Monty

Monty is a Rust-based interpreter for a restricted Python subset. MontyCodeActProvider gives an Agent Framework agent one execute_code tool and lets generated code call provider-owned tools as typed async functions or through call_tool(...).

This integration uses the CodeAct pattern with a restricted interpreter rather than a hardware-isolated sandbox.

Use Monty when you need a cross-platform CodeAct runtime without Hyperlight's hypervisor or WASM guest dependency.

Note

agent-framework-monty is a beta package. Monty restricts operating-system, subprocess, and direct network access, but it isn't a hardware-isolated virtual machine.

Warning

MontyCodeActProvider and MontyExecuteCodeTool don't currently support FIDES. Provider-managed host-tool calls don't pass through the agent's per-function middleware pipeline.

Checks on direct agent tools or the outer execute_code call don't cover nested calls, code-internal intermediate values, or file and network capabilities. Host tools must enforce their own authorization and destination controls.

Keep FIDES-dependent tools as direct agent tools, not Monty-managed tools, or leave CodeAct disabled for workflows requiring those guarantees. See CodeAct's current limitations.

Install the packages

pip install agent-framework-monty agent-framework-foundry --pre

Add MontyCodeActProvider

Register host tools on the provider rather than directly on the agent. The model sees execute_code and calls those tools from generated code.

async def main() -> None:
    """Run the provider-owned Monty CodeAct sample."""
    # 1. Create the Monty-backed provider and register sandbox tools on it.
    codeact = MontyCodeActProvider(
        tools=[compute, fetch_data],
        approval_mode="never_require",
    )

    # 2. Create the client and the agent.
    agent = Agent(
        client=FoundryChatClient(
            project_endpoint=os.environ["FOUNDRY_PROJECT_ENDPOINT"],
            model=os.environ["FOUNDRY_MODEL"],
            credential=AzureCliCredential(),
        ),
        name="MontyCodeActProviderAgent",
        instructions="You are a helpful assistant.",
        context_providers=[codeact],
        middleware=[log_function_calls],
    )

    # 3. Run a request that should use execute_code plus provider-owned tools.
    query = (
        "Fetch all users, find admins, multiply 7*(3*2), and print the users, "
        "admins, and multiplication result. Use a single execute_code call. "
        "You may call the registered tools directly as typed async functions "
        "(`await compute(operation='multiply', a=7, b=6)`) or via "
        "`call_tool('compute', ...)`."
    )
    print(f"{_CYAN}{'=' * 60}")
    print("Monty CodeAct provider sample")
    print(f"{'=' * 60}{_RESET}")
    print(f"{_CYAN}User: {query}{_RESET}")
    result = await agent.run(query)
    print(f"{_CYAN}Agent: {result.text}{_RESET}")

Control host tool parameter descriptions

MontyCodeActProvider and MontyExecuteCodeTool accept tool_description_format. The default, "compact", includes scalar parameter types, required or optional status, descriptions, enum values, and defaults in the execute_code description and CodeAct instructions. Use "json" for complete JSON Schema, or select a format by exact, case-sensitive tool name:

codeact = MontyCodeActProvider(
    tools=[compute, fetch_data],
    tool_description_format={
        "compute": "json",
        "fetch_data": "compact",
    },
)

Tools omitted from a mapping use compact format. Compact rendering automatically falls back to complete JSON Schema when it can't represent a schema without losing constraints, such as nested objects, arrays, references, or unions. Parameter schemas are visible to the model, so don't include credentials or other secrets in descriptions, enum values, defaults, or custom schema fields.

Configure capabilities

MontyCodeActProvider and MontyExecuteCodeTool support:

  • host tools and runtime tool management
  • never_require or always_require approval for execute_code
  • a workspace root and explicit file mounts
  • Monty resource limits
  • files returned from read-write mounts as Agent Framework content

Network access and Python packages

Monty runs its own Python interpreter, not the host's Python environment. This integration doesn't provide pip or another package-installation option. Installing a dependency on the host doesn't make it importable in Monty code. Use the interpreter's supported modules for code that runs inside Monty.

Monty doesn't provide an allowed_domains option. For external API calls or operations that require host-installed packages, register a narrow host tool and invoke it from Monty code. Keep credentials, authorization, and destination allow-list checks in that function because it executes on the host, outside the Monty interpreter.

Choose Monty or Hyperlight

Runtime Choose it when
Monty Cross-platform execution and a restricted interpreter are sufficient.
Hyperlight You need a hardened sandbox, filesystem controls, or outbound-domain allow lists.

Next steps

Review the CodeAct pattern

  • Last updated on