تنفيذ آمن لبرامج بايثون باستخدام MCP Run Python: بيئة معزولة مدعومة بتقنية Deno

The MCP Run Python package offers a secure and sandboxed environment for executing Python code. By leveraging Pyodide and Deno, it isolates code execution from the host system, mitigating potential security risks. This blog post explores the features, installation, usage, and dependency management capabilities of MCP Run Python, providing a comprehensive overview for developers looking to integrate secure Python execution into their applications.

Key Features and Benefits

MCP Run Python brings a suite of features that makes it a compelling choice for running Python code securely:

• Secure Execution: Python code runs within a WebAssembly environment managed by Pyodide and Deno, effectively sandboxing it and preventing direct access to the host system’s resources.
• Package Management: Simplifies dependency management by automatically detecting and installing required Python packages.
• Complete Results: Captures all relevant outputs, including standard output (stdout), standard error (stderr), and the return value of the executed code.
• Asynchronous Support: Handles asynchronous Python code execution correctly, ensuring compatibility with modern Python applications.
• Error Handling: Provides detailed error reports, including tracebacks and exception messages, to aid in debugging.

Installation and Setup

The recommended installation method has transitioned from npx to deno, providing enhanced sandboxing and security.

• Deno Installation: MCP Run Python is distributed as a JSR package and can be executed directly using the deno run command.
• Command Structure: The general command structure is: deno run -N -R=node_modules -W=node_modules --node-modules-dir=auto jsr:@pydantic/mcp-run-python [stdio|sse|warmup]
  • -N -R=node_modules -W=node_modules (or --allow-net --allow-read=node_modules --allow-write=node_modules): Grants necessary network, read, and write permissions to the ./node_modules directory for Pyodide to download and cache Python packages.
  • --node-modules-dir=auto: Instructs Deno to utilize a local node_modules directory.
  • stdio: Runs the server using the Stdio MCP transport, suitable for local subprocess execution.
  • sse: Runs the server using the SSE MCP transport, enabling remote HTTP connections.
  • warmup: Executes a minimal Python script to download and cache the standard Python library, verifying server functionality.

Usage Examples

MCP Run Python can be used both within PydanticAI and directly with other MCP clients. The document provides an example of direct usage using the Python MCP client.

• Direct Connection Example: The Python script mcp_run_python.py demonstrates connecting to the MCP Run Python server directly using the stdio_client from the Python MCP library. It initializes a ClientSession, lists available tools, and then calls the run_python_code tool to execute a provided Python code snippet.
• Dependency Inference: Dependencies are automatically inferred from import statements within the Python code. For example, if the code imports numpy, the MCP Run Python server will automatically install the numpy package.
• Inline Script Metadata (PEP 723): Dependencies can also be explicitly defined using inline script metadata within comments at the beginning of the Python file, as described in PEP 723. This approach is useful for specifying dependencies that aren’t directly imported or for pinning specific versions of packages. Example:

  # /// script
  # dependencies = ["pydantic", "email-validator"]
  # ///
  

  This metadata enables the use of dependencies that aren’t explicitly imported in the code and allows version pinning (e.g., dependencies = ["rich<13"]).

Logging

MCP Run Python supports emitting stdout and stderr from Python code execution as MCP logging messages. This functionality requires setting the logging level when connecting to the server. However, there is a known bug in the Python MCP client that currently prevents demonstrating this feature.

Conclusion

MCP Run Python provides a robust and secure way to execute Python code within a sandboxed environment. Its features, including automatic dependency management, comprehensive result capture, and asynchronous support, make it a valuable tool for developers needing to integrate secure Python execution into their applications. The transition to Deno-based execution enhances security and simplifies deployment. By understanding its installation, usage, and dependency management capabilities, developers can effectively leverage MCP Run Python to build safer and more reliable applications.

Source: PydanticAI (implied from jsr:@pydantic/mcp-run-python)