# AnyBot

[中文 README](README.md) · **English**

Your own AI bot. It chats, and it *does things*: files, shell commands, your browser, your screen, scheduled jobs. Self-hosted — your data stays on machines you own.

- Every bot can use a different model: xAI Grok, OpenAI, Claude, Gemini, OpenRouter, OpenCode Go, Ollama (local), or any OpenAI-compatible endpoint
- Desktop app (macOS, Linux) + mobile web app (install to home screen, push notifications)
- Multiple computers: one **brain**, the others are its **hands** — all linked through your own account server, no ports opened

## Demo

<!-- Drop a GIF/video at docs/demo/anybot.gif (see docs/demo/README.md) and it shows here. -->
📹 *No recording yet — see [docs/demo/README.md](docs/demo/README.md).*

## How it compares

| | AnyBot | OpenClaw | OpenHands | Khoj | UI-TARS-Desktop |
|---|---|---|---|---|---|
| Positioning | Personal bot across your machines | Agent gateway on your hardware | Coding agent in sandboxes | Personal knowledge/RAG assistant | GUI agent on one desktop |
| Chat with your own bots | ✅ multi-bot, per-bot model | ✅ via gateways | coding-focused | ✅ | — |
| Controls your real desktop/browser | ✅ + approvals, VNC takeover | via plugins | sandboxed, not your desktop | — | ✅ (its whole product) |
| Multi-device brain/hands/phone | ✅ built in, zero open ports | bring your own | — | server + apps | single machine |
| Bot's own sandboxed computer (Docker, optional gVisor) | ✅ | host shell | ✅ | — | — |
| Secrets never enter the model (vault fills forms directly) | ✅ | — | — | — | — |
| Phone web app + push, no app store | ✅ | community | — | ✅ | — |
| One binary, JSON files, no database server | ✅ | ✅ | — | needs services | Electron |
| License | Apache-2.0 | MIT | MIT | AGPL-3.0 | Apache-2.0 |

AnyBot's bet: a bot that touches your real machines is only trustworthy when the **harness** — not the model — owns the safety gates: per-action approvals, a sensitive-click policy the model cannot talk its way past, secrets painted out of screenshots, and an audit trail that survives crashes.

## Install

Pick one row, paste it into a terminal. The script installs what's needed (system packages, Rust, Docker).

| I want… | On which machine | Command |
|---|---|---|
| **Desktop app** | macOS, Linux with a screen | `curl -fsSL https://code.30cm.net/daniel.w/AnyBot/raw/branch/main/install.sh \| sh` |
| **Account server** (+ brain + HTTPS) | A Linux host with a domain | `curl -fsSL https://code.30cm.net/daniel.w/AnyBot/raw/branch/main/install.sh \| sh -s -- server` |
| **Add a computer as hands** | Any Linux (headless fine) | In AnyBot press “Add a computer”, paste the one-liner it shows |

First run compiles on your machine (5–15 min); later updates take 1–2 min. Read the script first: [install.sh](install.sh). It installs into your user folders — no root.

## Getting started

**One computer:** install the desktop app → Settings › Models → paste an API key → chat.

**Phone + several computers:** run the server once (asks only for URL, account, password; gets HTTPS by itself), open the URL on your phone and “Add to Home Screen”, then pair other computers with one-time pairing codes. Any Linux box can become the bot's own computer, running inside Docker (optionally gVisor). A Mac can be the brain instead of a server ([docs/multi-device.md](docs/multi-device.md), method B). No database to run: state is a handful of JSON files, crash-safe writes; back up two Docker volumes.

## Updates, removal

| What | Command |
|---|---|
| Update app / hands | re-run the install line |
| Update server | on the server: `cd ~/AnyBot && make server` → “keep settings, update, restart” |
| Uninstall the program | `cd ~/AnyBot && make uninstall` (your bots and chats are kept) |
| Stop a hands machine | `systemctl --user disable --now anybot` |

## Troubleshooting

```sh
cd ~/AnyBot && make doctor
```

It tells you what's missing. Common: `Killed`/`signal: 9` while compiling → add 2 GB swap; `requires rustc 1.95` → `rustup update stable`; Mac says “cannot verify developer” → right-click › Open once; phone says “brain offline” → the brain machine is asleep ([docs/multi-device.md](docs/multi-device.md)).

## Build from source

```sh
git clone https://code.30cm.net/daniel.w/AnyBot.git
cd AnyBot
make deps && make && make install   # deps: system packages + Rust 1.95+ (one time)
```

`make run` · `make test` · `make doctor` · `make serve` (headless) · `make setup` (pair this machine) · `make server` · `make dist` · `make help`. Needs: Rust ≥1.95, a C compiler, git; on Linux also `pkg-config` + `libasound2-dev` (deps installs all).

## Deployment

| Method | For | Notes |
|---|---|---|
| **Docker Compose** (default) | server | `install.sh server`: relay + brain + Caddy (auto-HTTPS) containers; data in Docker volumes; Tailscale URLs skip Caddy ([compose file](deploy/server/docker-compose.yml)) |
| Unattended | servers, Ansible | `ANYBOT_SETUP_USER=… ANYBOT_SETUP_PASSWORD=… [ANYBOT_SETUP_DOMAIN=…] sh install.sh server` |
| Portainer/Coolify/Dokploy | existing PaaS | they take the standard `deploy/server/docker-compose.yml` — set `ANYBOT_USER`, `ANYBOT_PASSWORD`, `ANYBOT_RELAY_PUBLIC_URL` |
| **systemd** user service | hands, headless brains | `anybot setup` installs `anybot.service`; `loginctl enable-linger` to keep it running logged-out |
| **launchd** | Mac as brain/relay | see [docs/multi-device.md](docs/multi-device.md) |
| Gitea Actions | release builds on `v*` tags | see [docs/release.md](docs/release.md) |

## Security in one paragraph

Commands run in a macOS sandbox (deny ~/.aws, Keychain, AnyBot's own data; allow only the attachments dir); per-action approvals with a policy layer the model cannot negotiate; clicking anything labelled “send/pay/transfer” is asked *every time*, even in direct mode, with no grant that silences it; card numbers and OTPs in screenshots are painted black before the model sees them; everything read from outside is wrapped as `<untrusted>` data, never treated as orders; the bot's own computer is a Docker container (gVisor for a second wall); relay stores only hashes (argon2id) and supports 2FA with recovery codes; egress binds loopback + detected bridge gateways, never 0.0.0.0. Details: [SECURITY.md](SECURITY.md) ([summary here](docs/en/security.md)) and [docs/architecture.md](docs/architecture.md) (Chinese; [English summary](docs/en/architecture.md)).

## Documentation

| Doc | Contents |
|---|---|
| [docs/install.md](docs/install.md) ([en](docs/en/install.md)) | per-platform details, manual steps, FAQ |
| [docs/multi-device.md](docs/multi-device.md) ([en](docs/en/multi-device.md)) | brain / hands / screen: setup, pairing, offline |
| [docs/architecture.md](docs/architecture.md) ([en](docs/en/architecture.md)) | layers, data storage, security design |
| [docs/protocol.md](docs/protocol.md) ([en](docs/en/protocol.md)) | relay API and long-connection wire format |
| [docs/release.md](docs/release.md) | packaging, CI |
| [FEATURES.md](FEATURES.md) | every feature (Chinese) |

## License

Apache License 2.0 — see [LICENSE](LICENSE). Copyright the contributors (The AnyBot contributors). Calls to third-party services (xAI, OpenAI, …) go through their public APIs; follow each service's terms and your own key agreements.

## Repository layout

```
install.sh      one-line installer (app, hands, server)
src/            AnyBot: desktop app, headless, `anybot setup`
relay/          account server
mobile/         phone web app (single file, embedded)
box/            the bot's own computer (Docker container)
deploy/         per-platform install & deployment files
docs/           technical docs (docs/en/ = English)
bench/          computer-use benchmark (tasks, scoring, red-team suite)
```