OpenDuet: CopilotKit's Open-Source Proactive Agent, Explained and Compared With Claude Duet

OpenDuet is CopilotKit's open-source answer to the proactive agent: an assistant that briefs you in the morning, sorts what needs attention, and keeps working in its own browser while asking before it does anything irreversible. The repo, CopilotKit/OpenDuet, picked up about 1,600 stars in the nine days since October 21, 2026, and is MIT licensed.

This guide covers what it actually does, how to run it, the catches in the setup, and how it compares with the closed product it takes its cue from, Claude Duet.

TL;DR: OpenDuet in one table

What does OpenDuet do?

According to the README, OpenDuet is "an open-source proactive agent that gets your work done and keeps you in the loop." In practice that breaks into four behaviors.

A morning brief and triage. It reads Gmail, Calendar and Slack, separates what needs you from what can wait, and presents a short summary at the start of the day.

A computer of its own. Each agent gets a Chromium browser, a workspace and a shell inside Docker, so it can do multi-step web work without touching your machine directly.

Approval gates. For anything that changes something in the world (sending a message, making a payment, signing a document, deleting data) it asks. You can allow once, always allow, or refuse. Password entry is masked so the agent never reads your passwords, and outgoing messages are checked for sensitive data.

Skills, routines and channels. You can call reusable skills with a slash, schedule routines, and talk to it from the web, Slack or Microsoft Teams. Customization lives in one folder, openbot/examples/openduet.

How does it relate to OpenBot and Claude Duet?

OpenDuet is a template on top of CopilotKit's OpenBot platform, which we covered in OpenBot: CopilotKit's open-source AI coworkers with a computer each. OpenBot supplies the runtime, the agent computers and the connectors. OpenDuet adds the proactive behavior and the daily-brief interface.

Claude Duet is Anthropic's research-preview app that messages you first; see our explainer on Claude Duet and its proactive design and the wider comparison of proactive agents from Anthropic, OpenAI, Meta and xAI. OpenDuet's README names Claude Duet as an example of the category and states plainly that it is independent and not endorsed by Anthropic.

Where the table says "closed", read it as a description of availability, not a quality ranking. We have not benchmarked the two against each other, and this post does not claim one is better.

How to run OpenDuet

The README's quick start, in order:

1. Install Docker, Bun 1.3 or later and Node.
2. Clone the repository and copy .env.example to .env.
3. Run bun install.
4. Log in with the CopilotKit CLI and select an Intelligence project.
5. Add a model key to .env (OpenAI is the default).
6. Run bash scripts/start.sh and open localhost:3010.

For Gmail and Calendar you need a Google OAuth client. If you only want to try the interface, the README offers a fake Google server so you can test without connecting a real account. We recommend starting there: you see the brief, the triage and the approval prompts with no real mail at stake.

The catches you should know before trying it

It is not fully self-contained. The server will not start without a CopilotKit Intelligence key, because threads and memory depend on it. "Open source" here means the code is MIT; the memory service is a CopilotKit project you sign into. If your goal is a fully offline agent, this is not that.

No production path yet. The README says there is no hosted or deployment guide and no OpenDuet container image. The Docker and Helm guides under openbot/docs deploy plain OpenBot, not OpenDuet. Treat it as a local experiment.

It is early. The README's own words are "Early, and in active development," with a warning to expect things to move. At the snapshot we read there were 4 open issues and 7 open pull requests, which is normal for a young repo and also a signal that interfaces will change.

Proactive agents widen your attack surface. An agent that reads your inbox and chat and can act is a prompt-injection target: a hostile email can contain instructions. The approval gates help, but "always allow" removes them for that action class. Keep the always-allow list short, and review what the agent can reach. For teams running agents with real access, AgentBeam, the agent security platform from the explainx.ai team, stops agents before dangerous actions, and the open-source Bernstein governance layer shows a policy-as-code approach.

What to try first

If you decide to test it, a safe sequence looks like this:

• Run it against the fake Google server and read the morning brief.
• Trigger an action that needs approval and check what the prompt shows before you allow it.
• Add one MCP connector, such as a docs or notes tool, and see how the agent uses it. If MCP is new to you, start with our guide to the Model Context Protocol.
• Write one skill in openbot/examples/openduet for a task you repeat, then schedule it as a routine.
• Only then connect a real account, with a throwaway or low-stakes mailbox first.

Memory is the part worth watching. Persistent memory makes a proactive agent useful and also makes mistakes persist. Our write-up of claude-mem and the memory tax paper are useful background on when memory helps and when it hurts.

Under the hood: the pieces and why they matter

The stack listed in the README is more informative than the feature list, because it shows which parts you would have to own if you adopted it.

• OpenBot with a Hono server and the CopilotKit runtime handles requests, tool calls and agent lifecycle. This is the layer that decides which agent runs and what it can touch.
• The AG-UI protocol connects the agent to the front end, so the brief, the approval prompts and streaming progress all arrive through a standard event stream rather than custom glue.
• Chromium-based agent computers in Docker give each agent an isolated browser and shell. Isolation is the main reason a proactive agent can work unattended without running loose on your laptop, though container escape and network egress still need your own review.
• PostgreSQL with pgvector stores embeddings, which is how a long-running agent recalls earlier threads and preferences.
• MCP connectors such as Google Drive and Notion add tools without custom code.

If you only want to learn, the value is reading how these layers are wired. If you want to deploy, the cost is operating Docker, a database and an external memory service for something that is explicitly labeled early.

Who should try it, and who should wait

Try it now if you build agent products and want a working reference for proactive behavior, approval design and per-agent computers. It is also a reasonable base for an internal prototype that never touches production data.

Wait if you need a supported deployment, an audited data path, or a fully self-hosted memory layer. Check the issue tracker and pull requests every few weeks; the missing container image and deployment guide are the obvious things to watch for, and a release that adds them would change the verdict.

Why this matters

Proactive agents are the next product category after chat and coding agents: instead of waiting for a prompt, they watch your work and come to you. The first versions are closed apps from large labs. OpenDuet shows the open ecosystem moving quickly to copy the shape, which matters for two reasons. It lets developers study how the approval, memory and scheduling layers fit together, and it gives teams who cannot send mail data to a third-party assistant a starting point they can modify.

It also shows the limits of "open" in practice. The code is MIT, but memory runs through a vendor service, the default model is a hosted API, and there is no production deployment guide. Compare that with what you actually need before you commit engineering time.

Questions people are asking

Can I use Claude with it? The README says Anthropic and other OpenAI-compatible endpoints can be configured, though OpenAI is the default.

Does it read my passwords? The README says password entry is masked so the agent never reads them.

Can it send email without asking? By default it asks for approval before sending. If you choose "always allow" for that action, it will not ask again for that class.

Is it safe for work accounts? We would not connect a work mailbox before reviewing your company's policy on third-party agents and the data path through the Intelligence service.

Related reading

• Claude Duet: Anthropic's proactive agent explained
• Claude Duet vs OpenAI Dots vs Meta Muse vs Grok Bot
• OpenBot by CopilotKit
• What is MCP? Complete guide
• Bernstein: governance layer for AI coding agents
• claude-mem persistent memory guide

Details are from the OpenDuet README and repository page as of October 30, 2026; the project is changing quickly.