Pydantic Monty
The open-source interpreter and Python package
- Controls Controlled host access, resource limits and snapshots
- Hosting and scaling You run it, wherever you choose
- Tracing Instrument it yourself
Agent Sandboxes Beta
A secure place to run your agent’s code
Not a container or VM. Agent Sandboxes is an isolated interpreter for the code your agent writes, built into Logfire and powered by Pydantic Monty.
A Organization Acme 
Agent Sandboxes 
Setup Last 15 minutes
OverviewWorkbenchSnapshotsVolumesProfiles
Setup Last 15 minutes 
Sessions 
298
Last span Nov 12, 00:57
Code runs 485
Estimated cost $0.05
Host calls 377
OS calls 174
Failures 33
Activity over time
Code runsRun time (95%)Failures
0
2
4
6
8
00:4400:4600:4800:5000:5200:5400:56
Sessions
Search by session name or trace ID / Newest first
Session First activity Duration Code runs Calls Failures Actions
session score_support_tickets.py about 9 hours ago 833ms 1 1 0 View code 
session estimate_cloud_spend.py about 9 hours ago 712ms 1 0 0 View code
session triage_failed_payments.py about 9 hours ago 1.25s 1 1 0 View code
Why Agent Sandboxes
Not every job needs a full virtual machine
Most code written by an agent is short and calls a few tools. That job needs an isolated interpreter, not a computer. Agent Sandboxes runs it in Pydantic Monty, our lightweight open-source interpreter built with Rust, with nothing to boot, build, or secure, and nothing to manage between runs.
Benchmark report
Long agent jobs, done right more often
We ran 5,276 graded runs: five Pydantic AI apps, eight models, the same tools, with code mode off and on. Every code mode run executed in Monty, the interpreter inside Agent Sandboxes.
Success on long tasks, by model
Tool calling Code mode
gpt-6-luna
+44 pts Tool calling 14% Code mode 58%
claude-haiku-5-5
+30 pts Tool calling 64% Code mode 94%
deepseek-v4.1-flash
+19 pts Tool calling 81% Code mode 100%
claude-sonnet-5-5
+17 pts Tool calling 83% Code mode 100%
gpt-6.1-sol
+8 pts Tool calling 92% Code mode 100%
gpt-6-astra
+6 pts Tool calling 86% Code mode 92%
muse-spark-1.3
+3 pts Tool calling 94% Code mode 97%
muse-wonder-1.0
Tool calling 100% Code mode 100%
Tokens used on long tasks, by model
Tool calling Code mode
gpt-6-luna
−54% Tool calling 189,799 tokens Code mode 88,059 tokens
claude-haiku-5-5
−70% Tool calling 204,610 tokens Code mode 61,859 tokens
deepseek-v4.1-flash
−9% Tool calling 234,611 tokens Code mode 213,929 tokens
claude-sonnet-5-5
−59% Tool calling 193,566 tokens Code mode 78,803 tokens
gpt-6.1-sol
−41% Tool calling 160,187 tokens Code mode 94,564 tokens
gpt-6-astra
−26% Tool calling 129,974 tokens Code mode 95,597 tokens
muse-spark-1.3
−15% Tool calling 187,429 tokens Code mode 160,230 tokens
muse-wonder-1.0
−25% Tool calling 446,906 tokens Code mode 334,889 tokens
Internal Pydantic benchmark, October 2026. Graded deterministically, no LLM judge. Self-reported; harness not yet public.
Read the full benchmark →Key features
Only the tools you give it, in a fresh session every run
- Sandbox tools support_agentGranted · 3get_customer_balance(customer_id) your function called · 12 msrun_query(sql) your function called · 41 mssend_report(to, body) your function called · 9 msNot grantedFilesystem open() · pathlibNetwork http · socketEnvironment and secrets os.environ
Only the tools you expose
Agent code reaches the functions your application hands it and nothing else. No files, network, or secrets unless you grant them, and your tools keep their own access.
- SessionsSession Duration Code runs Calls Failures Actionssession merge_survey_responses.py 1.05s 1 3 0 View code session rank_leads_by_intent.py 1.71s 2 2 0 View code session cohort_retention_q3.py 943ms 1 1 0 View code session forecast_inventory_reorder.py 1.84s 2 4 0 View code session validate_shipping_addresses.py 1.47s 2 3 error FileNotFoundError View code session score_support_tickets.py 1.28s 1 1 0 View code session dedupe_crm_contacts.py 848ms 1 1 0 View code session score_support_tickets.py 1.12s 1 1 0 View code session merge_survey_responses.py 1.29s 1 3 0 View code session flag_anomalous_refunds.py 710ms 1 1 0 View code session merge_survey_responses.py 1.05s 1 3 0 View code session rank_leads_by_intent.py 1.71s 2 2 0 View code session cohort_retention_q3.py 943ms 1 1 0 View code session forecast_inventory_reorder.py 1.84s 2 4 0 View code session validate_shipping_addresses.py 1.47s 2 3 error FileNotFoundError View code session score_support_tickets.py 1.28s 1 1 0 View code session dedupe_crm_contacts.py 848ms 1 1 0 View code session score_support_tickets.py 1.12s 1 1 0 View code session merge_survey_responses.py 1.29s 1 3 0 View code session flag_anomalous_refunds.py 710ms 1 1 0 View code
Cold start in milliseconds
Every run, and every user, gets a fresh session, even while someone is waiting on the answer. There is no machine to boot and nothing to keep warm between runs.
- Session limits sess_7c1d Stoppedwhile True:rows += fetch_page(cursor)Memory 38 MB / 64 MBTime 5.0 s / 5.0 sTime limit reached. Session stopped.support_agent got the error back and carried on
Limits that hold
Memory is bounded per session and CPU time per run. A loop that never ends hits its limit and stops, and your application carries on.
- refund_workflow sess_41a8 Completerun_query(order_id)calculate_refund(order)request_approval(amount=420)Paused · snapshot saved · 4.2 KB waited for approval · 2d 15h 32mapproved by ops@acmeissue_refund(order_id, 420)Done · picked up where it stopped
Pause at any tool call
Snapshot a session and pick it up later, right where it stopped. The snapshot is the interpreter's own state, so a long workflow survives a deploy or a worker change without starting over.
-
____ _ _ _ __ __ _ | _ \ _ _ __| | __ _ _ __ | |_(_) ___ | \/ | ___ _ __ | |_ _ _ | |_) | | | |/ _` |/ _` | '_ \| __| |/ __| | |\/| |/ _ \| '_ \| __| | | | | __/| |_| | (_| | (_| | | | | |_| | (__ | | | | (_) | | | | |_| |_| | |_| \__, |\__,_|\__,_|_| |_|\__|_|\___| |_| |_|\___/|_| |_|\__|\__, | |___/ |___/Learn more↗
monty version: 1.0.0↗
monty protocol version: 5
server version: v1.0.0 (e3282e4)Run code
Run Python in the Monty sandbox, or use the Python client↗ for more functionality.
class World: def __str__(self) -> str: return 'world' print(f'hello {World()}')RunTested in public
Hack Monty invited researchers to escape the engine underneath. The final announced bounty round ran through August 2026.
- Trace support_agent · 2.41 s6 agent run support_agent 2.41schat claude-sonnet-5-5 1.12s3 run_codeAgent Sandboxes 86mstool get_orders 41mstool get_orders 38mstool get_customer_balance 12mschat claude-sonnet-5-5 1.09s1 sandbox invocation · 3 tool calls · 86 ms Billed on your Logfire plan
Traced next to your agent
Every run shows up in Logfire beside the agent that asked for it, with the tool calls it made and how long each took. Usage lands on your Logfire bill.
Production-ready from the first run
Running agent code is the easy part. Agent Sandboxes handles the rest: isolation, scaling, reliability, and tracing.
-
Run agent code apart from your agent
Spikes in code runs never slow your agent, and you stop sizing servers for the heaviest script.
-
Keep agent code away from your secrets
Agent code runs on separate infrastructure with only the tools it needs, never next to your keys.
-
Scale without a dedicated platform team
Logfire runs and scales the workers, so your team spends its time on agents, not sandbox upkeep.
Every Logfire plan includes 50,000 free sandbox invocations a month
Need more? Pro is $49/mo plus $0.10 per 1,000 invocations, and Growth includes it. For higher volumes or custom limits, we price Advanced with you.
Customer stories
Teams who traded tool calls for code mode
-
How Elumynt cut LLM costs by over 80% with Pydantic Monty
80%+ Lower LLM costs on daily agentic routines
-
How Silex Data cut AIOps agent costs by up to 32% with Pydantic Monty
10/10 Test incidents solved, including two that direct tool calling failed
Monty vs Agent Sandboxes
One engine, two ways to use it
Pydantic Monty is the open-source interpreter. Agent Sandboxes is that interpreter hosted, scaled, and traced inside Logfire.
Agent Sandboxes
Hosted sandboxes built into Logfire, powered by Monty
- Controls Controlled host access, resource limits and snapshots
- Hosting and scaling Pydantic runs it in Logfire Cloud
- Tracing Every run traced in Logfire
Need it on your own hardware? Start with Monty. Self-hosted Agent Sandboxes is planned for Logfire’s Enterprise deployment early next year: talk to us about self-hosting.
Agent Sandboxes FAQs
Is Agent Sandboxes a container?
No. It isn’t a container or a VM. Agent Sandboxes is an isolated interpreter for the code your agent writes, powered by Pydantic Monty, so there’s no machine to boot and nothing to keep warm between runs.
When should I use a container instead?
When the job needs a full computer. Coding agents that run build tools, install packages, or walk a real filesystem need a container or VM sandbox: Agent Sandboxes runs a Python subset with host callbacks and has no operating system underneath. Reinforcement learning environments that need a whole computer per episode belong on a VM-backed sandbox, where the environment is the product. And you don’t deploy applications into it: the sandbox holds the agent’s code while your application keeps running wherever it runs today. Running model-written code in your own process with exec or subprocess is fast, but the code can do anything your application can. Agent Sandboxes keeps that speed and adds the limits.
Do my tools keep their own network and library access?
Yes. Agent code can only call the functions your application hands it. Those functions run in your application, so they keep their own network, library and secret access. The agent’s code gets none of that unless you grant it.
How is Agent Sandboxes different from Pydantic Monty?
Pydantic Monty is our open-source interpreter, built with Rust. Agent Sandboxes runs Monty for you inside Logfire: Logfire runs and scales the workers, bounds the memory of every session and the CPU time of every run, snapshots sessions so they can pause and resume, and traces every run next to your agent.
What language does the agent write?
Python. Monty is a sandboxed Python interpreter, so your agent writes Python and calls your tools as ordinary functions. It covers what agents reach for: async functions, comprehensions, dataclasses, match, and standard modules such as asyncio, json, re and datetime. Third-party packages can’t be installed. Monty’s limitations lists the rest.
What can the code reach?
Only the functions you expose. No files, network, environment variables or secrets unless you grant them. Each run gets 50 ms of CPU and each session 20 MiB of memory, so runaway code is stopped and your application keeps running.
Are there rate limits?
Yes. On Free and Pro, you can start up to 300 sessions every 5 minutes. Concurrent sessions follow your Logfire plan: 4 on Personal, with no limit on Team, Growth and Enterprise. On Advanced, they’re set around your workload. They’re separate from your monthly allowance: the 50,000 free invocations a month set how much you get, and these set how fast you can use them.
Does it work with Pydantic AI?
Yes. Pass CodeMode(monty_sandbox=logfire.agent_sandboxes) to your agent, with pydantic-ai-harness 0.67.0 or later, and the code it writes runs in Agent Sandboxes. In our benchmark, five Pydantic AI apps ran with code mode on, and every code mode run executed in Monty, the interpreter inside Agent Sandboxes.
Can I self-host Agent Sandboxes?
Not yet. Agent Sandboxes is part of Logfire and runs in Logfire Cloud. Self-hosting is planned as part of Logfire’s self-hosted Enterprise deployment, early next year.
What does it cost?
Every Logfire plan includes 50,000 free invocations a month. Pro is $49 a month plus $0.10 per 1,000 invocations, with fixed limits of 50 ms of CPU per invocation and 20 MiB of memory per session, and it’s included with Growth and Enterprise Cloud. Advanced is for higher volumes or workloads that need more than those limits: we set its limits and price with you. See Agent Sandboxes pricing.