Monty

A minimal, secure Python 3.14 interpreter written in Rust for use by AI.

Monty avoids the latency, complexity and cost of using a full container based sandbox for running LLM generated code.

Latency

† 10 commands run in a REPL against a sandbox that already exists, as you might expect from a simple agent with code mode. Monty and Full Monty keep the session, so each command is one feed; the others have no persistent interpreter, so command n re-runs commands 1 to n.

‡ The time to create the sandbox and perform the agent run: the two columns added together.

Learn more in the comparison to alternatives.

!!! tip "Commercial support"

If you're interested in running Monty in the most secure and scalable setup, please see
[Full Monty](server.md).
If you're interested in being a design partner for Monty development in any deployment setup, please
[get in touch](https://pydantic.dev/contact).

Why Monty

1. Latency in microseconds, not seconds. A sandbox plus ten REPL commands takes 5 ms against 900 ms for Docker and 1900 ms for a sandboxing service, because the sandbox is a subprocess, a command is one message each way, and the session persists so nothing is re-run. See start latency.
2. Suspend and resume from bytes. Every host call suspends the interpreter; feed_start returns the suspension and dump() serialises the whole interpreter, paused call stack included, to bytes you can store and load_snapshot later on another machine. There are no file descriptors, sockets or threads inside the sandbox, so nothing has to be reconstructed. See snapshots.
3. Strict resource limits max_memory, max_duration_secs and max_recursion_depth are enforced by the VM itself, and max_suspensions by the pool; 'x' * 10**12 raises MemoryError before the allocation is attempted. See resource limits.
4. A package, not infrastructure. uv add pydantic-monty, npm install @pydantic/monty or cargo add monty-pool: about 4.5 MB, no daemon, no image, no API key, and a worker baseline of about 2 MB so one machine runs hundreds. See getting started.
5. MIT licensed, with commercial options. The interpreter, the pool and bindings are open source. Full Monty runs the same workers behind a WebSocket as a container image, adding OS-level isolation, and horizontal scaling.

Example

Installation

=== "Python"

```bash
uv add pydantic-monty
```

See [getting started with Python](quickstart/python.md).

=== "TypeScript"

```bash
npm install @pydantic/monty
```

See [getting started with JavaScript](quickstart/javascript.md).

=== "Rust"

```bash
cargo add monty-pool
```

See [getting started with Rust](quickstart/rust.md).

The code string is what a model writes when asked how long a bar of chocolate could power a lightbulb. It calls a tool it was given, does arithmetic it should not do in its head, and prints the answer:

from pydantic_monty import Monty

code = """
kcal = nutrition('chocolate bar')['kcal']
hours = kcal * 4184 / (bulb_watts * 3600)
print(f'a chocolate bar could power a {bulb_watts}W bulb for {hours:.1f} hours')
"""

with Monty() as pool:
    with pool.checkout() as session:
        session.feed_run(
            code,
            inputs={'bulb_watts': 10},
            external_lookup={'nutrition': lambda food: {'kcal': 230}},
        )
        #> a chocolate bar could power a 10W bulb for 26.7 hours

Or in TypeScript:

import { Monty } from '@pydantic/monty'

const code = `
kcal = nutrition('chocolate bar')['kcal']
hours = kcal * 4184 / (bulb_watts * 3600)
print(f'a chocolate bar could power a {bulb_watts}W bulb for {hours:.1f} hours')
`

await using pool = await Monty.create()
await using session = await pool.checkout()
await session.feedRun(code, {
  inputs: { bulb_watts: 10 },
  externalLookup: { nutrition: (food: string) => ({ kcal: 230 }) },
})
// a chocolate bar could power a 10W bulb for 26.7 hours

nutrition ran on the host and the sandbox saw only its return value; the sandbox has no filesystem, environment or network with which to reach anything else. The Python, JavaScript and Rust quickstarts take it from here. Monty can do much more than this, see Examples.

Where the code comes from

LLMs are often faster, cheaper and more reliable when they write a short program that calls your tools, instead of making a sequence of individual tool calls: code mode from Cloudflare, programmatic tool calling and code execution with MCP from Anthropic, smolagents from Hugging Face. All of them need somewhere safe to run the generated code, and Monty is that place.

Next steps

• Getting started with Python, JavaScript or Rust.
• Commercial support: Full Monty, the same workers behind a WebSocket as a container image.
• Security model for what "secure" does and does not mean here.
• Examples, including Code Mode in Pydantic AI.
• Limitations: the Python subset, and every known divergence from CPython.