Monty

Monty is a Rust-based interpreter for a restricted Python subset. MontyCodeActProvider gives an Agent Framework agent one execute_code tool and lets generated code call provider-owned tools as typed async functions or through call_tool(...).

This integration uses the CodeAct pattern with a restricted interpreter rather than a hardware-isolated sandbox.

Use Monty when you need a cross-platform CodeAct runtime without Hyperlight's hypervisor or WASM guest dependency.

Note

agent-framework-monty is a beta package. Monty restricts operating-system, subprocess, and direct network access, but it isn't a hardware-isolated virtual machine.

Install the packages

pip install agent-framework-monty agent-framework-foundry --pre

Add MontyCodeActProvider

Register host tools on the provider rather than directly on the agent. The model sees execute_code and calls those tools from generated code.

async def main() -> None:
    """Run the provider-owned Monty CodeAct sample."""
    # 1. Create the Monty-backed provider and register sandbox tools on it.
    codeact = MontyCodeActProvider(
        tools=[compute, fetch_data],
        approval_mode="never_require",
    )

    # 2. Create the client and the agent.
    agent = Agent(
        client=FoundryChatClient(
            project_endpoint=os.environ["FOUNDRY_PROJECT_ENDPOINT"],
            model=os.environ["FOUNDRY_MODEL"],
            credential=AzureCliCredential(),
        ),
        name="MontyCodeActProviderAgent",
        instructions="You are a helpful assistant.",
        context_providers=[codeact],
        middleware=[log_function_calls],
    )

    # 3. Run a request that should use execute_code plus provider-owned tools.
    query = (
        "Fetch all users, find admins, multiply 7*(3*2), and print the users, "
        "admins, and multiplication result. Use a single execute_code call. "
        "You may call the registered tools directly as typed async functions "
        "(`await compute(operation='multiply', a=7, b=6)`) or via "
        "`call_tool('compute', ...)`."
    )
    print(f"{_CYAN}{'=' * 60}")
    print("Monty CodeAct provider sample")
    print(f"{'=' * 60}{_RESET}")
    print(f"{_CYAN}User: {query}{_RESET}")
    result = await agent.run(query)
    print(f"{_CYAN}Agent: {result.text}{_RESET}")

Configure capabilities

MontyCodeActProvider and MontyExecuteCodeTool support:

• host tools and runtime tool management
• never_require or always_require approval for execute_code
• a workspace root and explicit file mounts
• Monty resource limits
• files returned from read-write mounts as Agent Framework content

Monty doesn't provide an outbound URL allow list. Provide network access through a narrow host tool that validates destinations and inputs.

Choose Monty or Hyperlight

Runtime	Choose it when
Monty	Cross-platform execution and a restricted interpreter are sufficient.
Hyperlight	You need a hardened sandbox, filesystem controls, or outbound-domain allow lists.

Next steps

Review the CodeAct pattern