OpenBot

The deciding trait is that each bot gets a computer of its own: a real browser carrying its own logins and its own files, rather than everything sharing one session and one cookie jar. If you have ever watched two automations fight over the same account, you already know why that matters more than any feature on the list.

What you are signing up for is operations. This is infrastructure you run, not software you open. Pick it if a browser with credentials is the actual requirement. Otherwise you want something smaller.

Distribution is the defect. You clone the repository and replace the example tenant with your own, which means your configuration and the upstream code occupy the same files. There is no version to pin and no dependency to bump. Every improvement upstream becomes a merge conflict against changes you made to make it yours, and that cost recurs forever.

What it does right is being explicit about the stage. The label is on the front page rather than discovered in an issue thread three weeks in.

1. Fail-closed is the load-bearing word. A permission layer that defaults to denial is verifiable by construction, whereas a default-allow layer is only as complete as the list somebody remembered to write. 2. Placing the decision and the record in the same path means the log cannot drift from what was permitted, which is the failure that makes most audit trails useless.

2. The expression language is an existing one rather than an invented DSL, so its semantics are already specified elsewhere and do not need to be trusted here.

The commercial design is legible and I do not mind it. Give away the platform, keep a dependency on a service you operate, and the free plan converts on the day a deployment matters. Four thousand stars measures reach into the audience that would pay, which is a better signal than the number itself.

Moat: the funnel, plus whatever the hosted service accumulates. Likely acquirer: an application platform buying the developer relationship. Position: viable, and price the free tier as a promotion rather than a term.

There is no seat price, and that is the smallest number in this review. The real cost is a database we back up, a compose deployment we patch, and an on-call rotation that now covers something the vendor cannot page for, because there is no hosted alternative and therefore no support relationship to buy.

Nothing here runs in our pipeline, so it does not integrate with review or CI as a step. Onboarding is an infrastructure exercise rather than a login. Not yet: revisit when a managed deployment exists to compare against.

Standardising on a protocol instead of a plugin interface is the decision I care about. My agent does not have to be written here, or in the same language, or against a proprietary base class; it has to answer at an endpoint. Five frameworks are named as working and the sixth is whatever I write tomorrow.

MCP servers attach as tools, the licence keeps a fork legal, and the whole thing runs on my hardware with my key. That combination is rare enough that I will forgive a lot elsewhere.