Price terms as published
Each line is the vendor’s own wording, split from the price capture checked on 2026-09-22. Nothing here is rounded, converted or re-worded — the full sentences stay in the review below. Lines that carry only a price continue the plan named on the line above, in the vendor’s own order.
| # | Plan / term | Checked |
|---|---|---|
| 1 | Free (MIT) | 2026-09-22 |
One-liner: OpenWorker is an open-source desktop “AI coworker” published by Andrew Ng (andrewyng) that aims to deliver finished work — reviewed code, documents, triaged inboxes — rather than chat, with human approval gates around consequential actions.
Verified facts (checked 2026-09-22)
| Attribute | Value | Source |
|---|---|---|
| GitHub stars | 18,092 (2,572 forks) | andrewyng/openworker via GitHub API, 2026-09-22 |
| License | MIT | GitHub API, 2026-09-22 |
| Repository created | 2026-07-20 | GitHub API |
| Last push | 2026-09-19 | GitHub API |
| Maturity | Open beta (“fully usable, updates itself”) | repository README |
| Downloads | macOS 12+ Apple Silicon (signed & notarized); Windows 10/11 x64 (not yet code-signed — SmartScreen warning) | repository README |
What it actually does
The app runs on your machine as a local agent server (Python, built on aisuite) under a native desktop shell. You bring your own model key — OpenAI, Anthropic, Google, an open-weight provider, or fully local via Ollama — so your data leaves the machine only through the model and integrations you choose. Specialist “coworkers” ship first for security work: vulnerability review (deterministic scanners such as semgrep plus model reasoning, with fixes re-scanned before approval), cloud posture audits and incident triage, alongside everyday tasks like briefs, documents and inbox triage. It supports 25+ connectors (GitHub, Slack, Jira, Notion, Gmail and others), any MCP tool, scheduled automations, and working from Slack via @OpenWorker mentions.
Governance is the differentiator and is built into the architecture rather than added as a setting:
- Hard floors — a set of dangerous or irreversible operations is always human-only; no mode, including full auto-approve, bypasses them.
- Earned autonomy — actions are approval-gated by default; one-off approvals can graduate into standing rules and allowlists, each step explicit and revocable. In auto-approve mode a reviewer model passes routine actions and escalates uncertainty; repeated denials trip a circuit breaker.
- Audit trail — every tool call is logged with its approval provenance and the reviewer’s reasoning. Unattended runs never self-approve; their requests park in an inbox.
What the marketing doesn’t say
It’s still beta software with 505 open issues at check time, and the team openly says rough edges are being polished. Windows builds are not yet code-signed, so installing means clicking through a SmartScreen warning; macOS users get a signed, notarized, auto-updating build. Governance also adds friction by design — before sending messages, changing calendars or running commands, the agent checks in and waits. If you want an agent that acts without prompts, that is precisely what this project refuses to do.
Who should use it
Teams and professionals who want an AI coworker for real deliverables but require approval gates, auditability and local-first data handling, and who trust the BYOK model. Security-focused teams are the clearest early audience. If you want a zero-friction, fully autonomous agent or a cloud-only managed service, OpenWorker’s governance-first design is intentionally not aimed at you.
Repository stats, license text, download status and governance design verified against primary sources on 2026-09-22. This entry follows our verification policy: every claim here was checked against primary sources, not copied from other reviews.