Pydantic Monty
Overview
Monty is a minimal, secure Python interpreter written in Rust, built by the Pydantic team specifically for running code generated by AI agents. It has 7,696 GitHub stars and is actively developed as part of the broader Pydantic ecosystem that includes Pydantic AI, Pydantic Logfire, and the core validation library used by tens of thousands of Python projects.
The project is led by Samuel Colvin, the creator and maintainer of Pydantic — the data validation library that became the backbone of FastAPI and a near-requirement in modern Python web development. That pedigree matters here. Colvin understands Python tooling deeply, and Monty reflects that understanding: it’s not trying to be a general-purpose Python runtime. It’s built for one specific, increasingly critical use case — letting AI agents write and execute Python code safely, without the overhead and latency of container-based sandboxes.
The core problem Monty solves is the growing need for code execution in AI agent workflows. When an LLM needs to perform calculations, transform data, or orchestrate tools, the traditional approach is tool calling — structured JSON responses that map to predefined functions. But research from Anthropic, Cloudflare, and Hugging Face suggests that LLMs work faster, cheaper, and more reliably when they write actual code instead. The issue is that running untrusted LLM-generated code on your host machine is a security nightmare. Containers solve this but add hundreds of milliseconds of startup latency and significant infrastructure complexity. Monty starts in under a microsecond.
Why it matters
The AI agent ecosystem is converging on a pattern: let the model write code, then execute it. Cloudflare’s Codemode, Anthropic’s Programmatic Tool Calling, and Hugging Face’s Smol Agents all point in this direction. But each of these solutions either uses containers (slow, complex) or runs code directly on the host (dangerous). Monty occupies a third path — a restricted interpreter that gives agents the expressiveness of Python while maintaining tight control over what that code can access.
For fullstack developers building AI-powered features, this is a practical concern. If you’re integrating LLM capabilities into a Django backend or a NestJS service, you need a way to safely execute model-generated logic. Monty’s approach — a Rust binary with no CPython dependency that can be called from Python, JavaScript, or Rust — fits naturally into polyglot web stacks. The Pydantic team has already announced it will power codemode in Pydantic AI, which means it’s headed for production use in the ecosystem that underpins much of the Python web world.
Key Features
Microsecond Startup Time. Monty goes from code to execution result in under 1 microsecond. Compare that to container-based sandboxes that take 100-500ms to spin up. For agent workflows that need to execute code repeatedly — think multi-step reasoning loops or iterative data processing — this latency difference compounds fast. It’s the difference between an agent that feels responsive and one that feels sluggish.
Host Environment Isolation. Filesystem access, environment variables, and network calls are all blocked by default. Instead, they’re implemented as external function calls that the developer explicitly controls. If your agent needs to read a file, you provide a read_file function. If it needs to make an HTTP request, you provide that. The agent code can only use what you give it — nothing else.
Snapshot and Resume. Monty can serialize its interpreter state to bytes at any external function call point. Store that snapshot in a database or file, and resume execution later. This is useful for long-running agent workflows where you want to pause execution, wait for human approval or external input, and continue without re-running everything from scratch.
Multi-Language Calling. Monty has no dependency on CPython. You call it from Python (pip install pydantic-monty), from JavaScript/TypeScript (npm install pydantic-monty), or directly from Rust. This makes it viable in Node.js backends, Deno edge functions, or Rust services — not just Python projects.
Built-in Type Checking. Monty ships with ty (the Astral type checker, from the team behind Ruff and uv) included in a single binary. It supports full modern Python type hints, so your agent-generated code can be type-checked before execution. This catches a class of errors that would otherwise surface as runtime failures.
Resource Usage Control. Track memory usage, allocation counts, stack depth, and execution time. Set limits on any of these and Monty will cancel execution if they’re exceeded. For production agent systems, this prevents runaway code from consuming unbounded resources — a real concern when LLMs sometimes generate infinite loops or recursive calls.
Standard Library Subset. Monty supports a curated subset of Python’s standard library: sys, os, typing, asyncio, re, datetime, json, and dataclasses (coming soon). This is enough for most agent tasks — data transformation, string manipulation, JSON parsing, date calculations — without the security surface of the full standard library.
Use Cases
- AI agent code execution — Run LLM-generated Python code as part of multi-step agent workflows without containers. The agent writes code, Monty executes it safely, and results feed back into the reasoning loop.
- Programmatic tool calling in web backends — Django or NestJS services that integrate LLM capabilities can use Monty to safely execute model-generated business logic without exposing the host environment.
- Data transformation pipelines — Agents that need to process, filter, or reshape data can write transformation code that Monty executes with controlled resource limits.
- Interactive coding environments — Build notebook-like experiences or REPL interfaces where users or agents write Python that runs with guaranteed isolation.
- Pydantic AI codemode — The upcoming integration with Pydantic AI will make Monty the default execution backend for code-mode agent workflows in the Python ecosystem.
Pros and Cons
Pros:
- Sub-microsecond startup is genuinely fast — no other sandbox solution comes close to this latency profile for agent code execution.
- The Pydantic team’s track record gives confidence this will be maintained and integrated into production tooling (Pydantic AI, Pydantic Logfire).
- Multi-language support (Python, JS/TS, Rust) means it works in any backend stack, not just Python projects.
- The explicit function-call model for host access is a clean security boundary that’s easier to reason about than container escape prevention.
Cons:
- Still experimental — the README says “not ready for prime time,” and the API surface will change. Don’t bet production systems on it today.
- Limited standard library means many Python code patterns won’t work. You can’t use
pandas,requests, or most third-party packages. Agent-generated code needs to stay within Monty’s subset. - 70 open issues as of mid-June 2026 suggest the project is still settling its architecture. Early adopters should expect breaking changes.
- No support for defining classes yet (coming soon), which limits the complexity of code agents can generate.
Getting Started
# Install from PyPI (Python)
pip install pydantic-monty
# Or with uv (recommended by the Pydantic team)
uv add pydantic-montyBasic Python usage:
from pydantic_monty import Monty
# Create an interpreter
m = Monty()
# Run simple code
result = m.run("""
x = 42
y = x * 2
print(f"Result: {y}")
""")
print(result.stdout) # "Result: 84"For JavaScript/TypeScript:
npm install pydantic-montyimport { Monty } from 'pydantic-monty';
const m = new Monty();
const result = m.run('x = 1 + 2\nprint(x)');
console.log(result.stdout); // "3"For Rust, add to Cargo.toml:
[dependencies]
pydantic-monty = "0.1"Alternatives
E2B (Code Interpreter SDK) — A cloud-based sandbox for running LLM-generated code. E2B uses Firecracker microVMs with full Python environments, so it supports any library. It’s more capable than Monty but adds network latency (50-200ms per execution) and requires a cloud service. Choose E2B when your agents need full Python with third-party libraries; choose Monty when you need speed and local execution with a restricted feature set.
Pyodide — A CPython port to WebAssembly that runs Python in the browser or Node.js. Pyodide supports more of the standard library and many scientific packages (NumPy, Pandas). It’s a better fit for client-side Python execution. Monty is better for server-side agent workflows where you need tighter security controls and don’t need the full Python ecosystem.
Cloudflare Workers Python — Cloudflare’s edge runtime supports Python with a restricted standard library. If you’re already on Cloudflare, this gives you sandboxed Python execution at the edge. Monty is the better choice when you need a embeddable interpreter you control completely, or when you’re not on Cloudflare infrastructure.
Verdict
Monty is the most interesting approach to agent code execution I’ve seen. The Pydantic team identified a real gap — the space between “run anything in a container” (slow, complex) and “run code directly on the host” (dangerous) — and built something that fills it precisely. The microsecond startup time isn’t just a benchmark number; it changes what’s possible in agent design. When execution is that cheap, you can let agents write and run code in tight loops without worrying about latency budgets.
It’s still experimental, and the limited standard library means it won’t work for every use case today. But the trajectory is clear: the Pydantic ecosystem is one of the most influential in Python web development, and Monty will be the execution engine for Pydantic AI’s codemode. If you’re building AI-powered features in a Python backend and want to let your agents write code safely, start watching this project now. The 7,700 stars suggest the community already is.