Open Cowork

The deciding trait is what comes out the other end. A skills system produces actual presentations, documents, spreadsheets and PDFs, so a request that ends in a file ends in a file rather than in a block of text you then have to assemble by hand. For anyone whose week is half documents, that is the difference between help and homework.

You are the wrong buyer if you are here for source code, because this is aimed elsewhere and it shows. Pick it for document work. Pick a coding agent for a repository.

The isolation is asymmetric. Shell commands run inside a virtual machine, which is a real boundary, and the headline capability drives the desktop applications on the host, which is outside it. So the strongest containment protects the weakest capability, and the feature that clicks buttons in your signed-in applications answers to nothing but the model.

What it gets right is stating the boundary. The documentation says which mechanism applies on which platform, so a careful reader can work out what is protected without guessing.

1. Confinement is layered rather than singular: a virtual machine bounds execution and a user-selected folder bounds file access, which are different mechanisms addressing different threats and it is correct that both exist. 2. The documentation recommends a specific model for screen understanding, which is an unusually concrete admission that capability here is model-dependent.

2. That admission is worth more than a benchmark would be, because it tells a reader the result varies with a choice they control. No evaluation is published and none is claimed.

2,104 stars arrived quickly because the positioning does the marketing: it is defined as the open alternative to a named commercial product. That is efficient and it is borrowed. The demand curve belongs to the other company, and a change in their pricing or packaging moves this project's audience without anyone here voting.

Moat: none, beyond being early to the comparison. Likely acquirer: none. Likely path: relevance tracks the incumbent's decisions. Position: use it, and do not read its star count as evidence of anything except the incumbent's price.

Zero licence cost, and the spend is whichever provider each developer configures, which is already a policy gap at sixty people. The larger issue is what runs where: this operates the applications installed on a corporate laptop, and I have no console, no SSO and no audit log telling me what it did in them.

Nothing runs in a pipeline, so there is no delivery metric to point at either. Onboarding is trivial, which is not always good news. Not yet, and the blocker is an audit trail for desktop actions.

MIT, so the whole thing is mine to change, and the extension seam is MCP rather than a bespoke plugin format, which means the connectors I maintain work here without translation. That is the right choice and enough projects get it wrong that I notice when one does not.

The provider list is wide and takes any OpenAI-compatible endpoint, so I am not tied to a single vendor's pricing. The weights are still somebody else's, which is the one place this stops being mine.