Monty is a minimal Python interpreter written in Rust designed specifically for safely executing code generated by large language models and AI agents. The project addresses a critical need in AI systems where LLMs can express their intentions through Python code rather than traditional tool calling, enabling faster and more reliable agent execution without the overhead and complexity of containerized sandboxes.
The interpreter prioritizes security and performance as its core design principles. It completely blocks access to the host environment by implementing filesystem, environment variable, and network access through external function calls that developers can control. This means untrusted code cannot escape the sandbox or access sensitive system resources. Monty supports a reasonable subset of Python functionality including type hints with full modern Python typing support, async and sync code execution, and a limited standard library covering sys, os, typing, asyncio, re, datetime, json, and dataclasses. The interpreter can call functions on the host but only those explicitly granted access by the developer.
Performance is a defining characteristic of Monty. It achieves startup times measured in single-digit microseconds rather than the hundreds of milliseconds required by container-based approaches, making it practical for high-frequency code execution in agent loops. Runtime performance is generally comparable to CPython, typically between five times faster and five times slower depending on the workload. The interpreter can be snapshotted to bytes at external function call boundaries, allowing developers to store interpreter state in files or databases and resume execution later, enabling sophisticated execution patterns like pause-and-resume workflows.
The project is implemented in Rust with no dependencies on CPython, making it callable from Rust, Python, or JavaScript. The Python package is distributed via PyPI as pydantic-monty and executes code in a pool of worker subprocesses, ensuring that even adversarial code causing memory errors or stack overflows cannot crash the host process. JavaScript bindings are available as native NAPI bindings for Node.js and as WebAssembly for browser environments. Monty also provides resource control capabilities, tracking memory usage, allocations, stack depth, and execution time with the ability to cancel execution if preset limits are exceeded.
The repository overlaps with major projects including microsoft/vscode, python/cpython, and rust-lang/rust through shared contributors.
Monty explicitly cannot support the full Python standard library, third-party libraries like Pydantic, class definitions yet, or match statements, though class support is planned. The project is intentionally limited and designed for one specific use case: running code written by agents. The README notes the project is experimental and still in development. Monty will power code-mode functionality in Pydantic AI, allowing LLMs to write Python code that calls tools as functions rather than making sequential tool calls. Community bindings exist for Go and Dart/Flutter, extending the interpreter's accessibility beyond its native language support.
