Amazon open-sources Pizza Bot, an inbox for long-running AI agents

Pizza Bot is an open-source application, released under the Apache 2.0 license, built to manage AI agent work that keeps running after a person stops watching it. Instead of a single continuous chat thread, it works like an inbox: a user starts or schedules a task, moves on to something else, and the interface sorts what comes back into two queues, Unread for completed work and Action for runs that are waiting on a human decision. Conversations can be grouped into folders for organization without removing matching items from the global Unread and Action queues. Agents keep working when a user navigates away or disconnects, as long as the api-server process that runs them stays up.

The system is built on a stateful DeepAgents/LangGraph runtime, with the same React-based interface shared between an Electron desktop app and a browser-based web app; a terminal CLI is also provided. All three clients, desktop, web, and CLI, talk to a local api-server over HTTP and server-sent events (SSE) rather than embedding the agent logic themselves. The production graph engine lives in its own package, and the client applications consume a protocol layer rather than importing the runtime or model code directly.

Pizza Bot supports six model providers: Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter, and Ollama, configured under Settings > Providers or selected per run with the PIZZA_MODEL=: environment variable. The Bedrock integration accepts an AWS profile, AWS access keys, or a Bedrock API key, with an optional region override, and combines Amazon's native model catalog with a regional catalog called Mantle, routing requests through whichever API format, Converse, OpenAI-style Responses or Chat Completions, or Anthropic Messages, a given model advertises. OpenAI and Anthropic connections both accept custom base URLs for compatible endpoints. Checkpointed runs survive a client disconnecting, and cron schedules or webhooks can start a run without any conversation open at all. Skills can be delegated to tool-scoped subagents, whose progress shows in an Activity panel, and MCP servers or plugins can add new tools and skills through the UI or configuration files.

Access is opt-in throughout. The api-server binds to the loopback address 127.0.0.1 by default; exposing it beyond localhost requires authentication and an explicit allowlist of origins. Local folders are not visible to Pizza Bot until a user adds them individually under Settings > Files, and each is read-only unless writing is separately allowed; the application has no default access to the home directory. All application state, threads, checkpoints, long-term memories, file attachments, and logs, stays on the local machine under a data root that defaults to ~/.pizza-bot-oss. MCP servers and plugins, by contrast, are treated as trusted code: their commands can run with the full permissions of the user's own account, so the documentation advises installing them only from sources the user trusts.

Amazon built Pizza Bot internally, crediting the project to what it calls its 'Executive Chefs and Sous Chefs' and says it was shaped by feedback from more than 2,000 users across Amazon who tried earlier versions before the public release. The source does not say whether Pizza Bot is an official Amazon product or an internal project Amazon is open-sourcing outside any product line, and it gives no version number, release date, or performance figures for the tool itself. Release installers are provided for macOS (both Intel and Apple silicon), Windows, and Linux (x64 and arm64), each with a SHA256SUMS file for verification; the macOS builds are signed and notarized, while the Linux packages are not signed and need to be checked against the published checksums instead. Building from source requires Node.js 24 or newer.

Key facts

Pizza Bot is an open-source, Apache 2.0 licensed inbox application for long-running AI agent work, developed at Amazon and built on a DeepAgents/LangGraph runtime.
It sorts agent work into two queues, Unread for finished runs and Action for runs waiting on a human decision, and agents keep working after a user disconnects as long as the local api-server process stays running.
It supports six model providers, Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter, and Ollama, chosen per run through the PIZZA_MODEL environment variable.
The api-server binds to 127.0.0.1 by default, and local folders are read-only and off-limits until a user grants access individually, while MCP servers and plugins run with the full permissions of the user's own account once installed.
More than 2,000 people across Amazon tested earlier versions before the public release, and the project credits its 'Executive Chefs and Sous Chefs'.

Why it matters

Long-running AI agents pose an interface problem: work keeps happening after a person stops watching, while most chat interfaces assume someone stays present for the whole conversation. Pizza Bot reframes that as an inbox instead of a thread: a task is started or scheduled, the user moves on, and results sort themselves into Unread and Action rather than piling up in one open conversation. Amazon built the system on an existing open-source foundation, a DeepAgents/LangGraph runtime, instead of writing a new agent framework, and released the whole application under the permissive Apache 2.0 license rather than keeping it internal or paid.

Who it affects

The tool targets people already running AI agents against real work: developers and teams who start agent tasks and do not want to keep a chat window open while those tasks run. Because it is self-hosted and provider-agnostic, connecting to Amazon Bedrock, Anthropic, Google Gemini, OpenAI, OpenRouter, or Ollama, it suits anyone who wants to choose their own model rather than being locked into one vendor's assistant. The human-in-the-loop approval queue and the Activity panel, which shows subagent progress, point at workflows where an agent needs to take what the project calls 'consequential actions' and a person has to sign off before they happen.

How to use it

Pizza Bot ships as free installers for macOS (Intel and Apple silicon), Windows, and Linux (x64 and arm64), each accompanied by a SHA256SUMS file; the macOS builds are signed and notarized, while the Linux packages are unsigned and should be checked against the published checksums before running. Building from source needs Node.js 24 or newer, then npm install, npm run build, and npm run dev, which starts the Vite-based frontend and the Electron shell together with its own api-server. At least one model provider has to be configured under Settings > Providers, or via the PIZZA_MODEL=: environment variable, before a live run will start; HTTP clients that only talk to an already-running api-server do not need a provider configured locally. The whole project is Apache 2.0 licensed, allowing free use, modification, and redistribution under that license's terms.

How solid is it

Several structural details point to more engineering discipline than a typical hobby release: the production agent-graph engine is isolated in its own package, the client applications consume a protocol layer instead of importing runtime code directly, and a dedicated test suite checks LangGraph compatibility and protocol conformance. Amazon says the design was shaped by feedback from more than 2,000 users across the company who tested earlier versions before this public release. Set against that, the source material leaves real gaps: it does not say whether Pizza Bot is an official Amazon product or an internal project the company is open-sourcing outside any product line, and it gives no version number, release date, or performance figures for the tool. The underlying runtime, built on DeepAgents and LangGraph together, is an established combination rather than a novel one, which cuts both ways: less risk from an unproven architecture, less claim to originality.

Risks and caveats

Two parts of the design shift risk onto the user rather than removing it. The api-server binds to loopback (127.0.0.1) by default, but it can be exposed beyond localhost with authentication and an explicit origin allowlist, so a misconfigured deployment can open agent control to a network. And while local folders are read-only by default and require an explicit grant before Pizza Bot can touch them, MCP servers and plugins are treated as fully trusted once installed: their commands and materializers run with the user's own account permissions, so a malicious or compromised MCP server or plugin has the same reach the user does. The Linux release packages are not signed, leaving checksum verification as the only integrity check. And several basic facts, an official product status, a version number, any performance data, are simply absent from the material, so they cannot be verified either way from this source alone.