dart_monty_core 0.120.1

Sandboxed Python scripting for Dart. Low-level binding for pydantic/monty's interpreter.

dart_monty_core

GitHub

dart_monty_core 0.120.1 · monty 1.2.0

dart_monty_core runs Python in Dart through pydantic-monty, a sandboxed Python interpreter written in Rust. Dart programs can provide typed inputs, host functions, host modules, OS operations, host-directory mounts, resource limits, and type checking. Results return as typed MontyValue objects.

Dart applications cannot load new behavior without shipping a new binary. Monty lets an application run supplied Python under resource limits while exposing only selected host functions, host modules, and OS operations. Pydantic runs a security bug bounty for the interpreter at hackmonty.com.

Each session runs outside the application process. Native sessions use child processes, and browser sessions use Web Workers. A sandbox crash ends its worker and session without ending the application. The pool replaces the worker for a later checkout.

Installation

dart pub add dart_monty_core

Quick start

import 'package:dart_monty_core/dart_monty_core.dart';

Future<void> main() async {
  final value = await Monty.withPool(
    (monty) => monty.withSession((session) async {
      await session.feedRun(
        'def fib(n): return n if n < 2 else fib(n - 1) + fib(n - 2)',
      );
      return session.feedRun('fib(10)');
    }),
  );
  print(value); // MontyInt(55)
}

The example evaluates Fibonacci in a pooled session.

Platform support

Platform	Worker	Setup
Dart VM and AOT on macOS, Linux, and Windows	Child process	Supply a worker or enable the native build hook
dart2js and dart2wasm	Web Worker	The package supplies the worker assets

See Native worker for native worker setup, browser asset serving, caching, integrity checks, Flutter packaging, and platform details.

Host-directory mounts require the native mount library and are unavailable in browsers. OSAccess provides an in-memory filesystem on every platform.

Documentation

• Documentation index
• Execution model
• Host functions and async
• Host modules
• OS access
• Host directory mounts
• Telemetry
• Fake sessions
• Upstream divergences and limitations
• Package versioning

The API reference documents values, errors, snapshots, limits, callbacks, and session methods. The package exports test doubles from package:dart_monty_core/dart_monty_core_testing.dart and host-backed virtual files from package:dart_monty_core/unsafe_callback_file.dart.

Contributor commands and repository rules are in AGENTS.md.

License

MIT.