Pydantic Monty
The open-source interpreter and Python package
- Controls Controlled host access, resource limits and snapshots
- Hosting and scaling You run it, wherever you choose
- Tracing Instrument it yourself
Agent Sandboxes Beta
Not a container or VM. Agent Sandboxes is an isolated interpreter for the code your agent writes, built into Logfire and powered by Pydantic Monty.
298
Last span Nov 12, 00:57
485
Estimated cost $0.05
377
174
33
Activity over time
Sessions
Why Agent Sandboxes
Most code written by an agent is short and calls a few tools. That job needs an isolated interpreter, not a computer. Agent Sandboxes runs it in Pydantic Monty, our lightweight open-source interpreter built with Rust, with nothing to boot, build, or secure, and nothing to manage between runs.
Benchmark report
We ran 5,276 graded runs: five Pydantic AI apps, eight models, the same tools, with code mode off and on. Every code mode run executed in Monty, the interpreter inside Agent Sandboxes.
Internal Pydantic benchmark, October 2026. Graded deterministically, no LLM judge. Self-reported; harness not yet public.
Key features
Agent code reaches the functions your application hands it and nothing else. No files, network, or secrets unless you grant them, and your tools keep their own access.
Every run, and every user, gets a fresh session, even while someone is waiting on the answer. There is no machine to boot and nothing to keep warm between runs.
Memory is bounded per session and CPU time per run. A loop that never ends hits its limit and stops, and your application carries on.
Snapshot a session and pick it up later, right where it stopped. The snapshot is the interpreter's own state, so a long workflow survives a deploy or a worker change without starting over.
____ _ _ _ __ __ _
| _ \ _ _ __| | __ _ _ __ | |_(_) ___ | \/ | ___ _ __ | |_ _ _
| |_) | | | |/ _` |/ _` | '_ \| __| |/ __| | |\/| |/ _ \| '_ \| __| | | |
| __/| |_| | (_| | (_| | | | | |_| | (__ | | | | (_) | | | | |_| |_| |
|_| \__, |\__,_|\__,_|_| |_|\__|_|\___| |_| |_|\___/|_| |_|\__|\__, |
|___/ |___/
Learn more↗
monty version: 1.0.0↗
monty protocol version: 5
server version: v1.0.0 (e3282e4)
Run code
Run Python in the Monty sandbox, or use the Python client↗ for more functionality.
Hack Monty invited researchers to escape the engine underneath. The final announced bounty round ran through August 2026.
Every run shows up in Logfire beside the agent that asked for it, with the tool calls it made and how long each took. Usage lands on your Logfire bill.
Running agent code is the easy part. Agent Sandboxes handles the rest: isolation, scaling, reliability, and tracing.
Spikes in code runs never slow your agent, and you stop sizing servers for the heaviest script.
Agent code runs on separate infrastructure with only the tools it needs, never next to your keys.
Logfire runs and scales the workers, so your team spends its time on agents, not sandbox upkeep.
Need more? Pro is $49/mo plus $0.10 per 1,000 invocations, and Growth includes it. For higher volumes or custom limits, we price Advanced with you.
Customer stories
80%+ Lower LLM costs on daily agentic routines
10/10 Test incidents solved, including two that direct tool calling failed
Monty vs Agent Sandboxes
Pydantic Monty is the open-source interpreter. Agent Sandboxes is that interpreter hosted, scaled, and traced inside Logfire.
Hosted sandboxes built into Logfire, powered by Monty
Need it on your own hardware? Start with Monty. Self-hosted Agent Sandboxes is planned for Logfire’s Enterprise deployment early next year: talk to us about self-hosting.
No. It isn’t a container or a VM. Agent Sandboxes is an isolated interpreter for the code your agent writes, powered by Pydantic Monty, so there’s no machine to boot and nothing to keep warm between runs.
When the job needs a full computer. Coding agents that run build tools, install packages, or walk a real filesystem need a container or VM sandbox: Agent Sandboxes runs a Python subset with host callbacks and has no operating system underneath. Reinforcement learning environments that need a whole computer per episode belong on a VM-backed sandbox, where the environment is the product. And you don’t deploy applications into it: the sandbox holds the agent’s code while your application keeps running wherever it runs today. Running model-written code in your own process with exec or subprocess is fast, but the code can do anything your application can. Agent Sandboxes keeps that speed and adds the limits.
Yes. Agent code can only call the functions your application hands it. Those functions run in your application, so they keep their own network, library and secret access. The agent’s code gets none of that unless you grant it.
Pydantic Monty is our open-source interpreter, built with Rust. Agent Sandboxes runs Monty for you inside Logfire: Logfire runs and scales the workers, bounds the memory of every session and the CPU time of every run, snapshots sessions so they can and resume, and traces every run next to your agent.
Python. Monty is a sandboxed Python interpreter, so your agent writes Python and calls your tools as ordinary functions. It covers what agents reach for: async functions, comprehensions, dataclasses, match, and standard modules such as asyncio, json, re and datetime. Third-party packages can’t be installed. Monty’s limitations lists the rest.
Only the functions you expose. No files, network, environment variables or secrets unless you grant them. Each run gets 50 ms of CPU and each session 20 MiB of memory, so runaway code is stopped and your application keeps running.
Yes. On Free and Pro, you can start up to 300 sessions every 5 minutes. Concurrent sessions follow your Logfire plan: 4 on Personal, with no limit on Team, Growth and Enterprise. On Advanced, they’re set around your workload. They’re separate from your monthly allowance: the 50,000 free invocations a month set how much you get, and these set how fast you can use them.
Yes. Pass CodeMode(monty_sandbox=logfire.agent_sandboxes) to your agent, with pydantic-ai-harness 0.67.0 or later, and the code it writes runs in Agent Sandboxes. In our benchmark, five Pydantic AI apps ran with code mode on, and every code mode run executed in Monty, the interpreter inside Agent Sandboxes.
Not yet. Agent Sandboxes is part of Logfire and runs in Logfire Cloud. Self-hosting is planned as part of Logfire’s self-hosted Enterprise deployment, early next year.
Every Logfire plan includes 50,000 free invocations a month. Pro is $49 a month plus $0.10 per 1,000 invocations, with fixed limits of 50 ms of CPU per invocation and 20 MiB of memory per session, and it’s included with Growth and Enterprise Cloud. Advanced is for higher volumes or workloads that need more than those limits: we set its limits and price with you. See Agent Sandboxes pricing.
Sign up today and see your first trace in under 2 minutes
01 Install
$ uv add logfire
Resolved 7 packages in 128ms
Installed 7 packages in 89ms
+ logfire
02 Instrument
import logfire
logfire.configure()
logfire.info('Hello {name}', name='world')
Free up to 10m records per month No credit card needed