AWS Open-Sources Pizza Bot, an Inbox for Background AI Agents

AWS has open-sourced Pizza Bot, a self-hosted AI agent application under the Apache 2.0 license that uses an email-style inbox to manage long-running and asynchronous agent tasks. The project, which is not an AWS-supported service, supports model providers including Anthropic, Amazon Bedrock, Google Gemini, OpenAI, OpenRouter, and local models via Ollama, and stores threads, checkpoints, memories, attachments, configuration, and logs locally as SQLite databases and ordinary files with no telemetry. AWS open-source blog authors Joseph Dolivo and Igor Fil wrote that "live chat assumes both parties are present," which breaks when a task takes several minutes, waits on approval, or runs on a schedule while the user is away.

TL;DR — Key Takeaways - AWS has open-sourced Pizza Bot, a self-hosted AI agent application designed around an inbox-style interface for long-running and asynchronous tasks. - Pizza Bot supports multiple model providers, MCP integrations, specialist skills and per-tool approval policies while keeping data and state on user-controlled infrastructure. - The project’s usefulness will depend heavily on the open-source community building integrations to replace the Amazon-specific skills and MCP connections excluded from the public version. AWS has open-sourced Pizza Bot, a self-hosted application that lets AI agents work in the background and surface completed tasks or requests for human approval in an email-style inbox. First things first. AWS’s Pizza Bot https://github.com/pizza-bot-app/pizza-bot is not an AWS-supported service. You’re on your own. This newly open-sourced Apache 2.0 project offers an alternative to the common chat-centric agent interface. Rather than requiring users to watch an agent’s progress in a terminal or conversation window, Pizza Bot treats work as a durable thread. An agent is assigned a task, runs independently, and returns when it has either completed the work or needs a decision. Why? AWS open-source blog authors Joseph Dolivo and Igor Fil explained, “Live chat assumes both parties are present. That holds for a quick exchange and breaks the moment a task takes several minutes, waits on your approval, or runs on a schedule while you’re away.” It does all this using an email-style interface. Email? Yes, email. Hey, it’s worked for more than 30 years for Linux, the largest open-source project of all; it can work for you too. Pizza Bot’s interface divides agent work into three views: All , containing thread history; Unread , containing work the user has not yet reviewed; and Action , containing runs paused pending an answer or approval. An accompanying Activity panel shows specialist agents delegated by the main agent, including their individual transcripts and tool calls. The project addresses a growing practical problem for agentic systems. Useful jobs often run longer than a conventional chat interaction. Research, meeting preparation, email drafting, CRM updates, Slack summaries, task prioritization, and scheduled monitoring work may require agents to inspect multiple sources, use several tools, or wait for a person before taking a consequential step. “Pizza Bot treats an agent the way you’d treat a colleague who has gone off to do the work,” the authors wrote. “It comes back when there’s something to read, or something only you can decide.” Pizza Bot can be started manually, launched through a webhook, or scheduled through cron. AWS said a completed job appears in the Unread queue, while a task that needs human intervention appears in Action. AWS said Pizza Bot is self-hosted, has no telemetry, and is designed to run on a user-controlled machine or server. The software stores threads, agent checkpoints, memories, attachments, configuration, and logs in a local folder as SQLite databases and ordinary files. As someone who’s grown increasingly untrusting of the big AI vendors– I’m looking at you https://techstrong.ai/features/mythos-was-the-warning-hugging-face-was-the-operating-lesson/ , OpenAI–the more I can keep securely on my local hardware, the more I like it. It supports a range of model providers, including Anthropic, Amazon Bedrock, Google Gemini, OpenAI, OpenRouter, and local models served through Ollama. That provider-neutral approach distinguishes Pizza Bot from agent products coupled to a specific model vendor or hosted environment. The application uses a server-client architecture. The server runs agents, persists their state, and responds over HTTP, while clients can be an Electron desktop application, a browser, or a terminal. Because the server holds state, an agent run can continue after a user closes a thread, reloads the browser, or switches devices. The server-client architecture can work on a single machine. The architecture makes Pizza Bot suitable for an always-on home server, workstation, or container host. A user could, for example, schedule a daily briefing task on a machine that remains online, then read the result from a laptop or phone later. If the system misses scheduled runs while powered down, AWS said it runs the missed schedule once upon startup rather than replaying every missed occurrence. Pizza Bot connects agents to tools through the Model Context Protocol MCP https://modelcontextprotocol.io/docs/2026-07-28/getting-started/intro , the increasingly adopted framework for exposing external tools and data sources to AI models. It also supports Markdown-based SKILL.md http://skill.md files, following the Agent Skills convention introduced by Anthropic. Those skills define specialist agents that the primary agent can delegate work to. Each can have its own instructions and a limited set of MCP tools. This design narrows an agent’s privileges and makes its capabilities easier to inspect. AWS gave the example of a meeting-preparation skill that might have access to calendar, CRM, and document tools. A browser-automation skill included with Pizza Bot is restricted to a browser tool and has no access to other MCP services. Pizza Bot also supports per-tool approval policies. A skill can require a user to approve a specific tool invocation before it runs, and the workflow remains paused durably until the user responds—even if that response comes later from a different device. The project’s interruptOn policy can present several permitted choices, including an edit option that lets a user modify a proposed action rather than reject it outright. That approval-oriented model matters because MCP servers can act using the user’s permissions. AWS cautioned that installing an MCP server or plugin means running code with those permissions, and said Pizza Bot makes installation an explicit decision rather than an implicit side effect. I like this. Yes, it’s easier if you let the AI do it for itself, but every time you do this, you’re putting the fate of your job in the AI’s hands. That, as the Hugging Face hack showed https://www.zdnet.com/tech/cve-2026-53362-fraggap-linux-kernel-exploit-openai-incident/ , can be a big mistake. Pizza Bot originated inside Amazon, where AWS said more than 2,000 employees used earlier versions for meeting preparation and follow-ups, drafting emails, Slack summaries, CRM logging, prioritization, and web research. According to the announcement, however, Amazon rebuilt the open-source version from scratch. The name references Amazon’s well-known “two-pizza team” concept https://www.theguardian.com/technology/2018/apr/24/the-two-pizza-rule-and-the-secret-of-amazons-success , which favors small teams with broad ownership. Pizza Bot’s development team calls itself “Chefs.” However, AWS emphasized that Pizza Bot is a community project, not a managed AWS service. It carries no AWS support commitment or service-level agreement, leaving users responsible for operating, securing, backing up, and updating their deployments. The company also acknowledged that much of the internal tool’s immediate value came from Amazon-specific skills and MCP integrations tied to systems used inside the company. Those integrations were excluded from the open-source rebuild because they would have limited value externally. As a result, early outside adopters will likely need to build or source integrations for their own calendars, email systems, CRMs, document repositories, and automation targets. I think it’s worth the trouble. I’ve already started building a simple time-management tool using Google Gemini as my LLM and Gmail and Google Calendar for my data sources on my main Linux Mint desktop. This release reflects a broader shift in agent design. Many current agent products are optimized for interactive coding or chat sessions, where the user watches a stream of text, tool calls, and intermediate reasoning. Pizza Bot instead assumes the user shouldn’t need to monitor routine work continuously. That is a compelling interface choice for long-running knowledge work, but its success will depend on the maturity of its skills and MCP ecosystem. A background agent is most useful when it can safely access the systems where work actually happens, and when users can understand and control what it is allowed to do. Pizza Bot’s combination of local storage, model-provider flexibility, explicit permissions, durable approval pauses, and standardized MCP integrations gives it a potentially distinctive place in the emerging agent stack. Its real test, as AWS acknowledged, will be whether the open-source community can fill the integration gap that Amazon’s internal ecosystem had already solved. Me? I think it has real possibilities to become a useful tool. We’ll see.