workpilot 0.32.1

Enterprise AI assistant — internal preview only

WorkPilot

An enterprise AI assistant for coding and office work, built for the Microsoft ecosystem.

Documentation · 简体中文 · Changelog · Add to Teams

---

WorkPilot runs its agent, credentials, memory, and sessions on your machine. Prompts and tool content are sent only to the model providers and external channels you configure. It combines development tools, Microsoft 365 integration, browser automation, MCP servers, scheduled work, and multi-agent delegation behind one security and approval pipeline. The optional Cloud Gateway is a stateless relay for Teams and Web Chat.

Install

Windows PowerShell

irm https://aka.ms/workpilot/install.ps1 | iex
wp

macOS / Linux

curl -fsSL https://aka.ms/workpilot/install.sh | bash
wp

Complete the guided enterprise GitHub Copilot sign-in and setup, then run workpilot doctor to verify the configuration and effective Python package source. WorkPilot-managed installs and updates default to https://packagefeedproxy.microsoft.io/pypi/simple/; normal pip/uv use against that feed does not require sign-in, a PAT, or artifacts-keyring. See the installation guide for manual PIP_INDEX_URL / UV_DEFAULT_INDEX setup, firewall requirements, and alternative install and update paths.

Choose how to work

Surface	Start command	Use it for
Terminal (TUI)	workpilot chat	Local terminal conversations
Self-hosted Web	workpilot serve	Browser chat, attachments, approvals, settings, and status
Teams + M365 Copilot	workpilot cloud	Microsoft 365 conversations through the Cloud Gateway

What it can do

Area	Capabilities
Development	Read and edit code, run shell commands and tests, use Git, browse repositories, and delegate focused work
Microsoft 365	Work with mail, calendars, files, people, Teams, and other Graph surfaces through configured credentials
Automation	Run browser workflows, scheduled jobs, heartbeat tasks, skills, and MCP tools
Knowledge	Preserve append-only sessions, maintain long-term memory, search prior conversations, and use attachments
Operations	Serve a local gateway, connect cloud channels, inspect status, manage secrets, and audit actions

Security model

• Four profiles: open, standard, controlled, and restricted
• Per-call risk scoring and approval decisions
• Command and workspace sandboxing
• Secret storage, credential redaction, SSRF protection, and audit logs
• Manual emergency stop across tools and channels
• MCP tools treated as untrusted by default

Start with the security architecture and approval guide.

Documentation

• Get started
• Channels
• CLI
• Agents and tools
• Extensions and automation
• Configuration
• Gateways and security
• CLI reference
• Configuration schema
• Troubleshooting
• Contributor guide

Development

WorkPilot contains three separately validated components:

Component	Location	Primary checks
Python runtime and CLI	workpilot/	pytest, Ruff, mypy
React Web app	web/	TypeScript, ESLint, Vitest, Vite
.NET Cloud Gateway	cloud_gateway/	dotnet build, dotnet test

mkdir -p web/dist
python -m pip --isolated install --index-url https://packagefeedproxy.microsoft.io/pypi/simple/ -e ".[dev]"
pytest tests/ -v
python -m ruff check workpilot/ tests/
python -m mypy workpilot/

For multi-command manual shell sessions, set PIP_INDEX_URL / UV_DEFAULT_INDEX and clear alternate index variables as shown in the development guide. Frontend installs use web/.npmrc and the Microsoft-protected npm feed. Read the development guide before changing a component.

All changes go through a feature branch and pull request; never push directly to main.

Architecture

WorkPilot is organized as Transport → Message Bus → Processing, with provider, session, memory, configuration, and security services underneath. See the architecture overview and the internal core specification.