Your own AI bot. It chats, and it *does things*: files, shell commands, your browser, your screen, scheduled jobs. Self-hosted — your data stays on machines you own.
- Every bot can use a different model: xAI Grok, OpenAI, Claude, Gemini, OpenRouter, OpenCode Go, Ollama (local), or any OpenAI-compatible endpoint
- Desktop app (macOS, Linux) + mobile web app (install to home screen, push notifications)
- Multiple computers: one **brain**, the others are its **hands** — all linked through your own account server, no ports opened
## Demo
<!-- Drop a GIF/video at docs/demo/anybot.gif (see docs/demo/README.md) and it shows here. -->
📹 *No recording yet — see [docs/demo/README.md](docs/demo/README.md).*
| Positioning | Personal bot across your machines | Agent gateway on your hardware | Coding agent in sandboxes | Personal knowledge/RAG assistant | GUI agent on one desktop |
| Chat with your own bots | ✅ multi-bot, per-bot model | ✅ via gateways | coding-focused | ✅ | — |
| Controls your real desktop/browser | ✅ + approvals, VNC takeover | via plugins | sandboxed, not your desktop | — | ✅ (its whole product) |
| Multi-device brain/hands/phone | ✅ built in, zero open ports | bring your own | — | server + apps | single machine |
| Secrets never enter the model (vault fills forms directly) | ✅ | — | — | — | — |
| Phone web app + push, no app store | ✅ | community | — | ✅ | — |
| One binary, JSON files, no database server | ✅ | ✅ | — | needs services | Electron |
| License | Apache-2.0 | MIT | MIT | AGPL-3.0 | Apache-2.0 |
AnyBot's bet: a bot that touches your real machines is only trustworthy when the **harness** — not the model — owns the safety gates: per-action approvals, a sensitive-click policy the model cannot talk its way past, secrets painted out of screenshots, and an audit trail that survives crashes.
## Install
Pick one row, paste it into a terminal. The script installs what's needed (system packages, Rust, Docker).
| I want… | On which machine | Command |
|---|---|---|
| **Desktop app** | macOS, Linux with a screen | `curl -fsSL https://code.30cm.net/daniel.w/AnyBot/raw/branch/main/install.sh \| sh` |
| **Account server** (+ brain + HTTPS) | A Linux host with a domain | `curl -fsSL https://code.30cm.net/daniel.w/AnyBot/raw/branch/main/install.sh \| sh -s -- server` |
| **Add a computer as hands** | Any Linux (headless fine) | In AnyBot press “Add a computer”, paste the one-liner it shows |
First run compiles on your machine (5–15 min); later updates take 1–2 min. Read the script first: [install.sh](install.sh). It installs into your user folders — no root.
## Getting started
**One computer:** install the desktop app → Settings › Models → paste an API key → chat.
**Phone + several computers:** run the server once (asks only for URL, account, password; gets HTTPS by itself), open the URL on your phone and “Add to Home Screen”, then pair other computers with one-time pairing codes. Any Linux box can become the bot's own computer, running inside Docker (optionally gVisor). A Mac can be the brain instead of a server ([docs/multi-device.md](docs/multi-device.md), method B). No database to run: state is a handful of JSON files, crash-safe writes; back up two Docker volumes.
## Updates, removal
| What | Command |
|---|---|
| Update app / hands | re-run the install line |
| Update server | on the server: `cd ~/AnyBot && make server` → “keep settings, update, restart” |
| Uninstall the program | `cd ~/AnyBot && make uninstall` (your bots and chats are kept) |
| Portainer/Coolify/Dokploy | existing PaaS | they take the standard `deploy/server/docker-compose.yml` — set `ANYBOT_USER`, `ANYBOT_PASSWORD`, `ANYBOT_RELAY_PUBLIC_URL` |
| **systemd** user service | hands, headless brains | `anybot setup` installs `anybot.service`; `loginctl enable-linger` to keep it running logged-out |
| **launchd** | Mac as brain/relay | see [docs/multi-device.md](docs/multi-device.md) |
| Gitea Actions | release builds on `v*` tags | see [docs/release.md](docs/release.md) |
Commands run in a macOS sandbox (deny ~/.aws, Keychain, AnyBot's own data; allow only the attachments dir); per-action approvals with a policy layer the model cannot negotiate; clicking anything labelled “send/pay/transfer” is asked *every time*, even in direct mode, with no grant that silences it; card numbers and OTPs in screenshots are painted black before the model sees them; everything read from outside is wrapped as `<untrusted>` data, never treated as orders; the bot's own computer is a Docker container (gVisor for a second wall); relay stores only hashes (argon2id) and supports 2FA with recovery codes; egress binds loopback + detected bridge gateways, never 0.0.0.0. Details: [SECURITY.md](SECURITY.md) ([summary here](docs/en/security.md)) and [docs/architecture.md](docs/architecture.md) (Chinese; [English summary](docs/en/architecture.md)).
| [docs/architecture.md](docs/architecture.md) ([en](docs/en/architecture.md)) | layers, data storage, security design |
| [docs/protocol.md](docs/protocol.md) ([en](docs/en/protocol.md)) | relay API and long-connection wire format |
| [docs/release.md](docs/release.md) | packaging, CI |
| [FEATURES.md](FEATURES.md) | every feature (Chinese) |
## License
Apache License 2.0 — see [LICENSE](LICENSE). Copyright the contributors (The AnyBot contributors). Calls to third-party services (xAI, OpenAI, …) go through their public APIs; follow each service's terms and your own key agreements.
