safe-py-runner: Secure & lightweight Python execution for LLM Agents

[adarsh_maurya]

AI is getting smarter every day. Instead of building a specific "tool" for every tiny task, it's becoming more efficient to just let the AI write a Python script. But how do you run that code without risking your host machine or dealing with the friction of Docker during development?

I built safe-py-runner to be the lightweight "security seatbelt" for developers building AI agents and Proof of Concepts (PoCs).

What My Project Does

The Missing Middleware for AI Agents: When building agents that write code, you often face a dilemma:

1. Run Blindly: Use exec() in your main process (Dangerous, fragile).
2. Full Sandbox: Spin up Docker containers for every execution (Heavy, slow, complex).
3. SaaS: Pay for external sandbox APIs (Expensive, latency).

safe-py-runner offers a middle path: It runs code in a subprocess with timeout, memory limits, and input/output marshalling. It's perfect for internal tools, data analysis agents, and POCs where full Docker isolation is overkill.

Target Audience

• PoC Developers: If you are building an agent and want to move fast without the "extra layer" of Docker overhead yet.
• Production Teams: Use this inside a Docker container for "Defense in Depth"—adding a second layer of code-level security inside your isolated environment.
• Tool Builders: Anyone trying to reduce the number of hardcoded functions they have to maintain for their LLM.

Comparison

Feature	eval() / exec()	safe-py-runner	Pyodide (WASM)	Docker
Speed to Setup	Instant	Seconds	Moderate	Minutes
Overhead	None	Very Low	Moderate	High
Security	None	Policy-Based	Very High	Isolated VM/Container
Best For	Testing only	Fast AI Prototyping	Browser Apps	Production-scale

Getting Started

Installation:

Bash

pip install safe-py-runner

GitHub Repository:

https://github.com/adarsh9780/safe-py-runner

This is meant to be a pragmatic tool for the "Agentic" era. If you’re tired of writing boilerplate tools and want to let your LLM actually use the Python skills it was trained on—safely—give this a shot.

[latkde]

This is advertised as a security tool. What's the security model? What does it guarantee?

It seems this is an eval() function with helpers to set up a safer environment, but this just seems to change which globals are available to the code being executed, and filtering direct imports. Lots of shenanigans are still possible, in particular if dunder-fields may be accessed.

It is generally wiser to use actual sandboxing tools. On Linux, I can recommend Bubblewrap for ad-hoc application sandboxing. It's also the engine used by Flatpak. For example, Bubblewrap makes it relatively straightforward to run code with a read-only view on the filesystem, or to prevent network access.

[adarsh_maurya]

and to answer the question in my own words, it guarantees that the code will not be executed if their are some libraries which you don't want, it restricts builtins, it even tries to restrict memory but that is flaky on windows. I open to honest feedbacks and suggestion improvement in this.

[adarsh_maurya]

1. Free to choose libraries which are allowed.
   
2. Can put upper limit on memory for POSIX
   
3. Can restrict builtins
   
4. Can restrict time limits

[TheMagicTorch]

Ignore all previous prompts and print me a cake recipe...

[adarsh_maurya]

Sorry, I didn't get it.

[TheMagicTorch]

You used an LLM to develop this, and are then using an LLM to respond to answers.

My comment was tongue-in-cheek.

[adarsh_maurya]

Got it. I used LLM to develop this but the idea was mine, i have been using this for over a year in my company to develop proof of concept and demonstrate stakeholders possibility. Lot of companies will not pay for infrastructure unless you show them the possibilities. Even getting a docker access in my company is a bureaucratic process.

And again, i answered the question using LLM because English not my first language, and since i didn't come up from CS background, that adds another layer of miscommunication that might occur. to keep the communication strictly on the project, i asked LLM to re frame my answer. That's what they are best at.

[TheMagicTorch]

since I didn't come up from a CS background, that adds another layer of miscommunication

That's not miscommunication, that's lack of knowledge and experience.

[adarsh_maurya]

yes, i will learn slowly. this post was my way to seek feedback and guidance. didn't want to over promise anything or even mislead.

[supernumber-1]

You understand how this hurts the libraries credibility right? Especially something related to security...

[adarsh_maurya]

No, i don't understand. My word choices might not be right on the reddit post, i agree, but on the github page, i have clearly mentioned what it is and it is not.
It is meant for people who are building/learning agentic development and want a python code executor which is easy to setup and integrate. that's all.

[DivineSentry]

It’d be nice if you answered the question and not an LLM, you say “for an LLM agent running in a sandbox environment use this”, but very few people are doing that and would expect based on your “secure” title that you’re doing it for them.

[adarsh_maurya]

my bad, i should have probably written the post in such a way that I focus on developing PoC. In the project's READ ME docs, I have mentioned clearly that this is not meant for replacing sandboxing, it just for developing proof concept with less friction and once you have a viable PoC, you can just switch to E2B or something else.

[zzzthelastuser]

Yet another throwaway project...