AnyModelBot is a new open-source desktop agent app that pitches itself as a local-first alternative to Grok Bot, OpenAI dots and Claude Duet. The repository, modelflare-ai/AnyModelBot, shows about 2,100 stars and an MIT license. It lets you run several named bots, each with its own model, folder and memory, and reach them from the desktop app or from chat apps.
There is one important catch. "Local-first" describes where your files and memory live. It does not describe where your prompts go. Every model call goes through Modelflare, a paid gateway run by the same group, and the README says so plainly.
TL;DR: AnyModelBot at a glance
| Question | Answer |
|---|---|
| What is it? | An open-source desktop and Docker app for running persona bots on any model |
| License | MIT, with third-party parts under their own licenses |
| Platforms | Windows, macOS, Linux, and Docker |
| Is the app free? | Yes, no subscription. You pay per token to Modelflare |
| Which models? | One Modelflare key reaches 13 vendors and 70+ text, image and video models, per the README |
| Channels | App, WeChat, Feishu, Telegram, Slack, Discord |
| Does data leave my device? | Yes. Prompts, file contents and tool results go to Modelflare, then to the provider |
| Language | The README is mostly Simplified Chinese |
Agents that act on your behalf need rules. See how explainx helps secure your agents →
Why is this repo trending now?
October 2026 brought a wave of "agents that act for you" from the big labs. Anthropic shipped Claude Duet, a proactive agent that messages you first. OpenAI has dots, and xAI has Grok Bot. We put them side by side in our Claude Duet vs OpenAI dots vs Meta Muse vs Grok Bot comparison.
Open-source clones followed within days. We covered OpenDuet from CopilotKit and Rakazo. AnyModelBot is the third in that line. Its README compares it with all three vendor products, and the repo now shows about 2,100 stars.
What sets it apart is the reach into Chinese chat apps. WeChat and Feishu are first-class channels, alongside Telegram, Slack and Discord.
What can an AnyModelBot bot do?
The README describes bots as personas. Each has a default model, a workspace and its own memory. Here is what the project lists.
- Files and commands. Bots read and write files, run commands in a sandbox, and ask for approval before acting outside their workspace.
- Three permission levels. Read-only, workspace (the default), or full access.
- Background work. Long tasks run in the background and report back. Scheduled "rules" can check a condition at set times. A "needs you" area collects approvals and questions.
- Computer use. Bots can operate the desktop through the bundled Cua Driver. On macOS this is Beta.
- Media. Bots generate images and video, and ask first if the estimated cost passes 0.5 dollars.
- Memory. Three layers of Markdown memory (team, bot, group). The README says content that looks like secrets is filtered out.
- Group chat. Several bots can share one chat with @-mention routing. This works in the app only.
Compare that with the vendor products. Claude Duet and dots focus on proactive messages. AnyModelBot's pitch is more about control: you pick the model, set the budget, and choose how far a bot may go.
How do budgets and approvals work?
This is the most practical part of the design. Agents that run unattended can burn money. AnyModelBot ships default caps.
| Limit | Default |
|---|---|
| Task budget | 1 dollar |
| Scheduled rule, per run | 0.1 dollars |
| Scheduled rule, per month | 3 dollars |
| Image or video confirmation | Above 0.5 dollars estimated |
| Quiet hours | 22:00 to 08:00 |
Agent permission boundary: a key fits a narrow opening in a fence, picturing AnyModelBot workspace permissions
Approvals matter more than budgets. A bot on workspace permission can edit files inside its folder without asking. Anything outside, such as moving files from your Downloads folder, triggers an approval card. Computer use runs actions automatically by default, according to the README. You can switch on a confirmation for each click and keystroke, and you should for anything sensitive.
This matches a lesson from the vendor products. In our report on ChatGPT dots sending an unapproved email, the failure was an action taken without a clear approval step. Per-action approval is the right default, and it only helps if you read the card.
What is Modelflare, and why does it matter?
The app reaches models through Modelflare, which the README describes as a paid API gateway operated by Havenbyte LLC. The README says one key reaches 13 vendors and more than 70 models, including GPT, Claude, Gemini, Grok, DeepSeek, Kimi and GLM. It states compatibility with OpenAI, Anthropic and Gemini protocols.
Three points to weigh:
- It is a commercial funnel. The README promotes Modelflare heavily, with cache-hit guarantees, discount multipliers and a limited-time promotion. The project is open source, but the model access is not free. Read the promotion terms on Modelflare's own page, not in the README.
- Your data passes through a third party. The README states that prompts, file contents and tool results are sent to Modelflare and then to the chosen provider. It says Modelflare keeps request logs, and that it cannot guarantee nothing leaks.
- Service domains are manual. There are three API domains, and the app does not switch between them automatically.
If you handle client data, source code under NDA, or personal records, treat this as a hosted service with logs. That is a very different privacy position from a model running on your own machine. Our analysis of AI agent privacy promises explains why "local" claims need a careful read.
What is under the hood?
| Layer | Component |
|---|---|
| UI | Preact and htm, no build step |
| Backend | Node.js and TypeScript, with node:sqlite for storage |
| Desktop shell | Electron with a tray icon |
| Gateway | magpie, a Go component under MIT, bundled and launched by the app |
| Agent runtime | DeepSeek Harness, as a separate process |
The runtime choice is notable. DeepSeek Harness is DeepSeek's own agent harness, which we covered in DeepSeek Harness Desktop for macOS and Windows. AnyModelBot reuses it rather than building its own loop. That is a sensible shortcut, but it also means the agent behavior depends on a separate project's changes.
Channels use long-lived connections or polling: Feishu long connection, WeChat through iLink, Telegram long polling, Slack Socket Mode and Discord Gateway. It can also read Notion and Feishu messages as read-only data accounts.
How do you install it?
There are three routes, all from the README.
Desktop. Download a build from the Releases page. Verify it with sha256sum -c SHA256SUMS --ignore-missing.
Docker.
docker run -d --name amb -p 3600:3600 -v amb-data:/data ghcr.io/modelflare-ai/anymodel-bot
docker exec amb cat /data/ui-token
Then open http://<host>:3600/?token=<token>. The README warns against exposing port 3600 directly to the public internet.
From source. This needs Node.js 22.13 or newer and Go 1.26.8 or newer.
git clone https://github.com/modelflare-ai/AnyModelBot.git
cd AnyModelBot
npm install
npm run setup
npm start
The local console then listens on http://127.0.0.1:3600/. The desktop app generates a new access token at every launch. By default the bot answers only its owner and approved users. Anyone else gets a notice and no model call is made.
What are the limits?
The README is candid here, and the list is useful.
- Telegram voice messages cannot be understood yet.
- Telegram, Slack and Discord handle one-to-one chats only. Group chat is app-only.
- Scheduled rules do not run while the computer is off.
- Computer use needs a desktop session, and macOS support is Beta.
- Roadmap items that are not shipped: email and calendar triggers, always-on hosting, custom MCP servers, bot-to-bot collaboration, and a standalone mobile app. The README says the roadmap is not a commitment.
- The vendor comparison table is the project's own and rests on public reporting from October 2026, which may be out of date.
The repo shows 248 commits on master and one open issue. A single open issue on a repo that new says it is early, not that it is flawless.
Who should try it, and who should wait?
Try it if you want to experiment with persona bots, you are comfortable with a gateway that logs requests, and you want per-task dollar caps. It is also a good fit if WeChat or Feishu is your main chat tool.
Wait, or use another option, if you need data to stay on your device. In that case, use a local model runtime and an agent that talks to it directly. Our Grok Bot workshop covers safe setup habits for always-on agents, and they apply here too.
A safe first run:
- Use a fresh machine user or a VM, not your daily profile.
- Keep every bot on workspace permission. Do not enable full access.
- Put a small balance on the Modelflare account and leave the 1 dollar task cap in place.
- Do not connect Notion, Feishu or email data accounts until you have read what each one reads.
- For agent-action safety in general, see AgentBeam, the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.
What this means for what you build or pay
The pattern is clear. Proactive, always-on agents are becoming a product category, and open-source copies arrive within days. The real differences are not the chat window. They are budgets, approvals, memory handling and where the data goes.
When you evaluate any of these, ask four questions. Who sees my prompts? What can the bot do without asking? What is the spending cap? What stops a runaway schedule? AnyModelBot answers the last three with visible defaults and gives an honest, if buried, answer to the first.
Related reading
- Claude Duet: Anthropic's proactive agent, explained
- Claude Duet vs OpenAI dots vs Meta Muse vs Grok Bot
- OpenDuet: CopilotKit's open-source proactive agent
- Rakazo: an open-source Grok Bot alternative
- ChatGPT dots and the unapproved email
- AI agent privacy promises
- DeepSeek Harness Desktop
- AnyModelBot repository
Star counts, defaults and install steps come from the AnyModelBot README as of November 3, 2026, and may change.