pydantic-monty investigation

Simon Willison's Blog Tools

Summary

An investigation into pydantic-monty, a minimal Python interpreter in Rust for sandboxed execution, confirming that its security limits (duration, memory, allocations, recursion) work as intended.

No content available
Original Article
View Cached Full Text

Cached at: 05/31/26, 07:16 PM

# Research: pydantic-monty investigation Source: [https://simonwillison.net/2026/May/22/monty-investigation/](https://simonwillison.net/2026/May/22/monty-investigation/) [Research](https://simonwillison.net/elsewhere/research/)[pydantic\-monty investigation](https://github.com/simonw/research/tree/main/monty-investigation#readme)— Reviewing \`pydantic\-monty\` reveals it as a fast, minimal Python interpreter designed for controlled sandboxed execution, primarily useful when transforming data, branching, looping, and interacting with a select set of trusted host tools or a virtual filesystem\. The interpreter purposefully omits large portions of CPython’s functionality, with clear boundaries: unsupported features and missing resources generally fail cleanly as structured errors rather than escaping into the host runtime\. It's been a few months since[I last poked at Monty](https://simonwillison.net/2026/Feb/6/pydantic-monty/), the sandboxed subset of Python implemented in Rust\. I had Claude Code look at the most recent release\. Importantly the`max\_duration\_secs`,`max\_memory`,`max\_allocations`, and`max\_recursion\_depth`settings all appear to work as advertised\.

Similar Articles

A Simple Runtime Invariant Miner

Lobsters Hottest

This post implements a Daikon-style runtime invariant miner in Python, including instrumentation, trace collection, candidate invariant checking, and implication-based suppression, providing an approximate oracle for regression testing.

The Edge of Safe Rust

Lobsters Hottest

A TokioConf 2026 talk/blog post explores pushing safe Rust to its limits by implementing tracing garbage collection for complex pointer structures, sharing techniques for circular references and raw-pointer GC design.

Code mode with a stateful REPL

Reddit r/AI_Agents

The author introduces ptc_runner_mcp, an MCP server that provides a stateful, sandboxed REPL using a Clojure-like language, allowing AI agents to perform exploratory computations without overwhelming the context window.