代理框架
AWS Open-Sources Pizza Bot, Turning Long-Running Agent Work into a Resumable Asynchronous Inbox
Pizza Bot stores agent state, approval requests, and scheduled results on the server, allowing work to continue after users leave the conversation. It supports multiple model providers, MCP, and Agent Skills, but local-first does not mean tool-safe: remote deployments and extensions still require carefully designed trust boundaries.
On September 10, the AWS open-source team released Pizza Bot, a long-running agent application built around an “inbox” rather than real-time chat as its primary interface. Completed work moves to Unread, while executions awaiting human decisions appear under Action. Tasks can be initiated by users, cron schedules, or secret-protected webhooks. The project is licensed under Apache 2.0 and offers Electron, browser, CLI, and standalone backend options.
Its defining feature is not another chat frontend, but a server-managed execution lifecycle. Electron, Web, and CLI clients connect to an API server over HTTP/SSE. The backend uses DeepAgents and LangGraph to run stateful agents, persisting conversations, tool activity, memory, attachments, and approval pauses in SQLite or regular files. Closing or reconnecting a client does not terminate backend work. If a server launched by the desktop application is shut down, the individual step currently in progress will be interrupted, but earlier checkpoints and threads can be retained.
The extension layer uses MCP and `SKILL.md`. Each skill can become a specialized worker with its own prompt and a streamlined tool list. The `interruptOn` setting specifies which tool calls require approval, and users can approve, modify, or reject them. For models, users can choose Bedrock, Anthropic, Gemini, OpenAI, OpenRouter, or a local Ollama instance, avoiding dependence on a single inference provider.
The default security boundaries are fairly concrete: the API binds only to `127.0.0.1`; changing it to a non-loopback address requires a bearer token of at least 32 characters and an origin allowlist. The home directory is not authorized automatically, mounted folders are read-only by default, and the built-in JavaScript sandbox has no network or host-filesystem access. In the desktop application, credentials are entrusted to Electron `safeStorage`, although on Linux it may fall back to `basic_text`—effectively close to plaintext—when no compatible secret-storage service is available.
The largest risks lie in the extension surface. MCP servers and plugins still run with the user’s permissions, and Pizza Bot explicitly treats them as trusted programs. The SQLite data root also supports only a single backend process, making it unsuitable for direct sharing among multiple container replicas. The project currently shows only limited signs of public adoption, is community-run, and comes without an AWS SLA. Engineering teams should evaluate checkpoint-recovery consistency, the semantics of missed scheduled runs, and whether tool approvals can withstand malicious content and prompt injection.