langchain - 💡(How to fix) Fix Architecture Proposal: Hardening PythonREPLTool Local Execution via Defense-in-Depth (AST + PEP 578) [2 comments, 2 participants]

Submission checklist

• This is a feature request, not a bug report or usage question.
• I added a clear and descriptive title that summarizes the feature request.
• I used the GitHub search to find a similar feature request and didn't find it.
• I checked the LangChain documentation and API reference to see if this feature already exists.
• This is not related to the langchain-community package.

Package (Required)

• langchain
• langchain-openai
• langchain-anthropic
• langchain-classic
• langchain-core
• langchain-model-profiles
• langchain-tests
• langchain-text-splitters
• langchain-chroma
• langchain-deepseek
• langchain-exa
• langchain-fireworks
• langchain-groq
• langchain-huggingface
• langchain-mistralai
• langchain-nomic
• langchain-ollama
• langchain-openrouter
• langchain-perplexity
• langchain-qdrant
• langchain-xai
• Other / not sure / general

Feature Description

The langchain-experimental PythonREPLTool is a core utility for agentic code execution workflows, but running it locally without a heavy Docker container presents a severe Remote Code Execution (RCE) liability. Furthermore, standard static analysis often has blind spots against obfuscated agent payloads (e.g., dynamic execution via import('o'+'s')).

To address this, I have architected a defense-in-depth guardrail system specifically designed to armor local execution loops. It pairs a strict Static AST Gate with PEP 578 CPython Runtime Audit Hooks to physically snap unauthorized kernel interactions dynamically at the interpreter level.

I have formalized this engine into a standalone PyPI utility so developers can instantly provision the boundary around their LangChain agents:

pip install varek-guardrails

The Architecture:

Static Gate: Pre-execution AST parsing halts explicit forbidden module imports before the code ever reaches the interpreter.

Runtime Warden: The PEP 578 hook catches dynamic execution attempts during runtime, completely neutralizing the obfuscation blind spot.

Resources:

PyPI Registry: https://pypi.org/project/varek-guardrails/

Documentation: https://github.com/kwdoug63/varek

I would like to propose a PR to introduce a SecurePythonREPLTool wrapper utilizing this module to provide a safe, native fallback for developers not using Docker. Would the maintainers be open to reviewing an integration draft?

Use Case

See main Feature Description above.

Proposed Solution

See main Feature Description above.

Alternatives Considered

See main Feature Description above.

Additional Context

See main Feature Description above.