RestrictedPython
RestrictedPython is a defined subset of the Python language which allows to provide a program input into a trusted environment.
Decision gist · record as of 2026-08-14
Yes, if you need to execute untrusted Python code with controlled restrictions. RestrictedPython is mature, actively maintained, and has no known vulnerabilities. However, it is not a complete sandbox—it requires careful design of your safe_globals and guard functions to be effective. Verify the ZPL-2.1 license compatibility for your use case, and confirm that CPython-only support meets your deployment requirements.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- RestrictedPython only supports CPython; it does not work with PyPy or other Python implementations.
- Low install friction with no runtime dependencies.
- The package is actively maintained with a recent release (35 days ago) and has been in development since 2007.
License · maintenance · safety
ZPL-2.1 (unclear) — Licensed under ZPL-2.1 (Zope Public License 2.1), but license treatment is marked unclear in the metadata—verify the exact terms before use in proprietary or commercial contexts.
last release 2026-07-10 (35 days) · last repo commit 2026-08-13 · 736 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 8,872,727 downloads/mo, #1,584 on PyPI
Alternatives
Verify before relying
from RestrictedPython import compile_restricted, safe_globals
source = "def greet():\n return 'Hello'"
byte_code = compile_restricted(source, '', 'exec')
exec(byte_code, safe_globals, {})- Whether the ZPL-2.1 license is compatible with your project's licensing requirements.
- Whether the 'unclear' license treatment indicates any known ambiguity in the license terms.
- Whether the package's security restrictions are sufficient for your threat model (it is not a full sandbox).
What it is and what it does
RestrictedPython is a code compiler that transforms Python source into a restricted subset suitable for executing untrusted code in a controlled environment. It intercepts dangerous operations—such as arbitrary imports, unsafe attribute access, and format string exploits—by rewriting the compiled bytecode to route these operations through guarded functions that you control. The package is not a sandbox or a security guarantee; rather, it provides the machinery to define a trusted execution context and enforce restrictions within it.
You supply Python source code, compile it with compile_restricted(), and execute the resulting bytecode in a namespace you define (typically using safe_globals as a baseline). RestrictedPython prevents access to internals like __import__, restricts attribute traversal via safer_getattr, and blocks syntax constructs deemed unsafe (such as try/except* in recent versions). It has been maintained since 2007 and currently supports Python 3.10 through 3.14 on CPython only.
Use it for
- Execute user-supplied scripts or formulas in a web application without granting access to the filesystem or system calls.
- Provide a templating or rule-engine system where end users can write logic without risking the host application.
- Sandbox third-party plugins or extensions to prevent them from accessing sensitive APIs or data.
- Implement a restricted REPL or notebook environment for educational or demonstration purposes.
- Validate and restrict Python code before passing it to a workflow or job queue system.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need to execute untrusted Python code with controlled restrictions.
RestrictedPython is mature, actively maintained, and has no known vulnerabilities. However, it is not a complete sandbox—it requires careful design of your safe_globals and guard functions to be effective. Verify the ZPL-2.1 license compatibility for your use case, and confirm that CPython-only support meets your deployment requirements.
Install
restrictedpython on PyPI
Before you install
Low install friction with no runtime dependencies. The package is actively maintained with a recent release (35 days ago) and has been in development since 2007. Supports current Python versions (3.10–3.14) on CPython only.
RestrictedPython only supports CPython; it does not work with PyPy or other Python implementations.
License in practice
Licensed under ZPL-2.1 (Zope Public License 2.1), but license treatment is marked unclear in the metadata—verify the exact terms before use in proprietary or commercial contexts.
Quickstart
from RestrictedPython import compile_restricted, safe_globals
source = "def greet():\n return 'Hello'"
byte_code = compile_restricted(source, '', 'exec')
exec(byte_code, safe_globals, {})Verify before relying
- Whether the ZPL-2.1 license is compatible with your project's licensing requirements.
- Whether the 'unclear' license treatment indicates any known ambiguity in the license terms.
- Whether the package's security restrictions are sufficient for your threat model (it is not a full sandbox).
Package facts
| License | ZPL-2.1 unclear |
| Python support | Supports the current Python release <3.16,>=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Actively maintained 35 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 8,872,727 / month, #1,584 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 6 - MatureOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: Implementation :: CPythonTopic :: SecurityTyping :: Typed |
Evidence: restrictedpython-8.4-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “restricted code execution”
- RestrictedPythonRestrictedPython compiles and executes a restricted subset of Python…
- starlark-pyo3Exposes the Starlark interpreter (a Python-like language) to Python…
- pydantic-monty-runtimeProvides the `monty` command-line binary, a sandboxed Python…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also starlark-pyo3 · AccessControl · nono-py · e2b · asteval · pydantic-monty-runtime · hyperlight-sandbox · zope.deferredimport · llm-sandbox · zope.proxy