Simon Willison · 2026-06-06 · notable
Simon Willison Ships micropython-wasm 0.1a2 — Runs Untrusted Python Inside a WASI MicroPython Sandbox With wasmtime Memory Caps, CPU 'Fuel' Limits, and Persistent Sessions for LLM Agent Tool Use
Willison ships an alpha Python library that compiles MicroPython to a 362KB WASI WebAssembly blob, runs it via wasmtime, and exposes a persistent interpreter to host code with hard memory caps and a CPU 'fuel' budget for safe LLM tool-call execution.
A WASI MicroPython sandbox so LLM agents can run untrusted Python with hard memory and CPU limits.
Key specs
| Version | 0.1a2 |
|---|---|
| License | Apache-2.0 |
| Wasm blob size | 362 KB |
| C glue loc | 78 |
What is it?
An alpha Python package, micropython-wasm 0.1a2, that ships MicroPython compiled to a WASI WebAssembly module and drives it from CPython via wasmtime. It exposes a CLI plus a long-lived sandboxed interpreter you can feed code into from your own application.
How does it work?
78 lines of C glue compile alongside MicroPython into a 362KB WASM blob. A wasmtime host runs the module with persistent interpreter state across calls (via threading and a message queue), enforces memory limits directly through the WebAssembly engine, and caps CPU work using wasmtime's 'fuel' mechanism. The companion datasette-agent-micropython plugin wires this sandbox into Datasette Agent as a tool an LLM can call.
Why does it matter?
Plugin systems for Datasette, LLM, and most agent harnesses today execute Python with full host privileges, so any code the model writes can read the filesystem or hit the network. A WASM-bounded MicroPython interpreter is small enough to embed and strict enough to constrain memory and CPU, giving agent authors a credible sandbox for model-written code without spinning up a container.
Who is it for?
Authors of Python LLM agents and plugin systems who need a code-execution tool that does not trust the model.
Try it
uvx micropython-wasm -c 'print("Hello world")'