run_python runs a Python snippet for an agent and returns its output. Code is passed to subprocess.run as an argv list ([sys.executable, "-c", code]), so the source is preserved verbatim — no shell, no re-tokenisation — identically on POSIX and Windows.
Code is executed via
subprocess.run([sys.executable, "-c", code]) — no shell, no re-tokenisation. Multi-line snippets, backslashes, and mixed quotes are preserved exactly as passed, identically on POSIX and Windows. The return shape matches execute_command.Quick Start
1
Give an agent the tool
2
Call it directly
3
Verify verbatim source is preserved
Snippets with newlines, backslashes, and mixed quotes that used to break under shell quoting now run intact:
How It Works
Passing an argv list means the operating system hands your exactcode string to Python as a single argument. There is no intermediate shell to expand $VAR, collapse quotes, or re-split on whitespace — so the caller’s source arrives byte-for-byte.
Before / after
Return Shape
run_python returns the same dictionary shape as execute_command:
Best Practices
Use raw strings for backslash-heavy code
Use raw strings for backslash-heavy code
Wrap Windows paths or regex-heavy snippets in
r'''...''' so your own Python source doesn’t consume the backslashes before run_python ever sees them.Gate it behind approval for untrusted agents
Gate it behind approval for untrusted agents
run_python executes arbitrary code. Pair it with Approval so a human confirms each snippet on untrusted routes.Set a timeout for long snippets
Set a timeout for long snippets
Pass
timeout=<seconds> to bound execution; the default is 60 seconds.Prefer run_python over hand-building a shell command
Prefer run_python over hand-building a shell command
Building
python -c "..." strings yourself re-introduces the quoting bugs this tool fixes. Pass the code to run_python and let the argv list carry it.Related
Shell Tools
execute_command and process tools for shell-level tasks.Approval
Require human approval before an agent runs code.
Protected Paths
Block agents from touching sensitive files.
Code Execution with Tools
Let generated code call back into your registered tools.

