Simon Willison’s Weblog

pydantic/monty (via) Everyone's building sandboxes for running untrusted code right now. Here's Pydantic's latest attempt at the problem - they've implemented a custom Python-like language (a subset of Python) in Rust and made it available as both a Rust library and a Python package.

Monty avoids the cost, latency, complexity and general faff of using full container based sandbox for running LLM generated code.

Instead, it let's you safely run Python code written by an LLM embedded in your agent, with startup times measured in single digit microseconds not hundreds of milliseconds.

What Monty can do:

• Run a reasonable subset of Python code - enough for your agent to express what it wants to do
• Completely block access to the host environment: filesystem, env variables and network access are all implemented via external function calls the developer can control
• Call functions on the host - only functions you give it access to [...]

A quick way to try it out is via uv:

uv run --with pydantic-monty python -m asyncio

Then try this in the Python interactive prompt (the -m asyncio enables top-level await):

import pydantic_monty
code = pydantic_monty.Monty('print("hello " + str(4 * 5))')
await pydantic_monty.run_monty_async(code)

It's a very small subset of Python - it doesn't even support class declarations yet! But... that's not actually a problem. The neat thing about providing tools like this for LLMs is that they're really good at iterating against error messages - an agent can run some Python code, get an error message telling it that classes aren't supported and then try again.

I wanted to try this in a browser - so I fired up a code research task in Claude Code for web and kicked it off with the following:

Clone https://github.com/pydantic/monty to /tmp and figure out how to compile it into a python WebAssembly wheel that can then be loaded in Pyodide. The wheel file itself should be checked into the repo along with build scripts and passing pytest playwright teat scrips that load Pyodide from a CDN and the wheel from a “python -m http.server” localhost and demonstrate it working

Then a little later:

I want an additional WASM file that works independently of Pyodide, which is also usable in a web browser - build that too along with playwright tests that show it working. Also build two HTML files - one called demo.html and one called pyodide-demo.html - these should work similar to https://tools.simonwillison.net/micropython (download that code with curl to inspect it) - one should load the WASM build, the other should load Pyodide and have it use the WASM wheel. These will be served by GitHub Pages so they can load the

Here's the transcript, and the final research report.

The end result is I now have the Monty Rust code compiled to WebAssembly in two different shapes - as a .wasm bundle you can load and call from JavaScript, and as a monty-wasm-pyodide/pydantic_monty-0.0.3-cp313-cp313-emscripten_4_0_9_wasm32.whl wheel file which can be loaded into Pyodide and then called from Python in Pyodide in WebAssembly in a browser.