or to route requests through Free, Pro, or Max plan credentials on behalf of their users.”

And immediately after the quotes:

Anthropic has not confirmed to the OpenBot project that subscription sign-in through OpenBot is permitted. For your own use case, Anthropic tells you to contact sales.

This is not a hidden clause in a subprocessor list. It is a page in the repo, linked from the documentation, written by the maintainers, containing the sentence “Anthropic has not confirmed to the OpenBot project that subscription sign-in through OpenBot is permitted.”

The two statements can coexist only if you read “can I use my Claude plan?” as a technical question — does the button work — and not as a permissions question. The button works. That is the whole problem: the question a buyer is actually asking is whether they are allowed to, and the FAQ answers a different one.

The risk table the project wrote about itself

The same file continues with a table. It is worth reproducing in full, because it is more critical than anything in this article:

The third row is the product the company sells. The landing page’s “OpenBot for Teams” section reads: “AI coworkers for your whole company. We run OpenBot on managed servers and set it up around your team and tools.” The repository’s own assessment of team members using Claude agents on a host is the single word High, with the reason stated plainly: other people’s requests use one person’s plan.

There is a defensible reading in which this is fine — an unmodified Claude Code binary signed in by its owner, hosted on a machine the owner controls, is the case Anthropic’s own note carves out (“does not prevent an end user from signing in to the unmodified Claude Code binary with their own Claude subscription, including where a platform hosts Claude Code”). The document says that too, and it is the strongest argument for the product. But the carve-out is about an end user signing in themselves, and the “High” row is about several people’s requests flowing through that one sign-in. The repo does not resolve the difference. Neither does the landing page.

One more detail from the same file, which is where the practical answer lives:

An Anthropic API key, Amazon Bedrock, Google Cloud’s Agent Platform or Microsoft Foundry is the method that Anthropic tells Agent SDK products to use. The CLI uses it before a subscription sign-in, and OpenBot passes its environment to the CLI. Set ANTHROPIC_API_KEY in the environment that starts OpenBot, or in the env block of ~/.claude/settings.json.

So there is a supported path that sidesteps the whole question: an API key, which bills per token instead of drawing on a flat subscription. The landing page’s “$0, use the plan you already pay for” framing points at the other path.

What the file does not cover

provider-terms.md has one detailed section, for Claude, and then a two-line section called “Other providers”: OpenBot runs each provider’s CLI with your own sign-in, and that provider’s terms apply. The landing page names Codex, Gemini and Grok in the same sentence as Claude. OpenAI’s, Google’s and xAI’s positions on third-party clients riding a consumer subscription are not quoted, rated, or summarised anywhere in the repository. If Anthropic — the provider whose position is documented as unconfirmed — is the most cautious actor here, the absence of the other three is not reassurance.

Claim two: “OpenBot is open source.”

The resources panel of the landing page ends with a one-line summary, and it is not ambiguous:

<div class="site-panel-footer">
  <span class="site-panel-summary">OpenBot is open source.</span>
  <a href="https://github.com/nightly-labs/openbot">Source code</a>
</div>

The LICENSE file in that repository is PolyForm Noncommercial 1.0.0. Its “Noncommercial Purposes” clause reads “Any noncommercial purpose is a permitted purpose”, and its “Personal Uses” clause grants use for “research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application”. Commercial use is not granted.

PolyForm Noncommercial 1.0.0 does not appear on the Open Source Initiative’s approved licence list. I checked the list itself rather than trusting a summary: fetching opensource.org/licenses returns a 262 KB page containing MIT, Apache-2.0 and the GNU licences, and zero occurrences of “PolyForm”. The licence is source-available. “Open source” is a term with a definition, and this fails it on the field-of-endeavour clause.

The FAQ, three sections below the same page’s footer, is more careful:

All of the source code is public on GitHub, so you can check what OpenBot does. You can change and run it for free for noncommercial use, such as personal projects, study or research. Commercial use needs a separate license. The license is PolyForm Noncommercial 1.0.0.

The README is more careful still, calling itself “an independent source-available project”. The repository agrees with the FAQ. Only the navigation panel says “open source”, and it is the line a visitor is most likely to skim.

Eight days of Apache-2.0, then a one-way door

The licence history is in the commit log for the LICENSE path, and it is short:

I checked the tags, not just the commits. v0.1.11, published 16 August, still contains the Apache License 2.0 text. v0.1.14, published 21 August, already contains PolyForm Noncommercial 1.0.0. The permissive window was eight days, spanning eleven releases.

Two consequences are worth stating precisely. First, code you obtained under Apache-2.0 stays Apache-2.0 for you — that grant is irrevocable — so a fork taken on 15 August is legally a different object from one taken today. Second, the project has made the new position structural rather than editorial. AGENTS.md, the file that instructs AI coding agents working in the repo, contains this rule at line 34:

Keep PolyForm Noncommercial 1.0.0. Do not add incompatible dependencies or relicense files.

And CONTRIBUTING.md requires every outside author to sign a Contributor Assignment Agreement that assigns copyright to Synthetify Labs. So outside contributions land under a licence the contributor cannot reuse commercially, with the copyright held by the company that can.

There is no published price for the commercial licence. openbot.run/pricing returns a 404 today. The issue that tracks the gap is open and recent: #2947, “Add the Pricing page and sell its license prices”, filed 23 October. Until that ships, the answer to “what does this cost my company” is an email to licenses@openbot.run.

Claim three: “browser data stays on the computer”

The landing page’s storage section is laid out as a list — Workspaces, Conversations, Files, Browser data — under the heading “Stored on your computer”, followed by: “Workspaces, conversations, files and browser data stay on the computer that runs OpenBot, not on our servers.” The FAQ repeats it: “Workspaces, conversations, attachments and browser data stay on the computer that runs OpenBot.”

PRIVACY.md agrees about workspaces, conversations and attachments. About browser data it is more precise, in a paragraph that the FAQ does not summarise:

Websites. When a page in the embedded browser reaches a new registrable domain, the host sends that domain (for example linkedin.com for www.linkedin.com) and whether the user or an agent opened it. It never sends the subdomain, path, query, fragment or page title.

The analytics catalogue defines the event as system_site_visited, and adds a detail that matters for anyone running agents rather than browsing themselves: “actor is user or agent”. Every new registrable domain the agent visits during a task is reported, attributed to your account, with a flag saying whether a human or an agent opened it.

Three more facts about that pipeline, all from the repository:

• It is on by default, and the code says so. src/main/analytics-preference-store.ts line 10: const DEFAULT_PREFERENCE: AnalyticsPreference = { enabled: true }; A missing preference file means enabled; only a malformed file fails closed. The doc agrees: “Desktop analytics is enabled by default and can be disabled in General settings.”
• There is no retention limit. PRIVACY.md: “OpenPanel event and profile data has no automatic retention limit. It remains stored until it is removed manually or the analytics project is deleted.”
• It identifies you. “OpenPanel receives the central account ID as profileId and the normalized account email as the profile email.” A domain list attached to a named work email is a different object from an anonymous counter.

The catalogue is 84 table rows and 81 distinct event names, split across six surfaces and six schema generations (desktop 12, host 11, landing 10, account_api 11, mobile 4, web 2). It also includes system_resources — a daily CPU and memory profile per process group and per provider, at the 95th percentile — and system_inventory, which counts your agents, routines, workflows, MCP servers and installed catalogue plugins once a day.

Turning analytics off works, and the project documents the edge: the act of turning it off sends one analytics_preference_changed event first, then stops. That is a defensible design and it is written down. The gap is not in PRIVACY.md; it is between PRIVACY.md and a FAQ that says browser data stays on the computer without the word “analytics” appearing once.

What you are actually installing

297 MB for a chat window is a lot, and the Windows SBOM explains why: the bundle carries Sunshine (screen streaming), a Moonlight web client, ONNX Runtime, ffmpeg, Vulkan, SwiftShader, sherpa-onnx for speech, and a cua-driver binary for computer use. OpenBot is a remote-desktop and computer-use stack with an agent front end, and it is priced and documented as one.

Two consequences of that design are stated by the project in language that deserves to be quoted rather than paraphrased.

The README’s warning block:

OpenBot is a development preview. Agents currently run with danger-full-access and approvalPolicy: never. They can read and modify files, run commands, use the network, and control the embedded browser without per-action confirmations after the explicit first-launch consent.

PRIVACY.md adds the sentence that should be the first thing a security reviewer reads:

This is an explicit product behavior, not a host security boundary. Keep backups and do not give an agent a task you would not allow a local command-line tool to perform.

And the multi-tenant hosting guide, for the case where one Mac serves several paying clients:

Use one native macOS Standard user and one OpenBot instance per tenant. The shared application is /Applications/OpenBot.app. Client connections use the existing Team API, WebRTC, and the operator’s STUN/TURN infrastructure. No VM or Docker is involved.

This setup protects tenant files through macOS ownership and permissions. It does not provide resource isolation against a hostile tenant: native users share CPU, memory, storage capacity, and the network namespace. A tenant can consume resources or occupy ports. An idle update requires cooperation from every registered tenant; one tenant can block maintenance.

The guide also says “Do not promise independent availability on a shared native host”, which is advice the sales page for Teams does not repeat. File isolation between tenants is real — private homes at mode 0700, a helper that never opens tenant data, a documented acceptance test that must be run before paying-client use. Resource isolation is absent by construction, and the document says so in bold.

That acceptance test is the part of the project I would point a skeptical reader at first. It is a written, per-tenant procedure: from one account, try to read, create or replace a test file in another tenant’s home; both must fail; then repeat in the other direction. It is more rigour than most commercial desktop software ships with, and it exists because the authors know what their setup does not do.

The artifact that says nothing

Releases carry Sigstore bundles and SPDX files, which looks like a mature supply chain. The Sigstore side is real: the macOS bundles are DSSE envelopes with predicateType: https://slsa.dev/provenance/v1 and buildType: https://actions.github.io/buildtypes/workflow/v1, covering the .dmg, .zip and host .pkg by SHA-256, built by GitHub Actions.

The SPDX side is not. I parsed all five SBOMs attached to v0.52.1:

Every entry has filesAnalyzed: false. The Windows file at least names binaries — Sunshine, ONNX Runtime, ffmpeg, Vulkan, SwiftShader, cua-driver, the two remote-desktop runtimes — but assigns no licence to any of them. The Linux and macOS SBOMs name nothing at all. As an artifact for a procurement review, a one-package SBOM with NOASSERTION for a 297 MB binary is a signature without a statement.

The NOTICE file has the same shape. It lists exactly four third-party attributions: Blobatar 0.2.0 (MIT), recharts (MIT), moby/profiles (Apache-2.0), and the adaptive motion code in cua-driver 0.34.0 (MIT). It does not mention Sunshine, ffmpeg, ONNX Runtime, Vulkan, SwiftShader or sherpa-onnx.

Sunshine is the one to look at, because the repository is explicit about it. The README refers to “the bundled Sunshine.app”, the multi-tenant guide talks about reserving “Sunshine port families”, and the tree contains vendor/remote-desktop/patches/sunshine-v2026.516.143833-openbot.patch — 4,875 lines and 184,095 bytes across 37 files of the Sunshine codebase. Upstream LizardByte/Sunshine is licensed GPL-3.0.

Whether a patched Sunshine shipped as a separate application inside a bundle is mere aggregation or a derivative work is a question for a lawyer, and I am not going to pretend to settle it. What can be said without a lawyer is narrower and still useful: the PolyForm licence’s own “Notices” clause requires that anyone who receives a copy also receives the licence terms and any Required Notice: lines; the shipped NOTICE names four MIT/Apache components and none of the GPL one; and the SBOM a buyer would hand to their legal team declares NOASSERTION for everything. The compliance material exists in the repository — the patch is public, which is the hard part of GPL compliance — but none of it is in the artifact.

What the project does well

An audit that only lists defects is easy to write and easy to dismiss. Here is the other column, with the same standard of evidence.

• The telemetry boundary is unusually well specified. ANALYTICS.md states what may never be sent: “Never send message content, prompts, answers, generated content, search terms, URLs (a website is reported only as its registrable domain), referrers, user-authored names such as a custom MCP server, routine or skill name, file names, local paths, commands, credentials and API tokens, invitation values, raw errors, or local identifiers.” Payloads are validated at runtime, string enums are allowlisted, arrays are capped, and session replay is off.
• It disables a vendor’s telemetry rather than passing it through. cua-driver phones home on its own; PRIVACY.md says “OpenBot stops both calls, always”, setting CUA_DRIVER_RS_TELEMETRY_ENABLED=0 and CUA_DRIVER_RS_UPDATE_CHECK=0 on every copy it starts.
• docs/provider-terms.md exists. Very few agent tools publish a risk table that grades their own primary use case “Not clear”. The document is the reason this article can quote Anthropic’s position instead of guessing at it.
• The multi-tenant failure modes are documented, not discovered. “One tenant can block maintenance” and “Do not promise independent availability” are the sort of sentences that usually appear in a postmortem, not in the setup guide.
• The changelog is complete. 103 version headings, 4,907 lines, no gaps, even under a release cadence of more than one version per day. The word “breaking” never appears in it, which is a different problem — see below — but the record itself is there.

A checklist you can run before you install this at work

Each item names the file, the setting or the question, because “review your risk” is not a step anyone can execute.

1. Read LICENSE first, not the site. If your use produces revenue, the PolyForm Noncommercial grant does not cover it. Then email licenses@openbot.run and ask for a price and a delivery date; issue #2947 is the public tracker for whether one exists.
2. Decide the auth path before the first sign-in. For Claude, set ANTHROPIC_API_KEY in the environment that starts OpenBot, or in the env block of ~/.claude/settings.json, so the CLI uses the key ahead of any subscription login. Budget for per-token costs; that is the price of the supported path.
3. Ask the three providers the repo does not quote. provider-terms.md documents Anthropic and gestures at everyone else. If you plan to run ChatGPT Plus, Google AI Pro or Grok subscriptions through a third-party client at work, get the provider’s answer in writing for your use case — not the tool vendor’s.
4. Turn analytics off and confirm it, per surface. Desktop: Settings → General → Permissions → Share product analytics. Mobile: Settings → Privacy. Browser app: account settings. They are three separate preferences; changing one does not change the others. PRIVACY.md also says the account service ignores the desktop preference entirely for billing events.
5. Verify the SBOM story before you rely on it. Download the .spdx.json for your platform and count the packages. On macOS and Linux today you will get one, with NOASSERTION. If your procurement process requires a component inventory, you will have to produce it yourself.
6. If you host more than one person, run the acceptance test. sudo openbot-host setup --create-user client-a --create-user client-b then sudo openbot-host verify, then the cross-tenant file test from docs/multi-tenant-hosting.md. It is documented as required before paying-client use; treat it that way.
7. Assume agents have your shell. danger-full-access with approvalPolicy: never is the shipped default and the docs call it product behaviour rather than a security boundary. Give OpenBot an OS user whose damage you can afford, and keep backups outside it.

FAQ

Is OpenBot free? For noncommercial use, yes — with no feature gating, per the FAQ and the licence. For commercial use, the licence says a separate licence is required, there is no published price, and openbot.run/pricing is a 404. “Free” and “free for what you are about to do with it” are different claims.

Is it open source? The landing page’s resources panel says “OpenBot is open source.” The licence is PolyForm Noncommercial 1.0.0, which is not on the OSI approved list, and the README calls the project “source-available”. Trust the second and third sources.

Can I use my Claude or ChatGPT subscription? Technically yes: Connect runs claude auth login --claudeai and the CLI stores the credentials. Whether that is permitted is a separate question, and the project’s own file says Anthropic has not confirmed it for OpenBot, quotes Anthropic’s prohibition on third-party apps routing Pro/Max credentials, and rates the team case “High”. The API-key path is the one Anthropic recommends for Agent SDK products.

Does it send my data anywhere? Conversations, attachments and workspaces stay in local SQLite. Product analytics goes to a self-hosted OpenPanel project at analytics.openbot.run and is on by default: 81 event types, including the registrable domain of every site your agents open, your normalised account email, and a daily CPU/memory profile. There is no automatic retention limit.

What does 297 MB contain? An Electron app plus the remote-desktop and computer-use stack: a patched Sunshine build, a Moonlight web client, ONNX Runtime, ffmpeg, Vulkan, SwiftShader, sherpa-onnx, and the cua-driver binary. The Windows SBOM names most of it; the macOS and Linux SBOMs name nothing.

Is it safe to let it run unattended? The default is full access without per-action approval, after one consent screen. The project’s own words: “do not give an agent a task you would not allow a local command-line tool to perform.” That is the right frame — it is a shell with a queue, not a sandbox.

Bottom line

OpenBot is a serious piece of engineering with an unusually candid documentation set, and that combination is exactly why the marketing surface is the weak link. The repository tells you that subscription sign-in is unresolved and that team usage is high risk; the landing page tells you to bring the plan you already pay for. The repository tells you analytics is on by default and reports domains without a retention limit; the landing page says browser data stays on your computer. The repository calls itself source-available; the navigation panel calls it open source.

None of this requires bad faith to explain. A 76-day-old project shipping 103 versions has three surfaces — product, docs, site — edited by different hands at different speeds, and the docs are winning on accuracy. But you are the one who has to reconcile them before you put it in front of a client, and the reconciliation takes an afternoon:

Set the API key, read the licence, flip the three analytics switches, count the SBOM packages, and run the tenant test if there is more than one of you. If all five come back the way the repository predicts, you know precisely what you bought. If the commercial licence comes back with a price and the provider questions come back with a yes, you have a tool worth the 297 MB.