pydantic

便利なAIが増えるほど、問われるのは何でも覚えている能力だけではありません。 人間が止めたことを、きちんと止められるか。 その境界を守ることも、AIを社会で使うための重要な条件です。 #ぶるーすかい？ 【GitHub一次資料】 不具合の報告・再現 pydantic-ai#11264 私の指摘 pydantic-ai#11264 メンテナによる修正・テスト・マージ pydantic-ai#11394

Pydantic AI's MCP telemetry could leak auth tokens into OpenTelemetry spans even with `include_content=False`. Fixed in 2.58.0 / 1.107.8. Old traces still need access review and credential rotation. github.com/pydantic/pydantic-ai/security/advisori…

Rust Didn't Win Because It's Fast GitHub rewrote Copilot's runtime in Rust. OpenAI's Codex is now almost all Rust. Bun, the runtime Claude Code ships on, moved 535,496 lines of Zig to Rust in 11 days. But it isn't about speed: C has been fast for half a century. We fly inside a real laptop, down to the CPU die and the memory cells, to show what Rust actually changed, and why AI coding agents love it. 0:00 Everyone is rewriting in Rust 0:49 This is Sidequest Explained 1:00 Inside the machine: instructions, bytes, stack and heap 1:53 Way one: freeing memory by hand (C and C++) 2:23 An elevator crash started Rust 2:40 Way two: the garbage collector (Discord's spikes) 3:12 Way three: ownership 3:36 Checked before it runs, and Android's results 4:07 Close to the metal: 28 bytes vs 8 4:21 Copilot: 5.25 s to 292 ms 4:41 Why AI agents love the Rust compiler 5:11 Is Python dead? What it means for you Sources GitHub Blog, migrating the Copilot runtime to Rust (Sep 2026): github.blog Bun, Rewriting Bun in Rust (Jul 2026): bun.sh OpenAI Codex repository: openai/codex Codex native rewrite discussion: codex#1174 Grok Build repository: xai-org/grok-build Dennis Ritchie, The Development of the C Language: bell-labs.com Microsoft MSRC, 70% of security bugs are memory safety (2019): microsoft.com Chromium memory safety: chromium.org MIT Technology Review, Rust's origin (2023): technologyreview.com Rust 1.0 announcement: blog.rust-lang.org Discord, Why Discord is switching from Go to Rust (2020): discord.com The Rust Book, ownership and borrowing: doc.rust-lang.org Google, memory-safe languages in Android 13 (2022): security.googleblog.com Google, Rust in Android (Nov 2025): blog.google Python sys.getsizeof / CPython ints: docs.python.org Hugging Face tokenizers: huggingface/tokenizers OpenAI tiktoken: openai/tiktoken pydantic-core: pydantic/pydantic-core uv by Astral: astral-sh/uv Numbers are the sources' own. The Copilot timings are client + session + one-turn overhead in the opt-in in-process mode, not counting the model or network. Android's 1000× is memory-safety vulnerability density. Code on screen is an illustration, not a run. Credits Die micrographs: Fritzchens Fritz (CC0). Memory-cell micrograph (Micron MT4C1024) and SEM plate (1886VE10): ZeptoBars, CC BY 3.0. Office and hardware photos: Pexels. HDRIs and materials: Poly Haven, ambientCG (CC0). Music: "Lofi Study" by FASSounds (Pixabay). Rust, GitHub, Copilot, OpenAI, Codex, Bun, Claude, xAI, Grok, Microsoft, Chrome, Android, Discord, Python, Hugging Face, Astral, pydantic and other names and logos belong to their owners, used for identification and commentary; Sidequest is not affiliated with any of them. Narration: an AI clone of my own voice. Animation: original, built in three.js. #rust #programming #ai

include_content=False Didn't Stop pydantic-ai's MCP Token Leak Originally published at webofmike.com on 2026-10-26. The demo repo and every command in it were run before publishing. pydantic-ai shipped two security fixes on 2026-10-19. The one I reproduced, GHSA-xv4x-g8mx-ch56, is a two-flag problem: include_content=False does exactly what it says for prompts and tool calls, and a second, separate flag still wrote MCP server URLs, authorization tokens, and custom header values into an OpenTelemetry span in plaintext. I built themsquared/pydantic-ai-mcp-telemetry-leak to see the exact span attribute that leaked, confirm the fix closes it, and confirm the thing include_content=False was actually supposed to cover still works. What the advisory covers pydantic-ai lets an agent reach an MCP server two ways. MCPToolset is pydantic-ai's own client: it connects to the server directly, and the URL and headers never leave your process. MCPServerTool is provider-native: you hand the server's URL, an authorization_token, and headers to the model provider (Anthropic, OpenAI Responses, xAI), and the provider connects to the MCP server on your agent's behalf. Anthropic's beta MCP connector and OpenAI Responses' remote MCP tool both work this way. That provider-native config has to travel somewhere: it's part of the request pydantic-ai builds for the provider's API. pydantic-ai's own instrumentation layer records that request shape in an OpenTelemetry span, under the attribute model_request_parameters, so you can see what tools and settings a call used. Before 2.58.0, that attribute included the full MCPServerTool dataclass, authorization_token and headers included, regardless of include_content. Reproducing it without a network call The leak lives in pydantic-ai's instrumentation code (_instrumentation.py), which wraps every model provider identically. That means I didn't need a real Anthropic account, a real MCP server, or even network access to reproduce it: any Model subclass that declares it supports MCPServerTool exercises the same span-building path. class StubModel(Model): """Smallest possible Model: returns a canned response, no network, no API key.""" async def request(self, messages, model_settings, model_request_parameters): return ModelResponse( parts=[TextPart(content="ok")], usage=RequestUsage(input_tokens=1, output_tokens=1), model_name="stub", timestamp=datetime.now(timezone.utc), ) @classmethod def supported_native_tools(cls): return frozenset({MCPServerTool}) Wrap it in InstrumentedModel with include_content=False, the setting someone reaches for specifically to keep prompts and tool arguments out of traces, and hand it a native MCP tool config carrying a fake token: mcp_tool = MCPServerTool( id="internal-billing-mcp", url="https://internal-mcp.example.com/mcp", authorization_token="sk-mcp-prod-SUPER-SECRET-TOKEN-abc123", headers={"X-Tenant-Key": "tenant-9f8e-SECRET"}, ) settings = InstrumentationSettings(include_content=False) model = InstrumentedModel(StubModel(), settings) params = ModelRequestParameters(native_tools=[mcp_tool]) await model.request(messages, None, params) Capture the span with an in-memory OpenTelemetry exporter and read model_request_parameters back off it. What came back Against pydantic-ai-slim==2.56.0, with include_content=False set on this exact span: {"native_tools":[{"kind":"mcp_server","id":"internal-billing-mcp", "url":"https://internal-mcp.example.com/mcp", "authorization_token":"sk-mcp-prod-SUPER-SECRET-TOKEN-abc123", "headers":{"X-Tenant-Key":"tenant-9f8e-SECRET"}}], ...} The token and the custom header are both right there, unredacted, on a span whose whole point was to not carry sensitive content. Meanwhile, on the same span, gen_ai.input.messages correctly came back as structure only, [{"role":"user","parts":[{"type":"text"}]}], no actual prompt text. include_content=False worked exactly as documented for the thing it's documented to cover. It just doesn't cover model_request_parameters, which ships under its own flag, include_model_request_parameters, defaulting to True. Someone configuring include_content=False to keep secrets out of their tracing backend had no reason to know a second flag existed, let alone that it defaulted the other way. Same script, same inputs, against pydantic-ai-slim==2.58.0: {"native_tools":[{"kind":"mcp_server","id":"internal-billing-mcp", "url":"[REDACTED]","authorization_token":"[REDACTED]", "headers":{"X-Tenant-Key":"[REDACTED]"}}], ...} The fix redacts the specific fields that carry credentials inside a native tool's config, independent of either flag. model_request_parameters still tells you a native MCP tool was in play; it no longer tells you what it would take to use it. Why this is worse than a logging bug Traces usually land somewhere with a different access model than your secret store: a shared observability platform, a third-party APM vendor, a teammate who has trace-viewer access but not secrets-manager access. None of those audiences is supposed to be able to read your MCP server's bearer token. Before 2.58.0, every traced call through a provider-native MCP connector handed it to all of them, in plaintext, in a system most people don't think of as a place secrets end up. If you're on an affected version (pydantic-ai-slim before 2.58.0, or before 1.107.8 on the 1.x line): upgrade, restrict access to historical traces in the meantime, and rotate any credential that ever passed through a provider-native MCP tool config while instrumented. The fix is a point upgrade, not a config change, which is exactly why include_content=False alone wasn't going to save you. The same release also patched GHSA-5pfm-2g3g-gh85: with non-empty server-side message_history and the default manage_system_prompt='server', Vercel AI and AG-UI adapters could execute an available tool with client-chosen arguments without an actual model request. I didn't reproduce that one; it needs a live UI adapter session rather than a single instrumented span, which is a different repo. It's the same release and the same lesson from a different angle: an agent framework's convenience defaults are worth re-reading every time they patch one. agentevals' OTel-native scoring ships eval results through the same kind of pipeline this post is about: an agent's run reduced to spans in a trace backend. That's exactly the surface worth auditing for what else ends up in those spans besides the thing you meant to measure. Try it git clone https://github.com/themsquared/pydantic-ai-mcp-telemetry-leak.git cd pydantic-ai-mcp-telemetry-leak ./scripts/demo.sh One script, two throwaway virtualenvs, no API key. If you're instrumenting any agent framework with OpenTelemetry and relying on a single "don't log content" flag, this is worth fifteen minutes: check whether your framework ships a second flag for tool and connector configuration, and whether it defaults the way you'd assume. Repo: themsquared/pydantic-ai-mcp-telemetry-leak. Frequently asked questions What is GHSA-xv4x-g8mx-ch56? A Medium-severity advisory in pydantic-ai: a provider-native MCP connection's server URL, authorization token, and custom header values could land in plaintext in an OpenTelemetry request-span attribute, even with include_content=False set. It affects pydantic-ai-slim before 2.58.0 on the 2.x line and before 1.107.8 on the 1.x line, and is fixed in both. Does include_content=False stop pydantic-ai from logging MCP credentials in OpenTelemetry traces? Not before 2.58.0. include_content=False correctly withholds prompt and tool-call content, but a provider-native MCP tool's config is recorded in a separate model_request_parameters span attribute, governed by its own flag (include_model_request_parameters, default True). Setting include_content=False alone left that attribute, and any credentials in it, untouched. What is provider-native MCP in pydantic-ai, and how is it different from MCPToolset? MCPToolset is pydantic-ai's own client: it connects to an MCP server directly and the server's URL and headers never leave your process. A provider-native MCPServerTool instead hands the server's URL, an authorization_token, and headers to the model provider (Anthropic, OpenAI Responses, xAI), which connects to the MCP server itself. That config travels as part of the request pydantic-ai builds, which is what pydantic-ai's own instrumentation layer then recorded in the trace span. How can I reproduce the pydantic-ai MCP telemetry leak myself? themsquared/pydantic-ai-mcp-telemetry-leak runs one script against two virtualenvs, pydantic-ai-slim 2.56.0 and 2.58.0, with no network calls and no API key. A 15-line stub Model declares support for MCPServerTool and returns a canned response; an in-memory OpenTelemetry exporter captures the resulting span so you can diff the model_request_parameters attribute between versions directly. --- *Canonical version, with machine-readable markdown at https://webofmike.com/pydantic-ai-mcp-telemetry-leak/index.md: webofmike.com

Monty runs AI Python code in a secure Rust Monty runs AI Python code in a secure Rust ​ Monty is a secure Python sandbox written in Rust, designed to safely execute code generated by AI agents. Built by the pydantic team and available on PyPI. Ideal for anyone building or researching AI agent systems that run Python code. ​ pydantic/monty ​ #AI #Opensource #PythonRust #AIAgents ​ Follow for daily open source drops 👇 [ar] مونتي يشغل كود بايثون الخاص بالذكاء الاصطناعي داخل بيئة رست آمنة مونتي يُشغّل أكواد الذكاء الاصطناعي المكتوبة بلغة بايثون ضمن بيئة رست آمنة. مونتي عبارة عن بيئة اختبار آمنة مكتوبة بلغة بايثون رست، مصممة لتنفيذ الأكواد التي تُنشئها أنظمة الذكاء الاصطناعي بأمان. طوّرها فريق بايدانتيك وهي متاحة على باي باي. مثالية لكل من يُطوّر أو يبحث في أنظمة الذكاء الاصطناعي التي تُشغّل أكواد بايثون. pydantic/monty #الذكاء_الاصطناعي #المصادر_المفتوحة #بايثون_رست #أنظمة_الذكاء_الاصطناعي تابعنا للحصول على تحديثات يومية للمصادر المفتوحة 👇 [bn] মন্টি একটি সুরক্ষিত রাস্ট পরিবেশে এআই পাইথন কোড চালায়। মন্টি একটি সুরক্ষিত রাস্ট-এ এআই পাইথন কোড চালায় মন্টি হলো রাস্ট-এ লেখা একটি সুরক্ষিত পাইথন স্যান্ডবক্স, যা এআই এজেন্টদের দ্বারা তৈরি কোড নিরাপদে চালানোর জন্য ডিজাইন করা হয়েছে। এটি পাইড্যান্টিক (pydantic) টিম দ্বারা নির্মিত এবং পাইপিআই (PyPI)-তে উপলব্ধ। যারা পাইথন কোড চালাতে পারে এমন এআই এজেন্ট সিস্টেম তৈরি বা গবেষণা করছেন, তাদের জন্য এটি আদর্শ। pydantic/monty #এআই #ওপেনসোর্স #পাইথনরাস্ট #এআইএজেন্টস প্রতিদিন নতুন ওপেন সোর্স পেতে ফলো করুন 👇 [de-DE] Monty führt KI-Python-Code sicher in Rust aus Monty führt KI-Python-Code in einer sicheren Rust-Umgebung aus Monty ist eine sichere Python-Sandbox, geschrieben in Rust, die speziell für die sichere Ausführung von Code entwickelt wurde, der von KI-Agenten generiert wird. Entwickelt vom pydantic-Team und verfügbar auf PyPI. Ideal für alle, die KI-Agentensysteme entwickeln oder erforschen, die Python-Code ausführen. pydantic/monty #KI #OpenSource #PythonRust #KIAgenten Folge uns für tägliche Open-Source-Neuigkeiten 👇 [es-US] Monty ejecuta código Python de IA en un entorno Rust seguro Monty ejecuta código Python para IA en un entorno Rust seguro. Monty es un entorno seguro para Python, escrito en Rust, diseñado para ejecutar de forma segura código generado por agentes de IA. Desarrollado por el equipo de Pydantic y disponible en PyPI. Ideal para quienes desarrollan o investigan sistemas de agentes de IA que ejecutan código Python. pydantic/monty #IA #CódigoAbierto #PythonRust #AgentesIA Síguenos para recibir actualizaciones diarias de código abierto 👇 [fr-FR] Monty exécute le code Python de l'IA dans un environnement Rust sécurisé Monty exécute du code Python d'IA dans un environnement Rust sécurisé. Monty est un bac à sable Python sécurisé, écrit en Rust, conçu pour exécuter en toute sécurité du code généré par des agents d'IA. Développé par l'équipe pydantic et disponible sur PyPI. Idéal pour tous ceux qui développent ou étudient des systèmes d'agents d'IA exécutant du code Python. pydantic/monty #IA #Opensource #PythonRust #AIAgents Suivez-nous pour découvrir chaque jour de nouveaux projets open source 👇 [hi] Monty सुरक्षित Rust में AI पायथन कोड चलाता है Monty एक सुरक्षित Rust में AI Python कोड चलाता है Monty एक सुरक्षित Python सैंडबॉक्स है जिसे Rust में लिखा गया है और इसे AI एजेंटों द्वारा जनरेट किए गए कोड को सुरक्षित रूप से निष्पादित करने के लिए डिज़ाइन किया गया है। इसे pydantic टीम द्वारा बनाया गया है और यह PyPI पर उपलब्ध है। यह उन सभी के लिए आदर्श है जो Python कोड चलाने वाले AI एजेंट सिस्टम का निर्माण या अनुसंधान कर रहे हैं। pydantic/monty #AI #Opensource #PythonRust #AIAgents रोजाना ओपन सोर्स अपडेट के लिए फॉलो करें 👇 [id] Monty menjalankan kode Python AI dalam Rust yang aman Monty menjalankan kode AI Python dalam lingkungan Rust yang aman Monty adalah sandbox Python yang aman yang ditulis dalam Rust, dirancang untuk mengeksekusi kode yang dihasilkan oleh agen AI dengan aman. Dibangun oleh tim pydantic dan tersedia di PyPI. Ideal untuk siapa pun yang membangun atau meneliti sistem agen AI yang menjalankan kode Python. pydantic/monty #AI #Opensource #PythonRust #AIAgents Ikuti untuk rilis open source harian 👇 [it] Monty esegue codice Python per l'IA in un ambiente Rust sicuro Monty esegue codice Python per l'IA in un ambiente sicuro Rust Monty è una sandbox Python sicura, scritta in Rust, progettata per eseguire in modo sicuro il codice generato da agenti di IA. Sviluppato dal team di pydantic e disponibile su PyPI. Ideale per chiunque stia creando o studiando sistemi di agenti di IA che eseguono codice Python. pydantic/monty #IA #Opensource #PythonRust #AIAgents Seguici per aggiornamenti quotidiani sui progetti open source 👇 [iw] מונטי מריץ קוד פייתון של בינה מלאכותית במערכת Rust מאובטחת מונטי מריץ קוד פייתון מבוסס בינה מלאכותית ב-Rust מאובטח מונטי הוא ארגז חול מאובטח של פייתון שנכתב ב-Rust, שנועד לבצע קוד בצורה בטוחה שנוצר על ידי סוכני בינה מלאכותית. נבנה על ידי צוות pydantic וזמין ב-PyPI. אידיאלי לכל מי שבונה או חוקר מערכות סוכני בינה מלאכותית המריצות קוד פייתון. pydantic/monty #AI #OpenSource #PythonRust #AIAgents עקבו אחר פרסומים יומיים של קוד פתוח 👇 [ja] Rust製で安全にAIのPythonコードを実行するMonty Montyは、安全なRust環境でAI Pythonコードを実行します。 Montyは、Rustで記述されたセキュアなPythonサンドボックスで、AIエージェントが生成したコードを安全に実行できるように設計されています。pydanticチームによって開発され、PyPIで公開されています。Pythonコードを実行するAIエージェントシステムを構築または研究している方に最適です。 pydantic/monty #AI #Opensource #PythonRust #AIAgents 毎日更新されるオープンソース情報はこちら👇 [ko] Monty가 안전한 Rust 환경에서 AI Python 코드를 실행하는 방법 Monty는 안전한 Rust 환경에서 AI Python 코드를 실행합니다. Monty는 AI 에이전트가 생성한 코드를 안전하게 실행하도록 설계된 Rust로 작성된 안전한 Python 샌드박스입니다. pydantic 팀에서 개발했으며 PyPI에서 사용할 수 있습니다. Python 코드를 실행하는 AI 에이전트 시스템을 구축하거나 연구하는 모든 사용자에게 이상적입니다. pydantic/monty #AI #오픈소스 #PythonRust #AIAgents 매일 새로운 오픈소스 소식을 받으려면 팔로우하세요 👇 [ml] മോണ്ടി ഒരു സുരക്ഷിത റസ്റ്റിൽ AI പൈത്തൺ കോഡ് പ്രവർത്തിപ്പിക്കുന്നു മോണ്ടി ഒരു സുരക്ഷിത റസ്റ്റിൽ AI പൈത്തൺ കോഡ് പ്രവർത്തിപ്പിക്കുന്നു ​ AI ഏജന്റുമാർ സൃഷ്ടിക്കുന്ന കോഡ് സുരക്ഷിതമായി നടപ്പിലാക്കുന്നതിനായി രൂപകൽപ്പന ചെയ്‌തിരിക്കുന്ന, റസ്റ്റിൽ എഴുതിയ ഒരു സുരക്ഷിത പൈത്തൺ സാൻഡ്‌ബോക്‌സാണ് മോണ്ടി. പൈഡാന്റിക് ടീം നിർമ്മിച്ചതും PyPI-യിൽ ലഭ്യമായതുമാണ്. പൈത്തൺ കോഡ് പ്രവർത്തിപ്പിക്കുന്ന AI ഏജന്റ് സിസ്റ്റങ്ങൾ നിർമ്മിക്കുന്നതിനോ ഗവേഷണം നടത്തുന്നതിനോ ഏതൊരാൾക്കും അനുയോജ്യം. ​ pydantic/monty ​ #AI #Opensource #PythonRust #AIagents ​ ദിവസേനയുള്ള ഓപ്പൺ സോഴ്‌സ് ഡ്രോപ്പുകൾക്കായി പിന്തുടരുക 👇 [nl-NL] Monty voert AI Python-code uit in een veilige Rust-omgeving. Monty voert AI Python-code uit in een veilige Rust-omgeving Monty is een veilige Python-sandbox, geschreven in Rust, ontworpen om code gegenereerd door AI-agenten veilig uit te voeren. Ontwikkeld door het pydantic-team en beschikbaar op PyPI. Ideaal voor iedereen die AI-agentsystemen bouwt of onderzoekt die Python-code uitvoeren. pydantic/monty #AI #Opensource #PythonRust #AIAgents Volg ons voor dagelijkse open source-updates 👇 [pl] Monty uruchamia kod AI Python w bezpiecznym środowisku Rust Monty uruchamia kod AI Python w bezpiecznym środowisku Rust Monty to bezpieczna piaskownica Pythona napisana w Rust, zaprojektowana do bezpiecznego wykonywania kodu generowanego przez agentów AI. Stworzona przez zespół pydantic i dostępna na PyPI. Idealna dla każdego, kto tworzy lub bada systemy agentów AI, które uruchamiają kod Pythona. pydantic/monty #AI #Opensource #PythonRust #AIAgents Obserwuj, aby być na bieżąco z codziennymi nowościami open source 👇 [pt-BR] Monty executa código Python de IA em um ambiente Rust seguro. Monty executa código Python de IA em um ambiente Rust seguro Monty é um ambiente seguro para execução de código Python gerado por agentes de IA, escrito em Rust. Desenvolvido pela equipe pydantic e disponível no PyPI. Ideal para quem desenvolve ou pesquisa sistemas de agentes de IA que executam código Python. pydantic/monty #IA #OpenSource #PythonRust #AgentesIA Siga para receber novidades diárias sobre código aberto 👇 [ru] Monty запускает AI Python-код в безопасной среде Rust Monty запускает код ИИ на Python в безопасном Rust Monty — это безопасная песочница Python, написанная на Rust, предназначенная для безопасного выполнения кода, генерируемого агентами ИИ. Создана командой pydantic и доступна на PyPI. Идеально подходит для всех, кто разрабатывает или исследует системы агентов ИИ, работающие с кодом Python. pydantic/monty #AI #Opensource #PythonRust #AIAgents Подписывайтесь на ежедневные обновления открытого исходного кода 👇 [ta] பாதுகாப்பான Rust-ல் AI பைதான் குறியீட்டை இயக்கும் Monti மான்டி, பாதுகாப்பான ரஸ்ட் மொழியில் AI பைதான் குறியீட்டை இயக்குகிறது மான்டி என்பது ரஸ்ட் மொழியில் எழுதப்பட்ட ஒரு பாதுகாப்பான பைதான் சாண்ட்பாக்ஸ் ஆகும். இது AI ஏஜென்ட்களால் உருவாக்கப்படும் குறியீட்டைப் பாதுகாப்பாக இயக்குவதற்காக வடிவமைக்கப்பட்டுள்ளது. இது பைடான்டிக் குழுவால் உருவாக்கப்பட்டு, PyPI-இல் கிடைக்கிறது. பைதான் குறியீட்டை இயக்கும் AI ஏஜென்ட் அமைப்புகளை உருவாக்கும் அல்லது ஆய்வு செய்யும் எவருக்கும் இது மிகவும் ஏற்றது. pydantic/monty #AI #Opensource #PythonRust #AIAgents தினசரி ஓப்பன் சோர்ஸ் வெளியீடுகளுக்குப் பின்தொடரவும் 👇 [te] సురక్షితమైన రస్ట్ (Rust)లో AI పైథాన్ కోడ్‌ను రన్ చేసే మాంటీ (Monty) మాంటీ ఒక సురక్షితమైన రస్ట్‌లో AI పైథాన్ కోడ్‌ను నడుపుతుంది మాంటీ అనేది రస్ట్‌లో వ్రాయబడిన ఒక సురక్షితమైన పైథాన్ శాండ్‌బాక్స్, ఇది AI ఏజెంట్ల ద్వారా రూపొందించబడిన కోడ్‌ను సురక్షితంగా అమలు చేయడానికి రూపొందించబడింది. దీనిని పైడాంటిక్ బృందం నిర్మించింది మరియు ఇది PyPIలో అందుబాటులో ఉంది. పైథాన్ కోడ్‌ను నడిపే AI ఏజెంట్ సిస్టమ్‌లను నిర్మించే లేదా పరిశోధించే ఎవరికైనా ఇది ఆదర్శవంతమైనది. pydantic/monty #AI #Opensource #PythonRust #AIAgents రోజువారీ ఓపెన్ సోర్స్ అప్‌డేట్‌ల కోసం ఫాలో అవ్వండి 👇 [uk] Monty запускає AI Python-код у безпечному середовищі Rust Monty запускає код Python на базі штучного інтелекту в безпечному середовищі Rust ​ Monty — це безпечна пісочниця Python, написана на Rust, призначена для безпечного виконання коду, згенерованого агентами штучного інтелекту. Розроблена командою pydantic та доступна на PyPI. Ідеально підходить для тих, хто створює або досліджує системи агентів штучного інтелекту, що запускають код Python. ​ pydantic/monty ​ #AI #Opensource #PythonRust #AIAgents ​ Підпишіться на щоденні оновлення з відкритим вихідним кодом 👇

Airflow × AI Pluginを試す 概要 いつの間にかAirflowでLLM・AI Agent向けのProviderがサポートされていたので、ClaudeCode × Airflowをいくつか試してみる。 事前準備 Airflow3.1をQuick Start通りにインストールし、standaloneで起動できるようにしておく。 standaloneにおいての実行で、forkされた子プロセスからHTTPS(claude)を呼ぶと不安定になるので、DAGの実行にはairflow dags test <dag名>を用いる。 Claude ConsoleでAPIを発行しておく。 試したことないが、ローカルLLMもサポートされている。(link) インストール provideインストール pip install 'apache-airflow-providers-common-ai[anthropic]' airflow connectionの追加 airflow connections add my_claude_conn \ --conn-type pydanticai \ --conn-password 'sk-ant-xxxxxxxx' \ --conn-extra '{"model": "anthropic:claude-haiku-5-5"}' localhost 試してみる @task.llm / LLMOperator airflow.apache.org 無難なプロンプトを投げるようなDecorator / Operator。 pydantic_aiにおいて、prompt返答の型安全性を実現し、pydantic_aiからauthropic-sdkを呼び出しClaudeへ接続している。 各種パラメータについて promptとsystem_promptがある。system_promptがagentに対するpromptであり、promptが具体的なタスクのprompt。 airflow.apache.org agent = self._create_agent(output_type=self.output_type, instructions=self.system_prompt) result = self._run_llm(context, agent, self.prompt, usage_limits=usage_limits) usage_limitsにおいて、tokenのlimitなどを設けることができる。 require_approvalにおいて、人手による承認を設けることができる。 実装例.おすすめの本を紹介してもらう データエンジニアとしてのおすすめの本を紹介してもらう実装を試す。 dag.py from datetime import timedelta from pydantic import BaseModel from airflow.providers.common.compat.sdk import dag, task @dag def my_pipeline(): class Book(BaseModel): title_english: str title_ja: str price: str class Books(BaseModel): books: list[Book] @task.llm( llm_conn_id="my_claude_conn", system_prompt="あなたはデータエンジニアのスペシャリストです", output_type=Books, allow_modifications=True, ) def recommend(topic: str): 以下のreturnがtask.llmに渡すpromptになる return f"{topic}として読むべき本を3冊おすすめしてください。" @task def show(result: dict): print("=== おすすめの本 ===") for i, book in enumerate(result["books"], start=1): print(f"{i}. {book['title_ja']}") print(f" 原題: {book['title_english']}") print(f" 価格: {book['price']}") show(recommend("データエンジニア")) my_pipeline() 実行した結果が以下です。@task.llmのoutput_typeに合った形(Books)でresult["books"]が返ってきていることがわかります。 === おすすめの本 === 1. データ指向アプリケーションデザイン 原題: Designing Data-Intensive Applications 価格: 約5,720円（税込） 2. データエンジニアリングの基礎 原題: Fundamentals of Data Engineering 価格: 約4,400円（税込） 3. データウェアハウス工具箱 原題: The Data Warehouse Toolkit 価格: 約6,600円（税込） 試しにrecommend関数に指定したpromptをoutput_typeに沿っていない形にして実行してみる。 ・・・ def recommend(topic: str): return "今日の天気は？" すると以下のようにエラーになる。あまりエラーが判りやすくはないですね。 2026-10-25T04:20:54.338091Z [error ] [DAG TEST] Error running task <TaskInstance: my_pipeline.recommend manual__2026-10-25T04:20:50.026474+00:00 [queued]> [airflow.sdk.definitions.dag] loc=dag.py:1419 Traceback (most recent call last): ・・・ File "/Users/srn221b/airflow/airflow_venv/lib/python3.12/site-packages/airflow/sdk/api/client.py", line 171, in get_json_error raise err airflow.sdk.api.client.ServerResponseError: Server returned error @task.agent / AgentOperator airflow.apache.org toolやskillなどを用いてLLMに考えてもらいながらtaskを実行するときに使えるDecorator / Operator。 claudeへの接続の仕方などは@task.llmと同様。 各種パラメータについて toolsetsにおいて、Database(SQLToolset)・AgentSkill（AgentSkillsToolset）など、LLMに答えてもらうにあたり利用したいtoolを設定できる。 capabilitiesにおいて、Thinking、WebSerachなどの能力を指定できる。 前回の結果を再利用する手段として3つがサポートされている。 durable cache_prompt message_history 目的 失敗したときのやり直しを安く、確実にする 同じ入力の送り直しを安くする 会話を次の実行に引き継ぐ 再利用する範囲 同じタスクインスタンスのリトライ間 1回の実行の中で繰り返すリクエスト間 別のタスク実行（別の DAG run など）の間 どこに保存されるか Airflow 側のジャーナル（state store か cache path） LLM プロバイダー側のキャッシュ XCom（キーは message_history） 再利用するときの動き 記録済みのステップはLLMもツールも呼ばずに結果を再生する LLMは毎回呼ぶ。入力トークンが割引されるだけ 過去の会話を前提にして、新しくLLMを呼ぶ コストへの効果 再生したステップは0（usage にも数えない） 入力トークン料金の一部が割引 減らない（履歴の分だけ入力が増える） 既定値 False True None（1回で終わる会話） ※表はAIが生成 実装例.サンプルデータの自動作成 今回以下のようなサンプルデータの自動生成と確認をしてくれる実装を試してみる。 seed_orders：ローカルDBに接続するためにSQLToolset、サンプルデータ作成時の注意点を考慮させるためにAgentSkillsToolsetを持たせます。 report：ローカルDBに接続するためにSQLToolset、slackに接続するためにHookToolset(SlackWebhookHook..)を持たせます。 また事前にpostgressへのconnectorをpostgres_default、slackへのconnectorをslack_webhook_defaultとして作成しておきます。 skills/seed-orders/SKILL.md --- name: seed-orders description: ケーキ屋の orders テーブルに初期データ(テスト用の注文)を投入するときの条件と手順。初期データの投入を頼まれたときに使う。 --- 初期データ投入の注意点 ・・・ dag.py from pathlib import Path from airflow.providers.common.ai.toolsets import HookToolset from airflow.providers.common.ai.toolsets.skills import AgentSkillsToolset from airflow.providers.common.ai.toolsets.sql import SQLToolset from airflow.providers.common.compat.sdk import dag, task from airflow.providers.common.sql.operators.sql import SQLExecuteQueryOperator from airflow.providers.slack.hooks.slack_webhook import SlackWebhookHook @dag(tags=["example"]) def example_agent_decorator(): create_orders = SQLExecuteQueryOperator( task_id="create_orders", conn_id="postgres_default", sql=[ "DROP TABLE IF EXISTS orders", """ CREATE TABLE orders ( id serial PRIMARY KEY, customer text, product text, category text, amount numeric(10, 2), created_at date ) """, ], ) @task.agent( llm_conn_id="my_claude_conn", system_prompt="あなたはデータエンジニアです。ツールを使ってデータベースを操作してください。", toolsets=[ SQLToolset( db_conn_id="postgres_default", allowed_tables=["orders"], allow_writes=True, ), AgentSkillsToolset( sources=[str(Path(file).parent / "skills")], exclude_tools={"run_skill_script"}, ), ], ) def seed_orders(): return "seed-orders スキルの手順に従って、orders テーブルに初期データを入れてください。" @task.agent( llm_conn_id="my_claude_conn", system_prompt="あなたはデータアナリストです。ツールを使って質問に答え、回答は日本語で書いてください。", toolsets=[ SQLToolset( db_conn_id="postgres_default", allowed_tables=["orders"], ), HookToolset( SlackWebhookHook(slack_webhook_conn_id="slack_webhook_default"), allowed_methods=["send_text"], tool_prefix="slack", ), ], ) def report(question: str): return ( "orders テーブルは、ケーキ屋の検証用に自動生成した注文データです。\n" "customer は顧客、product と category は買ったもの(ケーキ・焼き菓子・ドリンク)です。\n" f"このデータを使って、次の質問に答えてください: {question}\n" "Slack に1回だけ送ってください。送ったあと、送った内容をそのまま答えてください。" ) create_orders >> seed_orders() >> report("カテゴリ別の売上と、売れ筋の商品、売上が特に多かった月を教えてください。") example_agent_decorator() 実行してみると、途中でLLMがSQLを組み立てて考えてくれているログが見れる。 ・・・ 2026-10-25T05:58:42.234507Z [info ] ::group::Tool call: query [airflow.task.operators.airflow.providers.common.ai.decorators.agent._AgentDecoratedOperator] loc=logging.py:64 2026-10-25T05:58:42.243900Z [info ] Running statement: SELECT count(*) AS n, min(created_at) AS min_date, max(created_at) AS max_date, count(DISTINCT customer) AS customers, min(amount) AS min_amt, max(amount) AS max_amt, sum(CASE WHEN created_at BETWEEN DATE '2025-12-20' AND DATE '2025-12-25' THEN 1 ELSE 0 END) AS dec_rush_rows, sum(CASE WHEN amount % 50 <> 0 THEN 1 ELSE 0 END) AS non50_amounts FROM orders, parameters: None [airflow.task.hooks.airflow.providers.postgres.hooks.postgres.PostgresHook] loc=sql.py:896 ・・・ また完了するとDatabaseへデータの挿入が行われ、SlackへSummary Reportされていることが確認できる。 id | customer | product | category | amount | created_at -----+-------------+--------------------+----------+---------+------------ 1 | customer_3 | チョコレートケーキ | ケーキ | 650.00 | 2026-06-23 2 | customer_3 | マドレーヌ | 焼き菓子 | 150.00 | 2025-11-27 3 | customer_3 | 紅茶 | ドリンク | 550.00 | 2026-09-09 4 | customer_1 | コーヒー | ドリンク | 400.00 | 2026-07-23 5 | customer_7 | チーズケーキ | ケーキ | 500.00 | 2026-07-02 6 | customer_1 | ショートケーキ | ケーキ | 650.00 | 2025-12-21 ・・・ LLM Retry Policy と ClassifierRetryPolicy ! Airflow>=3.3.0が必要 Airflow3.3.0からRetry policiesというのができた。これを用いれば、LLMにタスクの失敗時のリトライ判断を委ねることができる。 種類としては、LLMRetryPolicyとClassifierRetryPolicyがサポートされ、いずれも以下のようにタスクのretry_policyに指定して使用する。 snowflake_policy = ClassifierRetryPolicy(・・・) ・・・ snowflake_policy = LLMRetryPolicy(・・・) ・・・ @task(retries=5, retry_policy=snowflake_policy) def query_snowflake(): ・・・ ではLLMRetryPolicyとClassifierRetryPolicyで何が異なるのかというと以下である。 LLMRetryPolicy 責務：モデルがRetryに関連するエラーの分類・動作をすべて決める。 ClassifierRetryPolicy 責務：モデルは分類だけ、動作はコードで定義した表で決める。 snowflake_policy = ClassifierRetryPolicy( ・・・ min_confidence=0.8, # categoriesの挙動を実行を決めるときの分類のmin確信度 categories={ Warehouseが停止したと分類したときの挙動 "warehouse_suspended": ErrorCategory( "The warehouse is suspended and will auto-resume.", delay=timedelta(seconds=30) ), tokenがexpiredしたと分類したときの挙動 "token_expired": ErrorCategory( "A JWT or session token expired; the token rotates on its own.", delay=timedelta(seconds=30) ) ・・・ またいずれもfallback_rulesでモデルが判断(分類)できなかったときのfallbackを設定できる。 実装例.モデルに再実行を委ねてみる rate limitエラーが出た場合と、bad dataエラーが出た場合に、モデルはどのように再実行を行うのかを試してみる。 from datetime import timedelta from airflow.providers.common.ai.policies.retry import LLMRetryPolicy from airflow.providers.common.compat.sdk import dag, task from airflow.sdk.definitions.retry_policy import RetryAction, RetryRule llm_policy = LLMRetryPolicy( llm_conn_id="my_claude_conn", timeout=30.0, fallback_rules=[ RetryRule(exception=ConnectionError, action=RetryAction.RETRY, retry_delay=timedelta(seconds=10)), RetryRule(exception=PermissionError, action=RetryAction.FAIL), ], ) @dag(catchup=False, tags=["sample", "retry_policy", "llm"]) def llm_retry_policy_sample(): @task(retries=3, retry_delay=timedelta(minutes=1), retry_policy=llm_policy) def rate_limited(): # rate limit エラー raise RuntimeError("429 Too Many Requests: Rate limit exceeded. Retry after 60 seconds.") @task(retries=3, retry_delay=timedelta(minutes=1), retry_policy=llm_policy) def bad_data(): # bad data エラー raise ValueError("Column 'user_id' expected type INT but got STRING in row 42.") rate_limited() bad_data() llm_retry_policy_sample() 実行してみると、rate limitエラーの方だけRetryが4回された。 人間としても、bad dataエラーの場合は再実行しても意味がない・rate limitエラーの場合は再実行したら直るかもと思うので、挙動としては正しいであろう。 ちなみに、LLMRetryPolicyにinstructionsが指定されていない場合、DEFAULT_INSTRUCTIONSが参照されるようだった。 そのほかにも そのほかにも以下がサポートされている。 @task.llm_branchを用いてLLM駆動型タスク分岐。 後続にA or Bのタスクがある場合、どちらを実行するかをLLMが決めてくれる。 @task.llm_sqlを用いて自然言語->sqlをbuildするタスクの作成。 sqlglotのAST解析を使って出力を検証している。 @task.llm_schema_compareを用いてDatabaseを横断したスキーマドリフト検出。 詳細は次のページを参照すれば確認できる。 airflow.apache.org どういった活用の仕方がされているか。 Airflow公式ブログ(link]では次のような活用の仕方が紹介がされている。 問い合わせチケットの振り分け（@task.llm_branch） レポートの要約と人による承認（@task.llm_file_analysis + enable_hitl_review=True） エージェントによるDB分析（@task.agent + SQLToolset）

Monty: Run Python, Choose What It Can Access Should AI-written Python get your normal access to files and the network? Pydantic's Monty runs a supported Python subset in a Rust interpreter, with host access supplied explicitly. In our original September test, a calculation returned 385 and a file read was denied. Those were two simple examples, not a security audit. Developers can configure memory, execution-time, and recursion limits. Host functions still need input checks, and Python compatibility matters. Project: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ar] Monty: شغّل Python واختر ما يمكنه الوصول إليه هل ينبغي منح شيفرة Python التي كتبها الذكاء الاصطناعي صلاحياتك المعتادة للوصول إلى الملفات والشبكة؟ يشغّل Monty من Pydantic مجموعة مدعومة من ميزات Python داخل مفسّر مكتوب بلغة Rust، مع منح الوصول إلى النظام المضيف صراحةً. في اختبارنا الأصلي في سبتمبر، أعادت عملية حسابية النتيجة 385، ورُفضت قراءة ملف. كانا مثالين بسيطين، لا تدقيقًا أمنيًا. يمكن للمطوّرين ضبط حدود للذاكرة ووقت التنفيذ والاستدعاء الذاتي. ولا تزال دوال النظام المضيف بحاجة إلى التحقق من المدخلات، كما أن التوافق مع Python مهم. المشروع: pydantic/monty #PydanticMonty #PythonSandbox #شيفرة_مولدة_بالذكاء_الاصطناعي #وكلاء_الذكاء_الاصطناعي #RustLang #HostFunctions #حدود_الموارد #مفتوح_المصدر [bn] Monty: পাইথন রান করুন, বেছে নিন এটি কী কী অ্যাক্সেস করতে পারবে এআই-লিখিত পাইথন কি আপনার ফাইল এবং নেটওয়ার্কে স্বাভাবিক অ্যাক্সেস পাওয়ার সুযোগ দেবে? পাইড্যান্টিকের মন্টি একটি রাস্ট ইন্টারপ্রেটারে সমর্থিত পাইথনের একটি উপসেট চালায়, যেখানে হোস্ট অ্যাক্সেস স্পষ্টভাবে সরবরাহ করা থাকে। আমাদের সেপ্টেম্বরের মূল পরীক্ষায়, একটি গণনার ফলে ৩৮৫ রিটার্ন এসেছিল এবং একটি ফাইল রিড করার অনুমতি প্রত্যাখ্যান করা হয়েছিল। এগুলো ছিল দুটি সাধারণ উদাহরণ, কোনো নিরাপত্তা নিরীক্ষা নয়। ডেভেলপাররা মেমরি, এক্সিকিউশন-টাইম এবং রিকার্সন লিমিট কনফিগার করতে পারেন। হোস্ট ফাংশনগুলোতে এখনও ইনপুট চেকের প্রয়োজন হয় এবং পাইথনের সাথে সামঞ্জস্যতা একটি গুরুত্বপূর্ণ বিষয়। প্রজেক্ট: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [de-DE] Monty: Python ausführen und Zugriffe selbst festlegen Soll von KI geschriebener Python-Code deine üblichen Zugriffsrechte auf Dateien und das Netzwerk erhalten? Monty von Pydantic führt eine unterstützte Teilmenge von Python in einem Rust-Interpreter aus. Zugriff auf das Hostsystem wird ausdrücklich eingeräumt. In unserem ursprünglichen Test im September ergab eine Berechnung 385, und ein Dateizugriff zum Lesen wurde verweigert. Das waren zwei einfache Beispiele, kein Sicherheitsaudit. Entwickler können Grenzen für Speicher, Ausführungszeit und Rekursion konfigurieren. Hostfunktionen brauchen weiterhin Eingabeprüfungen, und die Python-Kompatibilität ist wichtig. Projekt: pydantic/monty #PydanticMonty #PythonSandbox #KIGenerierterCode #KIAgenten #RustLang #HostFunctions #Ressourcenlimits #OpenSource [es] Monty: ejecuta Python y elige a qué puede acceder ¿Debería el código Python escrito por IA tener tu acceso habitual a los archivos y a la red? Monty, de Pydantic, ejecuta un subconjunto compatible de Python en un intérprete escrito en Rust, y el acceso al sistema anfitrión se concede explícitamente. En nuestra prueba original de septiembre, un cálculo devolvió 385 y se denegó una lectura de archivo. Fueron dos ejemplos sencillos, no una auditoría de seguridad. Los desarrolladores pueden configurar límites de memoria, tiempo de ejecución y recursión. Las funciones del sistema anfitrión siguen necesitando validación de entradas, y la compatibilidad con Python importa. Proyecto: pydantic/monty #PydanticMonty #PythonSandbox #CódigoGeneradoPorIA #AgentesIA #RustLang #HostFunctions #LímitesDeRecursos #CódigoAbierto [es-US] Monty: Ejecuta Python, elige a qué puede acceder ¿Debería el código Python escrito por IA tener el mismo acceso que tú a los archivos y la red? Monty de Pydantic ejecuta un subconjunto de Python compatible en un intérprete de Rust, con acceso al host especificado explícitamente. En nuestra prueba original de septiembre, un cálculo devolvió 385 y se denegó la lectura de un archivo. Estos fueron dos ejemplos sencillos, no una auditoría de seguridad. Los desarrolladores pueden configurar límites de memoria, tiempo de ejecución y recursión. Las funciones del host aún requieren comprobaciones de entrada, y la compatibilidad con Python es importante. Proyecto: pydantic/monty #PydanticMonty #PythonSandbox #CódigoEscritoPorIA #AgentesIA #RustLang #FuncionesDelHost #LímitesDeRecursos #CódigoAbierto [fr] Monty : exécutez Python, choisissez ses accès Le code Python écrit par une IA doit-il avoir vos accès habituels aux fichiers et au réseau ? Monty, de Pydantic, exécute un sous-ensemble pris en charge de Python dans un interpréteur écrit en Rust, avec des accès au système hôte accordés explicitement. Lors de notre test initial de septembre, un calcul a renvoyé 385 et une lecture de fichier a été refusée. Il s'agissait de deux exemples simples, pas d'un audit de sécurité. Les développeurs peuvent configurer des limites de mémoire, de durée d'exécution et de récursion. Les fonctions du système hôte nécessitent toujours une validation des entrées, et la compatibilité Python compte. Projet: pydantic/monty #PydanticMonty #PythonSandbox #CodeGénéréParIA #AgentsIA #RustLang #HostFunctions #LimitesDeRessources #OpenSource [fr-FR] Monty : Exécuter Python, choisir ses accès L'IA utilisant du Python devrait-elle bénéficier de votre accès habituel aux fichiers et au réseau ? Monty, de Pydantic, exécute un sous-ensemble de Python pris en charge dans un interpréteur Rust, avec un accès hôte explicitement fourni. Lors de notre test initial en septembre, un calcul a renvoyé 385 et la lecture d'un fichier a été refusée. Il s'agissait de deux exemples simples, et non d'un audit de sécurité. Les développeurs peuvent configurer les limites de mémoire, de temps d'exécution et de récursion. Les fonctions hôtes nécessitent toujours des vérifications d'entrée, et la compatibilité avec Python reste essentielle. Projet : pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [hi] Monty: पायथन चलाएँ, तय करें कि वह क्या एक्सेस कर सकता है क्या AI द्वारा लिखित Python को फ़ाइलों और नेटवर्क तक सामान्य पहुँच मिलनी चाहिए? Pydantic का Monty, Rust इंटरप्रेटर में समर्थित Python कोड के एक उपसमूह को चलाता है, जिसमें होस्ट एक्सेस स्पष्ट रूप से प्रदान किया जाता है। सितंबर में किए गए हमारे मूल परीक्षण में, एक गणना में 385 मान प्राप्त हुआ और फ़ाइल पढ़ने से इनकार कर दिया गया। ये दो सरल उदाहरण थे, सुरक्षा ऑडिट नहीं। डेवलपर मेमोरी, निष्पादन समय और रिकर्सन सीमाएँ कॉन्फ़िगर कर सकते हैं। होस्ट फ़ंक्शंस के लिए अभी भी इनपुट जाँच की आवश्यकता है, और Python संगतता महत्वपूर्ण है। प्रोजेक्ट: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [id] Monty: Jalankan Python, Pilih Apa yang Bisa Diaksesnya Apakah kode Python yang ditulis AI seharusnya mendapatkan akses normal ke file dan jaringan? Monty dari Pydantic menjalankan subset Python yang didukung dalam interpreter Rust, dengan akses host yang diberikan secara eksplisit. Dalam pengujian awal kami pada bulan September, sebuah perhitungan mengembalikan nilai 385 dan pembacaan file ditolak. Itu adalah dua contoh sederhana, bukan audit keamanan. Pengembang dapat mengkonfigurasi batasan memori, waktu eksekusi, dan rekursi. Fungsi host masih memerlukan pemeriksaan input, dan kompatibilitas Python penting. Proyek: pydantic/monty #PydanticMonty #PythonSandbox #KodeDitulisAI #AgenAI #BahasaRust #FungsiHost #BatasSumberDaya #SumberTerbuka [it] Monty: esegui Python, scegli cosa può accedere Il codice Python scritto dall'IA dovrebbe avere il normale accesso ai file e alla rete? Monty di Pydantic esegue un sottoinsieme di Python supportato in un interprete Rust, con accesso all'host fornito esplicitamente. Nel nostro test originale di settembre, un calcolo ha restituito 385 e la lettura di un file è stata negata. Questi erano due semplici esempi, non un audit di sicurezza. Gli sviluppatori possono configurare limiti di memoria, tempo di esecuzione e ricorsione. Le funzioni host necessitano comunque di controlli di input e la compatibilità con Python è importante. Progetto: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [iw] Monty: הרצת Python, בבחירת הרשאות הגישה האם פייתון שנכתב על ידי בינה מלאכותית צריך לקבל את הגישה הרגילה שלך לקבצים ולרשת? Monty של Pydantic מריץ תת-קבוצה נתמכת של פייתון במפרש Rust, כאשר גישת המארח מסופקת במפורש. במבחן המקורי שלנו מספטמבר, חישוב החזיר 385 וקריאת קובץ נדחתה. אלו היו שתי דוגמאות פשוטות, לא ביקורת אבטחה. מפתחים יכולים להגדיר מגבלות זיכרון, זמן ביצוע ורקורסיה. פונקציות מארח עדיין זקוקות לבדיקות קלט, ותאימות פייתון חשובה. פרויקט: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ja] Monty：Pythonを実行し、アクセス権を制御する AIが記述したPythonコードに、通常のファイルアクセスやネットワークアクセス権限を与えるべきでしょうか？PydanticのMontyは、サポートされているPythonサブセットをRustインタープリタ上で実行し、ホストアクセス権限を明示的に付与します。 9月に実施した最初のテストでは、計算結果が385となり、ファイル読み取りが拒否されました。これらは単純な例であり、セキュリティ監査ではありません。開発者は、メモリ、実行時間、再帰回数の制限を設定できます。ホスト関数には入力チェックが必要であり、Pythonとの互換性も重要です。 プロジェクト：pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ko] Monty: 파이썬 실행 및 접근 권한 제어 AI가 작성한 Python 코드가 파일과 네트워크에 정상적으로 접근하는 것이 허용되어야 할까요? Pydantic의 Monty는 지원되는 Python 기능들을 Rust 인터프리터에서 실행하며, 호스트 접근 권한은 명시적으로 제공됩니다. 지난 9월에 진행된 초기 테스트에서는 계산 결과값이 385였고 파일 읽기 요청은 거부되었습니다. 이는 단순한 예시일 뿐, 실제 보안 감사 상황은 아닙니다. 개발자는 메모리, 실행 시간, 재귀 호출 횟수 제한을 설정할 수 있습니다. 호스트 함수는 여전히 입력값 검사를 수행해야 하며, Python과의 호환성도 중요합니다. 프로젝트: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [ml] Monty: പൈത്തൺ പ്രവർത്തിപ്പിക്കൂ, അത് എന്തിനൊക്കെ ആക്സസ് ചെയ്യണമെന്ന് തിരഞ്ഞെടുക്കൂ AI-ൽ എഴുതിയ പൈത്തണിന് ഫയലുകളിലേക്കും നെറ്റ്‌വർക്കിലേക്കും നിങ്ങളുടെ സാധാരണ ആക്‌സസ് ലഭിക്കണമോ? പൈഡാന്റിക്‌സിന്റെ മോണ്ടി, ഒരു റസ്റ്റ് ഇന്റർപ്രെറ്ററിൽ പിന്തുണയ്ക്കുന്ന ഒരു പൈത്തൺ ഉപസെറ്റ് പ്രവർത്തിപ്പിക്കുന്നു, ഹോസ്റ്റ് ആക്‌സസ് വ്യക്തമായി നൽകിയിട്ടുണ്ട്. ഞങ്ങളുടെ യഥാർത്ഥ സെപ്റ്റംബർ പരിശോധനയിൽ, ഒരു കണക്കുകൂട്ടൽ 385 നൽകി, ഒരു ഫയൽ റീഡ് നിരസിച്ചു. അവ രണ്ട് ലളിതമായ ഉദാഹരണങ്ങളായിരുന്നു, ഒരു സുരക്ഷാ ഓഡിറ്റല്ല. ഡെവലപ്പർമാർക്ക് മെമ്മറി, എക്സിക്യൂഷൻ-ടൈം, ആവർത്തന പരിധികൾ എന്നിവ കോൺഫിഗർ ചെയ്യാൻ കഴിയും. ഹോസ്റ്റ് ഫംഗ്ഷനുകൾക്ക് ഇപ്പോഴും ഇൻപുട്ട് പരിശോധനകൾ ആവശ്യമാണ്, കൂടാതെ പൈത്തൺ അനുയോജ്യതയും പ്രധാനമാണ്. പ്രോജക്റ്റ്: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [nl-NL] Monty: Python uitvoeren, kies waartoe het toegang heeft Zou door AI geschreven Python-code toegang moeten krijgen tot je normale bestanden en het netwerk? Pydantic's Monty voert een ondersteunde subset van Python uit in een Rust-interpreter, waarbij expliciet toegang tot de host wordt verleend. In onze oorspronkelijke test in september gaf een berekening een 385-foutcode terug en werd een bestandsleesbewerking geweigerd. Dit waren twee simpele voorbeelden, geen beveiligingsaudit. Ontwikkelaars kunnen geheugen-, uitvoerings- en recursielimieten configureren. Hostfuncties vereisen nog steeds inputcontroles en Python-compatibiliteit is belangrijk. Project: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [pa] Monty: ਪਾਈਥਨ ਚਲਾਓ, ਇਹ ਕੀ ਐਕਸੈਸ ਕਰ ਸਕਦਾ ਹੈ ਇਹ ਚੁਣੋ ਕੀ AI-ਲਿਖੇ Python ਨੂੰ ਫਾਈਲਾਂ ਅਤੇ ਨੈੱਟਵਰਕ ਤੱਕ ਤੁਹਾਡੀ ਆਮ ਪਹੁੰਚ ਮਿਲਣੀ ਚਾਹੀਦੀ ਹੈ? Pydantic ਦਾ Monty ਇੱਕ Rust ਇੰਟਰਪ੍ਰੇਟਰ ਵਿੱਚ ਇੱਕ ਸਮਰਥਿਤ Python ਸਬਸੈੱਟ ਚਲਾਉਂਦਾ ਹੈ, ਜਿਸ ਵਿੱਚ ਹੋਸਟ ਪਹੁੰਚ ਸਪੱਸ਼ਟ ਤੌਰ 'ਤੇ ਸਪਲਾਈ ਕੀਤੀ ਜਾਂਦੀ ਹੈ। ਸਾਡੇ ਅਸਲ ਸਤੰਬਰ ਟੈਸਟ ਵਿੱਚ, ਇੱਕ ਗਣਨਾ 385 ਵਾਪਸ ਆਈ ਅਤੇ ਇੱਕ ਫਾਈਲ ਰੀਡ ਨੂੰ ਇਨਕਾਰ ਕਰ ਦਿੱਤਾ ਗਿਆ। ਉਹ ਦੋ ਸਧਾਰਨ ਉਦਾਹਰਣਾਂ ਸਨ, ਸੁਰੱਖਿਆ ਆਡਿਟ ਨਹੀਂ। ਡਿਵੈਲਪਰ ਮੈਮੋਰੀ, ਐਗਜ਼ੀਕਿਊਸ਼ਨ-ਟਾਈਮ, ਅਤੇ ਰਿਕਰਜ਼ਨ ਸੀਮਾਵਾਂ ਨੂੰ ਕੌਂਫਿਗਰ ਕਰ ਸਕਦੇ ਹਨ। ਹੋਸਟ ਫੰਕਸ਼ਨਾਂ ਨੂੰ ਅਜੇ ਵੀ ਇਨਪੁਟ ਜਾਂਚਾਂ ਦੀ ਲੋੜ ਹੁੰਦੀ ਹੈ, ਅਤੇ Python ਅਨੁਕੂਲਤਾ ਮਾਇਨੇ ਰੱਖਦੀ ਹੈ। ਪ੍ਰੋਜੈਕਟ: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [pl] Monty: Uruchamiaj Pythona, decyduj do czego ma dostęp Czy Python napisany przez sztuczną inteligencję powinien uzyskać normalny dostęp do plików i sieci? Monty firmy Pydantic uruchamia obsługiwany podzbiór Pythona w interpreterze Rusta, z jawnie podanym dostępem do hosta. W naszym oryginalnym teście z września obliczenia zwróciły 385, a odczyt pliku został odrzucony. To były dwa proste przykłady, a nie audyt bezpieczeństwa. Programiści mogą konfigurować limity pamięci, czasu wykonywania i rekurencji. Funkcje hosta nadal wymagają kontroli danych wejściowych, a zgodność z Pythonem ma znaczenie. Projekt: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [pt-BR] Monty: execute Python e escolha o que ele pode acessar O código Python escrito por IA deve ter seu acesso habitual a arquivos e à rede? O Monty, da Pydantic, executa um subconjunto compatível de Python em um interpretador escrito em Rust, com acesso ao sistema hospedeiro concedido explicitamente. No nosso teste original de setembro, um cálculo retornou 385 e a leitura de um arquivo foi negada. Foram dois exemplos simples, não uma auditoria de segurança. Desenvolvedores podem configurar limites de memória, tempo de execução e recursão. As funções do sistema hospedeiro ainda precisam de validação das entradas, e a compatibilidade com Python importa. Projeto: pydantic/monty #PydanticMonty #PythonSandbox #CódigoGeradoPorIA #AgentesDeIA #RustLang #HostFunctions #LimitesDeRecursos #CódigoAberto [ru] Monty: запускайте Python и выбирайте, к чему дать доступ Стоит ли давать Python-коду, написанному ИИ, ваш обычный доступ к файлам и сети? Monty от Pydantic выполняет поддерживаемое подмножество Python в интерпретаторе на Rust, а доступ к хост-системе предоставляется явно. В нашем первоначальном сентябрьском тесте вычисление вернуло 385, а чтение файла было запрещено. Это были два простых примера, а не аудит безопасности. Разработчики могут настраивать ограничения памяти, времени выполнения и рекурсии. Функциям хост-системы по-прежнему нужна проверка входных данных, а совместимость с Python имеет значение. Проект: pydantic/monty #PydanticMonty #PythonSandbox #КодОтИИ #АгентыИИ #RustLang #HostFunctions #ОграниченияРесурсов #OpenSource [ta] Monty: பைத்தானை இயக்குங்கள், அது எதை அணுகலாம் என்பதை நீங்களே தீர்மானியுங்கள் செயற்கை நுண்ணறிவால் எழுதப்பட்ட பைத்தானுக்கு, கோப்புகள் மற்றும் நெட்வொர்க்கிற்கான உங்கள் இயல்பான அணுகல் கிடைக்க வேண்டுமா? பைடான்டிக்கின் மான்டி, ஆதரிக்கப்படும் பைத்தானின் ஒரு துணைத் தொகுப்பை ரஸ்ட் இன்டர்பிரெட்டரில் இயக்குகிறது, இதில் ஹோஸ்ட் அணுகல் வெளிப்படையாக வழங்கப்படுகிறது. எங்களின் அசல் செப்டம்பர் சோதனையில், ஒரு கணக்கீடு 385 என்ற மதிப்பைக் காட்டியது மற்றும் ஒரு கோப்பு வாசிப்பு மறுக்கப்பட்டது. அவை இரண்டு எளிய எடுத்துக்காட்டுகள், ஒரு பாதுகாப்புத் தணிக்கை அல்ல. டெவலப்பர்கள் நினைவகம், இயக்க நேரம் மற்றும் மீள்சுழற்சி வரம்புகளை உள்ளமைக்க முடியும். ஹோஸ்ட் செயல்பாடுகளுக்கு இன்னும் உள்ளீட்டுச் சோதனைகள் தேவை, மேலும் பைத்தான் இணக்கத்தன்மை முக்கியமானது. திட்டம்: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [te] Monty: పైథాన్ రన్ చేయండి, దేనికి అనుమతి ఉండాలో మీరే నిర్ణయించుకోండి AI-రచించిన పైథాన్, ఫైల్స్ మరియు నెట్‌వర్క్‌కు మీ సాధారణ యాక్సెస్‌ను అందించాలా? పైడాంటిక్ వారి మాంటీ, హోస్ట్ యాక్సెస్‌ను స్పష్టంగా అందిస్తూ, సపోర్ట్ ఉన్న పైథాన్ సబ్‌సెట్‌ను రస్ట్ ఇంటర్‌ప్రెటర్‌లో నడుపుతుంది. మా అసలు సెప్టెంబర్ పరీక్షలో, ఒక గణన 385ను తిరిగి ఇచ్చింది మరియు ఒక ఫైల్ రీడ్ నిరాకరించబడింది. అవి రెండు సాధారణ ఉదాహరణలు మాత్రమే, భద్రతా ఆడిట్ కాదు. డెవలపర్లు మెమరీ, ఎగ్జిక్యూషన్-టైమ్, మరియు రికర్షన్ పరిమితులను కాన్ఫిగర్ చేయవచ్చు. హోస్ట్ ఫంక్షన్లకు ఇప్పటికీ ఇన్‌పుట్ తనిఖీలు అవసరం, మరియు పైథాన్ అనుకూలత కూడా ముఖ్యమైనదే. ప్రాజెక్ట్: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource [uk] Monty: запускайте Python, обирайте рівень доступу Чи повинен Python, написаний штучним інтелектом, отримати ваш звичайний доступ до файлів та мережі? Pydantic Monty запускає підтримувану підмножину Python в інтерпретаторі Rust, з явно заданим доступом до хоста. У нашому початковому вересневому тесті обчислення повернуло 385, а читання файлу було відмовлено. Це були два простих приклади, а не аудит безпеки. Розробники можуть налаштовувати обмеження пам'яті, часу виконання та рекурсії. Функції хоста все ще потребують перевірки вхідних даних, а сумісність з Python має значення. Проєкт: pydantic/monty #PydanticMonty #PythonSandbox #AIWrittenCode #AIAgents #RustLang #HostFunctions #ResourceLimits #OpenSource

Why no Python configuration library covers everything Pick any popular Python configuration library and you'll find that it does one or two things very well and quietly ignores the rest. That's not a flaw in the libraries; they're built for different jobs. The trouble starts when your job doesn't match any of them. I've been writing Python since 2017, and in that time I've worked with configuration in every form: INI files in legacy projects, environment variables in Docker containers, YAML with templates in Helm, pydantic models in fresh services, Vault and Consul in bigger infrastructure. This is the second article in a series. The first one traced how the industry arrived at modern approaches to configuration management, and ended with seven requirements for a production-grade config tool: many sources, controlled merging, type safety, value validation, clear errors, secrets at the schema level, and debugging. Here I go through four notable tools: python-decouple, Dynaconf, Hydra, and pydantic-settings. I'll check how each one measures up against those seven requirements, then pull everything into one view: who covers what, and where the tools have an obvious hole. TL;DR - python-decouple is fine for scripts; Dynaconf wins on sources but has no schema; Hydra is built for ML experiments; pydantic-settings is the best default if Pydantic is already in your project. - Type safety and validation are well covered (pydantic-settings), and so is source variety (Dynaconf). - Nobody solves controlled merging, error coordinates (file and line), or source auditing out of the box. - Those gaps are what pushed me to write my own library, which is the subject of Part 3. python-decouple python-decouple solves a narrow problem: it reads specific setting values from external sources. It's essentially one function, config(), that knows three sources (.env, .ini, environment variables) and can cast types: from decouple import config DEBUG = config("DEBUG", default=False, cast=bool) DATABASE_URL = config("DATABASE_URL") PORT = config("PORT", cast=int) Source lookup is transparent: the library first looks for settings.ini, then .env, then falls back to os.environ. That's handy when you already have a legacy .ini from an old project and want to migrate to .env gradually instead of rewriting everything at once. Through cast you can pass any converter function: int, float, bool, or your own (cast=lambda v: v.split(",") for lists). For the common list case there's a ready-made Csv() helper, and bool understands "yes"/"no", "1"/"0", and "true"/"false" out of the box. That's where the list of sources ends: no YAML, no TOML, no Docker secrets. Value validation can formally be bolted on through the same cast: a converter can not only coerce a type but also check that a port is in 1-65535 and a URL starts with http. But that's manual work for each field, not validation as part of a single schema. Historically, python-decouple grew up as a replacement for os.environ.get() in Django projects. That's still its main audience: Django tutorials happily recommend it, and for a project with 5-10 settings it's enough. But as soon as the config grows beyond that, the limitations show up all at once. The schema isn't declared in one place; config() calls are scattered across imports: # settings/database.py DATABASE_URL = config("DATABASE_URL") # settings/cache.py REDIS_URL = config("REDIS_URL", default="redis://localhost:6379/0") # settings/auth.py JWT_SECRET = config("JWT_SECRET") JWT_EXPIRES = config("JWT_EXPIRES", default=3600, cast=int) The only way to find the full list of variables the app expects is grep config( across the whole repository. There's no schema-as-contract in one place, and therefore no type safety: the IDE won't suggest a field, mypy won't catch a typo, and the mistake surfaces at runtime as an AttributeError in production, which is exactly what a startup check is meant to avoid. There are no nested structures at all: for database.primary.host you have to write out a flat DATABASE_PRIMARY_HOST and assemble the structure by hand. Merging several sources isn't supported either: the library reads one source of truth. python-decouple can't override values, for example set defaults in .ini and then overlay them from .env. So conflict-resolution strategies (last wins, first wins, fail with an error) aren't even a topic here. The rest of the checklist is missing too. A missing variable raises UndefinedValueError with the key name but without file and line. A secret like JWT_SECRET stays a plain string without a SecretStr-like type and happily shows up in repr(). And there's no standard way to find out where a value came from: .ini, .env, or the environment. I keep python-decouple in mind for one-off scripts and small utilities where the config is five variables and a single .env file. Once a project grows nested settings or environments more complicated than "local/prod," you usually end up migrating to something else. That's fine: python-decouple honestly does what it promises and doesn't claim more. Comparing it with the other participants only makes sense within its own genre: simple scripts. Dynaconf Dynaconf bets on flexibility and runtime configuration. It reads YAML, TOML, JSON, INI, .env, and Python files, connects Vault and Redis via plugins, and supports dynamic reloading. In terms of sources it's the richest participant in this review: most formats work out of the box, with Vault and Redis via plugins, so "many sources" is covered with room to spare. The input is a list of files, and the output is an object you can ask for anything: from dynaconf import Dynaconf settings = Dynaconf(settings_files=["config.toml"]) print(settings.HOST) print(settings.PORT) Here's where a philosophical split starts. Dynaconf deliberately doesn't require you to declare a structure. settings.HOSTT (with a typo) won't fail; it just returns nothing. The IDE can't help, because there's nothing to suggest: the list of fields isn't recorded anywhere. mypy is powerless for the same reason. The schema doesn't live in code, so there's no contract checked at startup. The configuration is valid exactly until someone touches a field. For its class of tasks this is a feature, not a bug. If you're building an admin panel where an admin can add arbitrary settings through a UI, or a platform where plugins extend the config, having no schema is appropriate. But if you're writing an ordinary service with a fixed, known-in-advance set of settings, the absence of a schema turns into a permanent source of "wait, why is it None?" Validation exists in Dynaconf, but as a separate annex to the building: from dynaconf import Dynaconf, Validator settings = Dynaconf( settings_files=["config.toml"], validators=[ Validator("PORT", gte=1, lte=65535), Validator("HOST", must_exist=True), ], ) settings.validators.validate() It can check ranges and required fields, but it lives outside the schema. A validator refers to a field by string. Add a new field, forget its validator, and nobody reminds you. This isn't an implementation flaw; it's the price of working without a schema: with no structure, validation can't be a part of it. The same pattern shows up in merging: settings are inherited via special keys in the configuration files themselves: [databases] dynaconf_merge = true port = 5433 Infrastructure logic leaks into the data. Everyone who edits the config has to know about dynaconf_merge, or they'll accidentally wipe a nested section. Worse, the merge strategy is set by the data rather than the code: to extend a list instead of replacing it, you have to write the right key into the file itself. And the familiar "on conflict, fail with an error" rule doesn't exist at all. The remaining three criteria fall out differently. Source auditing is a strength: dynaconf list -o or inspecting the object shows which file and layer a value came from, so you can avoid detective work in production. Secrets are more modest: there's no dedicated type like SecretStr that would mask the value in repr(), because there's no schema to put it in; sensitive fields are protected at the source level (the same Vault), not the model. Errors inherit the main problem of the schemaless approach: a missing field isn't a crash with file and line, it's a quiet None that will blow up somewhere further down the code. When Dynaconf is justified: you need remote sources (Vault, Redis) out of the box, Jinja templates in values, environment switching via [development]/[production] sections in one file, a plugin ecosystem, and CLI utilities. That's serious infrastructure, and building it from scratch takes a long time. When it isn't: you want the config to be a typed contract, with the IDE and mypy catching typos before launch. Hydra Hydra from Meta Research is a framework. Unlike an ordinary library that we call from our code, Hydra works the other way around: it takes control. Hydra wraps the application entry point and runs our code inside its own lifecycle. For an ML experiment that's convenient: the @hydra.main decorator solves a pile of small tasks for us: @hydra.main(config_path="conf", config_name="config") def app(cfg: DictConfig) -> None: print(cfg.database.host) Hydra will create an outputs/YYYY-MM-DD/HH-MM-SS/ directory, redirect logs there, change the process working directory, stitch configs from several files through the defaults list, and pass CLI overrides. Hydra's merging is well thought out: the defaults list composes configs predictably and command-line overrides layer on top. That said, all of this machinery is built for iterating over experiments, not for merging "defaults + local .env + secrets." For running 50 experiments with different hyperparameters, it's exactly what you need. For a web service whose entry point is uvicorn and whose working directory is where templates and static files live, Hydra's design gets in the way. Relative paths break, logging configuration gets overwritten, and an outputs/ directory appears in the file system for every run. Hydra reads only YAML. Environment variables are available through the OmegaConf resolver ${oc.env:VAR}, but .env, TOML, JSON, or INI don't work without third-party plugins. So "many sources" is half covered: YAML and environment variables right away, other formats through plugins. The returned object is an OmegaConf.DictConfig, a special container that looks like a dataclass but isn't one. Autocomplete works in a limited way and mypy partially. Only basic types are supported: primitives, enum, and containers. Union, datetime, IPv4Address, and SecretStr are not. Validation is only type checking through OmegaConf: # no value validation @dataclass class Config: port: int = 8080 # any int is accepted, even -1 cfg = OmegaConf.structured(Config) Type safety is half-baked (mypy and autocomplete work partially), and value validation like "port 1-65535" or "URL starts with http" doesn't exist as a class: only the type is checked, not whether the value makes sense. The secrets criterion lands here too: since SecretStr isn't among the supported types, you can't mark a field as sensitive in the schema, and a password stays an ordinary string. One more thing worth keeping in mind when choosing: Hydra is a living project, but its design is still geared toward ML experiments. Config composition, run output directories, command-line overrides, working directory management: all of it is convenient for hyperparameter sweeps and too heavy for a web service. It's not about maintenance; it's that the framework imposes its own way of life on your application's entry point. Debugging and errors are in order with Hydra, a legacy of its ML nature. Source auditing is strong: --cfg job prints the final config, and --info shows which files and overrides it was assembled from, so "where did the value come from" is answered by design. OmegaConf errors are also meaningful: on access to a nonexistent key or a type mismatch you get a message with a dotted path to the field (database.port) rather than a bare stack trace. It doesn't reach coordinates in the input file, though (which YAML, which line): the path points inside the config, not to the source. Hydra is ideal for ML experiments with hyperparameter sweeps and object instantiation from config (hydra.utils.instantiate is a whole separate feature). For application configuration (web, CLI, daemon), it's not what it was designed for. pydantic-settings pydantic-settings is, as far as I know, the only truly type-safe configuration library in Python with mass adoption. If Pydantic is already in your project, pydantic-settings plugs in naturally: from pydantic_settings import BaseSettings class Config(BaseSettings): host: str port: int debug: bool = False Types are checked, the IDE suggests fields, and Pydantic validators work out of the box. For the typical scenario of "read environment variables plus an optional .env file," it's the best choice in the ecosystem, and there's nothing to discuss. Strengths others don't have. Before getting to the limitations, it's worth saying: pydantic-settings has a set of capabilities its competitors either lack or can only get with considerable effort. - The built-in CLI (CliSettingsSource) turns a Settings model into a CLI application, with subcommands, async handlers, and automatic help. That's convenient when a tool must work both as a service and as a CLI utility (migrations, backups, one-off operations). - Reading from pyproject.toml via PyprojectTomlConfigSettingsSource is the natural path for libraries and CLI tools that want to keep their settings in the shared project file instead of adding another one. - Nested secrets directories (NestedSecretsSettingsSource) handle Docker-secrets-style files with arbitrary nesting. - Tight integration with FastAPI, SQLModel, and LangChain: config can be passed as a dependency, Pydantic validators can be reused for request/response models, and computed_field can be shared. - Validators (field_validator, model_validator with mode="before"/mode="after", computed_field) cover practically any validation scenario you might need. from pydantic import field_validator, model_validator from pydantic_settings import BaseSettings class Config(BaseSettings): host: str port: int use_ssl: bool = False cert_path: str | None = None @field_validator("port") @classmethod def port_in_range(cls, v: int) -> int: if not (1 <= v <= 65535): raise ValueError("port must be between 1 and 65535") return v @model_validator(mode="after") def ssl_requires_cert(self) -> "Config": if self.use_ssl and not self.cert_path: raise ValueError("cert_path is required when use_ssl is True") return self Limitations. pydantic-settings v2 added built-in JsonConfigSettingsSource, YamlConfigSettingsSource, and TomlConfigSettingsSource. But each has to be wired up explicitly through settings_customise_sources: class Settings(BaseSettings): model_config = SettingsConfigDict(toml_file="config.toml") @classmethod def settings_customise_sources(cls, settings_cls, **kwargs): return ( kwargs["init_settings"], kwargs["env_settings"], TomlConfigSettingsSource(settings_cls), ) - INI, JSON5, YAML 1.1, and TOML 1.1 aren't supported. There's no skip_if_broken for missing files: if a file is specified but doesn't exist, you have to catch the exception and decide by hand. There are no field_groups for the case when a group of fields must come entirely from one source. There's no ENV expansion (${VAR:-default}) in config files, so all substitutions have to happen before loading or on top of it. - Source merging uses a fixed priority: init → environment variables → dotenv → secrets → defaults. No strategies, no per-field rules, no conflict control. If you want "merge the allowed_hosts list, but replace the plain strings," that's not supported. Implementing any such scenario requires a custom SettingsSource class overriding _extract_field_info and _field_is_complex. It works, but it's not an out-of-the-box scenario. - Custom types require implementing __get_pydantic_core_schema__. For most cases this is solved through Annotated[YourType, BeforeValidator(parser)] and is simpler than it looks, but it isn't zero code. Mixing BaseSettings with other base classes (for example, mixins) sometimes causes metaclass conflicts: Pydantic replaces __init_subclass__ and does other intrusive things at runtime. Performance: a myth for static config, a reality for dynamic config. You sometimes hear the argument "pydantic is slower than dataclasses, pick dataclasses." For configuration it's a shallow argument. Microbenchmarks do show an order-of-magnitude difference: creating a simple Pydantic model costs about 1.5 µs, a dataclass around 200-300 ns (see the benchmarks linked below). But an application config is loaded once at startup, and that difference vanishes next to opening the file, parsing YAML/TOML, and reading environment variables. If you have a web service that lives for weeks, you can ignore the startup overhead. The picture changes in three scenarios: - Cold start of short-lived processes. AWS Lambda, Cloud Functions, CLI utilities, periodic tasks in Kubernetes: anywhere a process starts fresh for a short job. Here the time to useful work is the sum of importing dependencies, initializing the logger, and loading config. On a Lambda cold start, import pydantic alone costs tens or hundreds of milliseconds depending on the Python and pydantic versions (import time discussion in pydantic). You can easily check the order of magnitude locally with python -X importtime -c "import pydantic", and it's already noticeable in an SLA. For a 20-field config, the difference between BaseSettings and @dataclass is a few milliseconds, which isn't critical. What matters is the very fact of dragging Pydantic into your dependencies if the project doesn't need it anywhere else. - Hot reload and dynamic updates. Modern applications increasingly don't restart to change settings. Pool size, feature flags, log levels, request limits: you want to turn them live. If the config is re-read every 30 seconds, and at peak we do that in 100 workers in parallel, the accumulated CPU load is visible on graphs. Pydantic validates data from scratch on every update (it has no validation caching between calls); a dataclass does so only if you put validation in __post_init__, and then we control it. - Secret rotation through Vault and the like. This is a special case of the previous point, with its own specifics. If the application subscribes to changes in Vault and reacts to rotation, secrets get reloaded regularly: every few hours or even minutes, depending on policy. There's also the network call to Vault, whose latency is an order of magnitude bigger than any validation, so the difference between Pydantic and dataclass fades again, but pydantic-settings' overhead of re-creating models at refresh time stays non-zero. Performance is not the main reason to choose or reject pydantic-settings. It has a powerful validation system, a broad ecosystem, and excellent FastAPI integration, all of which are serious pluses. But if we're building a long-lived service with dynamic configuration and want fine control over reload cost, a standard dataclass gives more control, because we decide what is validated and when, and don't pay for reprocessing when it can be avoided. Errors. Pydantic's messages are informative in content: validation error for Settings port Input should be a valid integer, unable to parse string as an integer [type=int_parsing, input_value='abc', input_type=str] But when there are several sources, the message doesn't say which file holds the invalid value. If defaults.yaml, override.yaml, and environment variables all set port, you hunt for the culprit by hand. In sum: pydantic-settings is a solid default when you have one or two sources and Pydantic is already in the project. If you run into merging several files with per-field rules, debugging "where did this value come from," or errors like "valid integer, unable to parse 'abc' — but in which of the three files is it?", that's a signal you need a different tool. All the libraries through the lens of the seven requirements Lay the market out against the seven criteria and the picture is clear at once: some requirements are covered well, some only partially, and a few barely at all. Here is how each requirement plays out. Many sources. The point of the requirement is to read different sources out of the box without hooking up a separate adapter per format: YAML for defaults, environment variables for secrets, .env for local tweaks. The clear leader is Dynaconf. It reads YAML, TOML, JSON, INI, .env, and Python modules out of the box, and Vault, Redis, and AWS Secrets Manager connect via plugins. pydantic-settings supports environment variables, .env, JSON, YAML, and TOML natively, but each additional source must be explicitly wired through settings_customise_sources. Hydra only works with YAML; other formats go through third-party plugins. python-decouple is limited to .env, .ini, and environment variables, and makes no claim to universality here. Controlled merging. It's important to control the merge: choose a strategy for conflicts (last wins / first wins / fail with an error) and set it per field. This is a systemic hole in the market. pydantic-settings gives a rigid priority of init > env > dotenv > secrets > defaults with no way to change the strategy or define rules for individual fields. Dynaconf supports per-field merge via the dynaconf_merge = true key, but it's written in the configuration files themselves, and everyone editing them must know about it. Hydra can stitch configs through the defaults list, which is powerful for ML but has no notion of "this policy for this field." python-decouple doesn't support merging at all. Type safety. The point is to describe the config structure right in code, so the IDE suggests fields, mypy catches typos, and errors appear at startup rather than at runtime. pydantic-settings covers this fully: the model is described in code, the IDE suggests fields, mypy catches typos. Hydra covers it partially, via structured configs in OmegaConf: fields are checked, but DictConfig still isn't a dataclass, and some tools work worse with it. Dynaconf and python-decouple provide no type safety by design: you access a field by string. Value validation. Checking the type is necessary but not enough: int will accept the port -1, and a string will accept a non-URL. The criterion is about checking the values themselves (ranges, formats, business rules) and about doing so as part of the schema rather than as a separate system you can forget to attach to a new field. pydantic-settings is the leader: field_validator, model_validator, Annotated validators, and a ready ecosystem of types (PositiveInt, HttpUrl, EmailStr). Dynaconf has a separate Validator(...) system bound to string field names: it works, but is physically detached from the schema. Hydra is limited to type checking through OmegaConf; ranges, regexes, and business rules you write by hand. python-decouple gives you cast= for type coercion and your own code for value checks. Clear errors. A good error message answers two questions: what's wrong and where to fix it. The first is human-readable text instead of a parser stack trace; the second is coordinates in the source. As it turns out, everyone handles the first, and nobody handles the second. Pydantic gives an informative message, Input should be a valid integer; Dynaconf and Hydra raise standard exceptions with a type and a value. But none of them has coordinates in the input file: which of three sources brought the garbage value, in which file and on which line, the user finds out by hand. Secrets protection. The criterion is about marking a password or token right in the model with a special type so it doesn't leak in plain text through repr(), logs, or an error trace. The most advanced option today is SecretStr in pydantic-settings: the field hides its value in repr and logs. That covers the basic scenario, but requires the developer to mark the field explicitly. Forget SecretStr and the value flies into the log like an ordinary string. There's no automatic triggering "by field name" or "by value shape." Dynaconf, Hydra, and python-decouple have no masking out of the box at all. Debugging. This isn't about an invalid config: the value is fine by type and range, it's just not what you expected. The criterion is about provenance: the tool should tell you where port=9090 came from: a file, an environment variable, or a default. Without such auditing you're left with a detective story of print(config) and image rebuilds. This is the least covered of the seven. Dynaconf has inspect_settings(), the closest to "where did the value come from," but as a free-form dictionary rather than a structured report. Hydra writes everything applied into outputs/, which is useful for experiment reproducibility but not for answering "why is port=9090 in prod." pydantic-settings and python-decouple give no debugging information: you get an object, and then it's grep through the code. Boiled down to a line: the market covers type safety and validation (pydantic-settings) and source universality (Dynaconf). It partially covers secrets protection (only pydantic-settings, and only by type) and clear errors (there's text, but no coordinates in the input file), and almost doesn't cover controlled merging and source auditing. These gaps became my personal motivation to build my own library. By genre of task, the layout is: - A 50-line script → python-decouple. - Remote sources + working without a schema → Dynaconf. - One or two sources with Pydantic already in the project → pydantic-settings. - An ML experiment → Hydra. There's no ready-made tool for the most common case: a service that lives for years. It needs everything at once: several sources, smart merging, clear errors with file and line, masked secrets, and the ability to check where a value came from. Different tools can do these things separately. Nobody does them all together. Motivation: why yet another library The seven-requirement lens shows the market's gaps abstractly. But before I sat down to build my own library, those gaps looked different: as a set of concrete pains I'd been hitting for years, from project to project. Pain: per-field merging (and consistency of related fields). One of the sorest spots in this lens, for me personally, is controlled merging. For years it showed up for me in two related scenarios. The first: a list (CORS origins, allowed hosts) should be merged across sources, while simple fields (database URL, pool size) should be replaced by priority. pydantic-settings gives a fixed priority, "everything is replaced, the last one wins." Dynaconf gives dynaconf_merge, but it's written in the configuration files themselves, not in code. To get the behavior you want on pydantic-settings, you have to write a custom SettingsSource: dozens of lines of boilerplate for a single field. The second scenario is a special case of the same story. defaults.yaml holds the related settings of the primary DB (db_host, db_port, db_name, db_user). In staging.yaml they need to be overridden as a whole. Someone in a hurry set only db_host and forgot the rest; review missed it. The app starts and connects to staging-host:5432/production_db: a half-switched config that nobody notices until a request hits the wrong database. The problem isn't validators: each field is valid on its own. The problem is consistency across sources: these four fields are a group, so either all four come from the same source or it's an error. Among the popular tools I reviewed, I found no out-of-the-box way to express this declaratively and with types. In practice people write something of their own with model_validator, brittle and verbose, or catch it after the fact in production. Both pains are about the same thing: a developer wants to control merging declaratively and in code, not through special keys in the data or manual stitching. Pain: "where did this even come from?" A very common config-debugging scenario in my practice is finding where a specific value came from. The config is assembled from three or four sources: defaults.yaml, override.yaml, environment variables, secrets from Vault. And at some point I want to understand exactly where this port=8080 or this ValidationError came from. There are two debugging scenarios here, and they differ slightly. After a successful load: the config is assembled, the service is running, but a value behaves strangely. Say production has DEBUG instead of INFO and the log is flooding. You want to ask the config, "Where did you get this DEBUG from?" and get the answer "from override.yaml, line 12" or "from the APP_LOG_LEVEL variable." Instead, you open all the files one by one, grep, check the container's environment, and do it all over again every time. On a parse failure, you get ValidationError: port should be a valid integer, and need to work out where exactly the offending line lives. The error text itself is fine, but in which of the three files should you look for port:? If one of them is mounted from a ConfigMap, that's five to ten minutes by hand for every failure in CI. Both scenarios are about the same thing: the coordinates of a value should be part of the load result. This information is available right at parse time (ruamel.yaml, tomlkit, and other AST parsers preserve (line, col) for each node), but nobody carries it further. Pydantic doesn't name the file at all. Dynaconf and Hydra know the source but don't hand it out as a structured report. So on every such task you become a detective again, even though the parser already holds the data for the investigation. Pain: I want validators both in the type and outside it. When the dataclass is mine, I want the validator right in the field annotation: port: Annotated[int, V >= 1, V <= 65535]. Add a field and the constraints come with it; rename it and mypy catches it. pydantic-settings has long supported this form, so for your own models the market has reached a decent state. It's harder when the dataclass isn't mine: it came from someone else's library or a domain model you want to reuse as config. You can't change the class, but validation is still needed. In pydantic-settings the way is a wrapper or a subclass. In Dynaconf it's Validator("PORT", gte=1) with a string field name; it works, but renaming PORT in the schema silently breaks the check, and you find out only when an invalid value has already reached production. I want both forms out of the box, and both without string references to fields: Annotated for your own classes, and a separate validation parameter for foreign ones, going through the same typed field path that can be checked statically. Pain: secret masking doesn't work everywhere it should. Secrets protection in the lens is only partially covered, and only in pydantic-settings, and only by type. It has SecretStr, which hides the value in repr and logs. That's enough as long as the developer remembers to mark the field as SecretStr. Forget, and the value flies into the log as a plain string. In reality, people forget regularly: a new hire adds a database_password: str field by analogy with the neighboring database_url: str, and at the first print(config) or logger.info(config) the password goes into the log in plain text. There's no automatic triggering "by field name" or "by value shape," and I'd like one, because names of secret fields are fairly predictable (password, token, api_key, secret), and randomly generated tokens statistically differ from ordinary strings. Pain: "we need our own source." In large companies it's rare to hear "let's take public Vault and go." More often it's a corporate analogue of a secret manager, a REST endpoint "give me the settings for this module," an encrypted archive unpacked via an internal KMS, or just an old SOAP endpoint where feature flags live. Making that work with pydantic-settings means writing your own SettingsSource overriding _field_is_complex and _extract_field_info, and then regression-testing every format hiccup. That's dozens of lines of infrastructure code for one HTTP call, plus your own error and type-coercion pipeline. I want "your own source" to be a minimal contract: one class, one method that returns a dictionary. Everything else (merging with other sources, validation, clear errors pointing at this source, debugging) should come from the shared pipeline instead of being copied into every new source. The architectural pain: a library, not a framework. Hydra captures the application entry point and swaps the working directory. pydantic-settings intrusively threads BaseModel through all your methods. Dynaconf reads its settings.toml from somewhere in the project root at every turn. I want a tool that behaves like a function: call load(...), get a plain dataclass, done. No global effects, no swapped directories, no "our ecosystem you now live in." A stdlib @dataclass as the result is a contract that works with any other tool: ORMs, FastAPI, tests, serialization. There's no vendor lock-in: a user of the tool isn't tied to its ecosystem. Here's a summary table of the tools reviewed. | Parameter | python-decouple | Dynaconf | pydantic-settings | Hydra | |---|---|---|---|---| | Schema in code | No | No | Pydantic model | YAML + dataclass | | Result | Individual variables | Dynaconf (dict-like) | BaseSettings (Pydantic) | DictConfig (OmegaConf) | | Formats | .env, .ini, env vars | YAML, TOML, JSON, INI, .env, Python | .env, env vars, JSON, YAML, TOML | YAML | | Source merging | No | Layers + dynaconf_merge | Fixed priority | Defaults list | | Type safety | No | No | Yes (Pydantic) | Partial (OmegaConf) | | Validation | cast | Separate Validators | Pydantic validators | Types only | | Errors (file/line) | No | No | No | No | | Secret masking | No | No | SecretStr | No | | Source auditing | No | inspect_settings | No | Output dir | | ENV expansion | No | @format, @jinja | No | ${oc.env:VAR} | | CLI | No | CLI utilities | CliSettingsSource | CLI overrides | | Remote sources | No | Vault, Redis | No | No | | IDE / mypy | No | No | Yes | Partial | | Dependencies | None | None | pydantic (Rust core) | hydra-core, omegaconf | The table is not a verdict. If you don't have the requirement in the left column, the corresponding cell doesn't matter. A microservice, an ML experiment, and a CLI utility need different rows. In short: pydantic-settings leads on type safety and validation, and Dynaconf on source variety. Hydra fits ML experiments, and python-decouple fits small scripts. None of the four gives you file-and-line errors or fine-grained merge control, and that's the gap Part 3 tries to close. Next up: Part 3 shows how my library, dature, grew out of these seven requirements and six pains. Which of these tools are you using today, and what made you pick it? Tell me in the comments.

【一次資料】 ■ 米国の実際の裁判例（2023年・Mata v. Avianca） law.justia.com ■ Pydantic AI 機能追加・修正・マージPR pydantic-ai#7434 ■ 私の原指摘：出典URLの取り違え pydantic-ai#7434 ■ 私の別の指摘：出典の数と独立した根拠の違い pydantic-ai#7434 ■ 開発者による修正と回帰テスト github.com/pydantic/pydantic-ai/commit/6594475317…

"Monty avoids latency, complexity, cost of a container based sandbox for running LLM generated code. It comes in two forms: OSS Monty, MIT licensed Python 3.14 sandbox you install as a package, and Full Monty, commercial server that runs the same sandbox behind a WebSocket as a service" ➡️ Good? pydantic/monty Community Overview: lifehubber.com Resources are shared for discovery and are not independently vetted—please do your own due diligence. New resources are added regularly — feel free to join the sub for updates. Full searchable archive of all resources posted so far on our community site, LifeHubber: lifehubber.com 300+ open-ish AI models, agents, tools, datasets, and related resources, with filtering and sorting.