How Monty Works
Monty is a minimal, secure Python interpreter written in Rust designed specifically for executing code generated by AI models. It operates as a sandbox that isolates untrusted code from the host system, preventing access to the filesystem, environment variables, and network resources. Instead, the sandbox interacts with the host only through predefined functions and mounts provided by the user. This design ensures that even if the AI-generated code contains malicious intent or vulnerabilities, the host system remains protected.
The interpreter is built to avoid the latency, complexity, and cost associated with container-based sandboxing solutions. Monty achieves this by using a pool of pre-initialized worker subprocesses, allowing it to spawn a new sandbox in under 1 millisecond for the open-source version (OSS Monty) and approximately 2 milliseconds for the commercial version (Full Monty).
Monty supports two deployment models: OSS Monty, which is distributed under the MIT license and can be installed as a package for Python, JavaScript/TypeScript, or Rust, and Full Monty, a commercial server that extends the same sandbox functionality behind a WebSocket. Full Monty is particularly suited for large-scale deployments, as it runs workers as container images, providing OS-level isolation and horizontal scalability. Both versions enforce strict resource limits, such as maximum memory usage and execution time, to prevent denial-of-service attacks or excessive resource consumption.
The sandbox operates by suspending and resuming execution states as byte streams, enabling efficient long-running sessions or human-in-the-loop workflows. This feature is particularly useful for AI agents that require persistent interaction or complex toolchains.
Monty integrates seamlessly with the Pydantic Stack, a suite of tools designed for building production-grade AI agents. It is particularly useful in scenarios where AI models generate code to solve problems, such as calculating the duration a chocolate bar could power a lightbulb. In such cases, the AI code calls predefined tools (e.g., nutrition()) and performs computations, while Monty ensures the execution remains isolated and secure. The sandbox only exposes the return values of these tools, preventing any unintended access to the host system.
The interpreter’s design aligns with broader trends in AI agent frameworks, such as Cloudflare’s Code Mode and Hugging Face’s SmolAgents, where AI models generate short programs to interact with tools rather than making individual API calls. Monty provides the necessary infrastructure to safely execute these programs, bridging the gap between AI-generated logic and secure, isolated execution environments.
Use Cases
Monty is primarily used in environments where AI models generate code that must be executed securely without compromising the host system. One of its key applications is in AI agent frameworks, where models produce Python scripts to perform tasks such as data processing, calculations, or tool interactions. For example, an AI model might generate code to analyze nutritional data, perform mathematical computations, or interact with external APIs. Monty ensures that these operations are executed in an isolated environment, preventing potential security risks such as arbitrary code execution or data leaks.
The sandbox is particularly valuable in development and production settings where rapid iteration is required. Its low latency—under 1 millisecond for new sandboxes—makes it ideal for applications that demand high throughput, such as real-time AI-driven workflows or interactive development environments. Monty’s ability to suspend and resume execution states also enables long-running sessions, which are useful for human-in-the-loop workflows or complex toolchains that require persistent state management.
Monty’s resource limits and isolation mechanisms prevent one user’s malicious or resource-intensive code from affecting others. This makes it suitable for platforms that host multiple AI agents or user-generated code, such as collaborative development tools or AI-driven automation platforms.
Monty’s commercial version, Full Monty, extends these capabilities by offering OS-level isolation and horizontal scaling through containerized workers. This is particularly beneficial for enterprises deploying AI agents at scale, where security and performance are critical. Full Monty’s WebSocket-based architecture allows for centralized management of sandboxes, reducing operational overhead and improving security by isolating workers from the host infrastructure.
Beyond AI agents, Monty can be used in educational settings to teach secure coding practices or in research environments where untrusted code must be executed safely. The open-source version (OSS Monty) is accessible via package managers for Python, JavaScript/TypeScript, and Rust, while the commercial version provides additional features for enterprise-grade deployments.
Key Features and Capabilities
Monty’s security model is built on several foundational principles designed to minimize attack surfaces and enforce strict isolation. The sandbox does not provide access to the host’s filesystem, environment variables, or network, ensuring that untrusted code cannot perform unauthorized operations. Instead, interactions with the host are mediated through explicitly defined functions and mounts, which are controlled by the user.
One of Monty’s standout features is its performance optimization, achieved through the use of a pre-initialized pool of worker subprocesses. This design eliminates the overhead associated with launching new containers or virtual machines for each execution, resulting in sub-millisecond startup times.
Monty enforces strict resource limits, including maximum memory usage and execution time, to prevent denial-of-service attacks or unintended resource exhaustion. These limits are enforced at the virtual machine level, ensuring that even poorly written or malicious code cannot allocate excessive resources. For example, attempting to allocate an impractically large amount of memory (e.g., x * 1012) will result in a MemoryError before the allocation is attempted, rather than crashing the system or consuming all available resources.
The interpreter supports a restricted subset of Python 3.14, which includes essential modules and functions while excluding unsafe or unnecessary components. These enhancements ensure that AI-generated code can perform a wide range of operations without requiring access to the full Python standard library.
Monty’s ability to suspend and resume execution states as byte streams is another key feature. This capability allows for efficient long-running sessions, human-in-the-loop workflows, and complex toolchains that require persistent state management. For instance, an AI agent might generate a multi-step script that interacts with external tools or requires user input. Monty can serialize the entire sandbox state at any point, enabling seamless continuation of execution after interruptions or delays. This is particularly useful in scenarios where AI models generate code for extended periods or where human oversight is necessary.
The commercial version of Monty, Full Monty, extends these capabilities by running workers as container images behind a WebSocket. This architecture provides OS-level isolation and horizontal scaling, making it suitable for large-scale deployments where security and performance are critical. Full Monty’s containerized workers can be managed independently of the host infrastructure, reducing the blast radius of potential security incidents and enabling dynamic scaling based on demand.
Monty also integrates with the broader Pydantic Stack, which includes tools for type-safe agent frameworks (Pydantic AI), AI-first observability (Pydantic Logfire), and unified LLM proxies (Logfire AI Gateway). This integration allows developers to build end-to-end AI-driven workflows where Monty serves as the secure execution layer for AI-generated code. For example, an AI agent might use Pydantic AI to define its behavior, Logfire for monitoring and logging, and Monty to execute code safely. This cohesive ecosystem simplifies the development and deployment of secure, scalable AI systems.
Monty’s documentation provides detailed comparisons to alternative sandboxing solutions, including Docker, Pyodide, WASI, and traditional sandboxing services. These comparisons highlight Monty’s advantages in terms of latency, simplicity, and security. For instance, Monty’s execution environment runs locally on the same machine as the application, avoiding the network overhead and complexity associated with remote sandboxing services. This local execution model also reduces the attack surface by eliminating network-based attack vectors.
Recent updates have addressed specific divergences from CPython, such as support for long integers in mathematical functions and improved handling of floating-point overflows.
Monty is available in multiple programming languages through community bindings, including gomonty for Go and dartmonty for Dart/Flutter. These bindings extend Monty’s functionality to non-Python environments, making it accessible to developers working in diverse ecosystems. The open-source version (OSS Monty) is distributed under the MIT license, while the commercial version (Full Monty) offers additional features and support for enterprise deployments.