OpenWork: The Open-Source Claude Cowork Alternative That Runs Your AI Agent Locally

"Claude Cowork proved people want an AI teammate that drives the desktop. OpenWork's bet is that they don't want to pay $200/month or ship their files to someone else's cloud to get it."

When Anthropic shipped Claude Cowork in early 2026, it made a convincing case: an AI agent that doesn't just chat but actually moves files, runs commands, and completes multi-step work on your machine. The catch was just as clear — a Max subscription running $100–200/month, files processed in Anthropic's cloud, and a hard lock to Claude models. A project called OpenWork (GitHub: different-ai/openwork) walked straight into that gap. Built on the open-source OpenCode engine, wrapped in an Electron desktop app, and released under MIT for the community core, OpenWork had roughly 19,000 stars and 150,000+ downloads by August 2026, went through Y Combinator (Spring 2026), and briefly hit GitHub Trending #4. For a blog about AI you can run on your own hardware, OpenWork is a natural fit: it defaults to keeping your data on your machine, lets you bring your own model (including local Ollama), and shares one configured workflow across an entire team. This is the honest, no-hype breakdown.

1. What OpenWork Is (and Isn't)

OpenWork is not a model. It's a runtime and a workbench — the layer that lets an LLM actually operate your filesystem, terminal, and connected apps with guardrails. Under the hood it drives OpenCode, an 180,000-star open-source coding-agent engine, and presents it through a friendly desktop UI, a web UI, or a headless CLI. Think of the relationship like this: OpenCode is the engine; OpenWork is the car around it — the seats, the dashboard, the shared keys, and the controls that let a non-developer actually use it. The project's tagline is deliberately provocative: "the open-source Claude Cowork alternative." But it's more precise to call it a capability router — you define a skill or MCP connection once, and any compatible agent (Claude Code, Codex, Cursor) can call it. The license deserves a careful read, and we'll return to it in the limitations section: the community core is MIT, but the enterprise tier ships under FSL-1.1-MIT, a functional source license that isn't fully OSI-open for competitive use for its first year.

2. The Problem It Actually Solves

If you've used more than one AI coding assistant, you've hit this wall: the skill you tuned in Claude Code has to be reconfigured from scratch in Cursor. The MCP server your team spent a week wiring isn't reachable from your colleague's setup. Every agent is an island, and "shared corporate knowledge" means a Slack message. OpenWork's core thesis is that agent capabilities should belong to the team, not to a tool. Define a "competitive analysis report" workflow once, publish it, and everyone — across Claude Code, Codex, Cursor, or the OpenWork desktop — gets the same vetted behavior. That's the product, not "a free chatbot." This matters most for small teams that can't justify a platform engineer to babysit integrations. One person configures the sanctioned skills, MCP endpoints, and prompts; a generated link or config pushes it to the whole team. Workers are isolated per person, but the configuration is synchronized.

3. Architecture: Engine and UI Are Separate

Understanding the architecture explains why OpenWork is more than a fork. It's a four-layer system: 1. Interface layer — the Electron desktop app (macOS/Windows/Linux), a pure web UI, and a CLI. Same backend, three front doors. 2. Engine layer — OpenCode, the 180k-star agent engine handling sessions, tool execution, permissions, and SSE event streaming. 3. Orchestration layer — the OpenWork Orchestrator, a daemon managing multiple workspace lifecycles, including a headless mode so it can sit on a server as a 24/7 "AI colleague." 4. Integration layer — 50+ LLM providers plus MCP servers and the local filesystem. The smart part is the engine/UI separation. OpenCode can run with no OpenWork UI at all, which means the same agent core can later drive a web app, a chatbot, or a mobile client. You're not buying into a walled garden; you're adopting a module.

4. Three Run Modes

OpenWork ships in three shapes, and the difference is purely deployment:

• Desktop Host — the desktop app launches a local OpenCode instance. One click, personal use.
• CLI Host — openwork (or openwrk) from the command line, for headless or server deployment.
• Remote Client — connect to an already-running server so a team shares one configured instance.

The Remote Client mode is the one that turns OpenWork from "my tool" into "our tool." An IT admin stands up the host, configures the sanctioned skills and provider routing, and teammates connect. Their data and API keys stay on the shared server; zero privacy leakage to a third party.

5. "Capability Once, Reuse Everywhere"

This is the feature that justifies the hype. OpenWork exposes a single MCP endpoint (https://api.openworklabs.com/mcp/agent) that surfaces two tools — search_capabilities and execute_capability. Drop that into Claude Code, Codex, or Cursor and suddenly those agents can call every OpenWork skill, MCP connection, and Google Workspace / Microsoft 365 integration you've defined. Concretely: you debug a "weekly report generator" workflow in Claude Code. A teammate opens Cursor and uses the exact same workflow — no reconfiguration, no new tool to learn. OpenWork calls this "productizing agent workflows," and it's the closest thing the open ecosystem has to a portable agent app store. The built-in Skills Manager leans into this. Skills are just SKILL.md files in a project directory; OpenWork discovers and loads them. Community packages install with a one-liner (opkg install openpackage://essentials). The long-term play is an "Obsidian-plugin-style" ecosystem where the workflow you need only exists inside OpenWork — network effects by design.

6. Human-in-the-Loop and Visual Audit

A raw CLI agent is a black box: you don't know what it did until it breaks something. OpenWork attacks the trust problem two ways:

• Visual execution timeline. Every planned step and action — file edits, command runs, API calls — renders live in the UI, fully traceable.
• Permission prompts. Sensitive operations pop a three-way choice: allow once / always allow / deny. Non-technical users can safely run an agent without fearing accidental data loss.

This is the difference between "an intern with sudo" and "a supervised teammate." For legal, finance, and healthcare — industries where a wrong file move is a compliance incident — the approval gate isn't a nice-to-have; it's the reason the tool is admissible at all.

7. 50+ Models, Local-First

OpenWork does not lock you to one vendor. It supports OpenAI, Anthropic, DeepSeek, Qwen, and local Ollama, among 50+ providers, and you can route different tasks to different models. For China-based developers especially, a DeepSeek API key drops cost an order of magnitude below Claude. Crucially, local models are first-class. Point OpenWork's Custom Provider at a local Ollama address (http://localhost:11434) and the entire agent — planning, tools, file access — runs with no outbound model calls. That's the "data never leaves the building" configuration, and it's a one-line setting, not a recompile.

8. Team Sharing and Enterprise Deployment

OpenWork scales from "my laptop" to "our org" without a different product:

• Den control plane — centrally manage team members' model access, desktop policy push, and skill/plugin assignment.
• SSO + SCIM — enterprise identity and user sync, the table-stakes for IT compliance.
• Helm Charts + Kubernetes — full containerized deployment, including private-network and air-gapped (fully offline) environments.
• MCP OAuth — standardized enterprise MCP auth, with OAuth discovery for apps like Salesforce.

None of this is required to use OpenWork; it's the on-ramp for a team that wants governance. A two-person startup can ignore Den entirely and just share a config file.

9. The Honest Limitations

No review is useful without the downsides, and OpenWork has real ones:

• License split. The community core is MIT (genuinely free, genuinely open). But the enterprise edition is FSL-1.1-MIT — a Functional Source License. For its first year, competitive use (building a directly competing commercial product) is restricted; it converts to plain MIT after that. If you plan to fork and compete, read the license line by line. For normal use — including commercial internal use — MIT applies and you're fine.
• Pre-1.0 churn. The verified version is v0.18.12. The API and features can break between releases. Don't wire it into production-critical pipelines without pinning a version and staging updates.
• Speed vs Claude native. Reviews consistently note that on long, complex chains, OpenWork's execution speed and model ceiling lag behind Claude Cowork running on Anthropic's own infrastructure. OpenWork wins on openness, locality, and model freedom — not on raw "best model" performance.
• Submodule gotcha. Cloning requires git submodule update --init --recursive or the OpenCode dependency won't resolve. Minor, but it bites first-time builders.
• Not zero-config. Despite the friendly UI, a safe deployment still means setting Allowed Folders, choosing a provider, and deciding local vs cloud. "Free" doesn't mean "no decisions."

10. What It Costs (Real Numbers)

OpenWork the software is free under MIT. Your cost is the LLM behind it:

• Local model (Ollama). If you run Qwen 2.5:14B or DeepSeek-Coder on your own machine, marginal software cost is $0 — you pay only for the electricity and amortized hardware. A decent used GPU or an M-series Mac handles 14B-class models.
• Cloud model (bring your key). You pay the provider's token price. DeepSeek's API, for instance, runs roughly an order of magnitude cheaper than Claude for equivalent work; a team doing heavy agent runs might spend $20–80/month instead of $200/month per seat on a Cowork Max plan.
• Den / enterprise. The managed control plane has paid tiers for SSO, audit, and air-gap support; pricing is per-seat/enterprise and should be modeled against your headcount, not assumed free.
• Opportunity cost. The real expense is the engineer time to configure skills and MCP once. After that, it's amortized across the team.

Bottom line: for a 5-person team doing daily agent work, OpenWork + local-or-cheap-cloud models lands in the low-tens-of-dollars/month range versus $500–1000/month for five Cowork Max seats. The savings are the point.

11. Where Your Data Lands (Data Sovereignty)

This is the section that matters most for this blog. OpenWork's default posture is local-first:

• Files are read only from folders you explicitly allow (the "Allowed Folders" sandbox). They are not uploaded to OpenWork's cloud by default.
• With a local model, your documents, prompts, and agent actions never leave your machine. End-to-end private.
• With a cloud model (DeepSeek, OpenAI, etc.), your retrieved context and prompts travel to that provider — the same single trade-off as every local-AI tool. Choose local if the data is sensitive.
• The Den control plane is optional and cloud-based; you can skip it entirely and stay fully on-prem.

Sovereignty verdict: run OpenWork with a local model and it is end-to-end private, suitable for legal, medical, and financial work. Attach a hosted LLM and the prompt context leaves with it — decide per workload.

12. A Real Setup Walkthrough

Say you want a shared "competitor analysis" agent for a 4-person team: 1. One person installs OpenWork desktop, runs git submodule update --init --recursive if building from source, and launches it. 2. Configure providers. Set a DeepSeek API key for cheap heavy lifts and a local Ollama Qwen model for sensitive docs. 3. Author the skill. Drop a SKILL.md describing the analysis workflow into the project's .opencode/skills/ folder. OpenWork loads it. 4. Share. Export the workspace config (or use Den) and send the team a link. Each teammate connects via Remote Client; their worker is isolated but the skill is identical. 5. Govern. Sensitive file moves prompt an allow/deny dialog; the execution timeline is visible to the operator. Total setup for the admin: under an hour. For each teammate: a link click.

13. Four Concrete Scenarios

Beyond the headline "it shares workflows," here's where OpenWork earns its keep: Personal file concierge. "Sort the downloads folder's images by date and give each folder a meaningful name." OpenWork plans the steps, requests folder access, batch-processes, and shows the timeline. No cloud upload of your files. Team AI server. Stand up OpenWork in host mode on a team server. One person debugs a "competitive report generator" template; the whole team reuses it with one click. All data and API keys stay on your server. Marketing automation. Website copy changes → auto-open a PR → notify dev → deploy. What used to be hours of manual coordination becomes one workflow. Fully offline private deploy. Install local Ollama, run Qwen or DeepSeek, point OpenWork's Custom Provider at localhost. Disconnect the network and the agent still works — the刚需 for "data hygiene" industries.

14. OpenWork vs Claude Cowork (and vs a Bare Agent)

| | OpenWork | Claude Cowork | Raw OpenCode | |---|---|---|---| | License | MIT (core) / FSL (ent) | Proprietary | MIT | | Cost | Free + BYO model | $100–200/mo/seat | Free | | Runs where | Local-first + optional remote | Cloud only | Local | | Models | 50+, incl. local | Claude only | 50+, incl. local | | Team sharing | Built-in (Den/config) | Limited | Manual | | UI for non-devs | Yes (desktop) | Yes | No (CLI) | OpenWork sits between "a bare engine" (powerful, unfriendly) and "a closed SaaS" (easy, locked). It's the open, shared middle.

15. Security Model Deep-Dive

The governance surface is what separates OpenWork from a shell script with an LLM attached:

• Worktree boundaries. Agent edits happen in isolated worktrees, so a stray write doesn't silently corrupt your main branch.
• Approval hooks. Every tool call can be gated; you can whitelist safe commands and force-prompt on risky ones.
• Traces. Every action is logged to a trace you can audit after the fact — useful when something goes wrong and you need to know what the agent touched.
• Per-worker isolation. In team mode, each person's worker is sandboxed; one teammate's experiment can't read another's files unless explicitly shared.

None of this is a substitute for common sense (don't grant root to an agent on a production box), but it raises the floor considerably versus a raw agent loop.

16. FAQ

Is it really open source? The core is MIT. The enterprise edition is FSL-1.1-MIT (converts to MIT after year one). Read the LICENSE file in the repo you clone. Can it run fully offline? Yes — install local Ollama, point OpenWork's Custom Provider at it, and skip Den. No internet required after setup. Do my files leave my machine? Not by default. Only the model provider sees your prompt context, and only if you choose a cloud model. Is v0.18.12 safe for production? For internal, low-risk workflows, yes with version pinning. For mission-critical pipelines, stage updates and test — the API can change. Why does cloning fail? You skipped git submodule update --init --recursive. The OpenCode dependency lives in a submodule. Who is it NOT for? Anyone wanting zero-configuration out of the box, or teams that need the absolute best single-model performance regardless of cost.

17. The Skill Ecosystem in Practice

Skills are the unit of reuse in OpenWork, and the model is deliberately low-friction. A skill is a SKILL.md file — markdown with a front-matter block describing what the skill does, what tools it needs, and how to invoke it. Drop it into a project's .opencode/skills/ directory and OpenWork discovers it on the next load. No build step, no manifest registration. The community angle is opkg, OpenWork's package installer. opkg install openpackage://essentials pulls a curated baseline; openpackage://home-automation or openpackage://markdown-publisher add domain skills. Because skills are plain files, version control them inside the repo and the whole team gets updates via git pull — the same way you'd share code, not via a separate plugin marketplace login. The strategic play is clear: as teams accumulate internal skills (a "generate PR description from commits" skill, a "summarize this Notion space" skill), those skills become organizational assets. The company that has the skill another team needs is the one whose workflow gets adopted. That's the network effect OpenWork is quietly building.

18. Troubleshooting Common Issues

A few gotchas surface repeatedly, and knowing them saves an afternoon:

• Clone fails to resolve OpenCode. You ran git clone without git submodule update --init --recursive. The OpenCode dependency lives in a submodule; without it, the engine won't load. Always recurse.
• "App is damaged" on macOS. Gatekeeper quarantines unsigned builds. sudo xattr -rd com.apple.quarantine /Applications/Openwork.app clears it.
• Agent can't see my files. You didn't add the folder to Allowed Folders in settings. Grant the project root explicitly; don't grant global root or you widen the blast radius.
• Prompts hit the wrong model. Provider routing is per-task. Check the workspace's provider config; a mis-set default can silently route sensitive work to a cloud model.
• v0.18.12 broke my integration. Pre-1.0 means API churn. Pin a known-good version in your deployment and stage upgrades behind a test workspace.

19. Roadmap and Community Signals

The trajectory is telling. From a 48-hour HN prototype (Ben Shafii's v0) to a YC-backed platform with 19k stars and 150k+ downloads in roughly half a year is a steep curve. The 0.18.x line is stabilizing the core (orchestrator, permissions, MCP), and the Den control plane is where the enterprise features (SSO, audit, air-gap) are landing. The risk signal to watch: the enterprise edition's FSL-1.1-MIT license. If OpenWork's commercial strategy leans harder on the restricted tier, the "open alternative" narrative gets complicated. For now, the community core remains genuinely MIT, and that's what matters for self-hosters.

20. Who Should (and Shouldn't) Adopt OpenWork

Adopt if you are: a small team that wants shared, governed AI workflows without a platform engineer; a privacy-sensitive org (legal, finance, health) that needs local-first execution; a developer already using OpenCode who wants a friendly UI and team sharing on top. Skip if you are: someone who wants zero configuration and an agent that "just works" on first launch; a team that needs the absolute best single-model performance regardless of cost (Claude Cowork on Anthropic infra will still edge it on long chains); an organization with strict SOC 2 / FedRAMP requirements that OpenWork's pre-1.0 maturity can't yet satisfy. For everyone in the first group, OpenWork is the most compelling open desktop-agent option of 2026 — and the local-first default is exactly the posture this blog exists to champion.

21. OpenWork and the Local-First Movement

Stepping back, OpenWork is one node in a clear 2026 trend: AI capability moving from rented cloud APIs back onto owned hardware. The same pull drove Ollama, Open WebUI, hermes-agent, and the desktop agents this blog covers. The motivation is triple — privacy (data doesn't leave), cost (no per-seat SaaS tax), and latency/control (you own the runtime). OpenWork's specific contribution to that movement is sharing: local-first used to mean "one person, one machine." OpenWork makes local-first team-scale via shared configs and the Den control plane. That's the harder problem, and solving it is why it belongs in the self-hosted stack rather than the toy bin.

Related

• OpenWorker: The Local-First Desktop Agent That Ships Results, Not Promises — another desktop agent, with a typed permission engine worth comparing.
• Ollama: Run Open Weights on Your Own Machine — the local model backend OpenWork points at for a fully private stack.
• DeerFlow: The SuperAgent Harness That Plans Before It Acts — a different take on orchestrated agent work.