Introduction

Secure Exec is a library for running code you do not trust. Give an AI agent, a plugin author, or a user the ability to write and run code, without giving them your host.

import { evaluate } from "secure-exec";

// Each call runs in a fresh VM that is disposed when the call finishes.
const sum = await evaluate<number>("1 + 2");
console.log(sum.outcome === "succeeded" ? sum.value : sum.error); // 3

• One function call. evaluate and execute are all you need. There is no runtime object to create, configure, and dispose.
• Real Node.js inside. Guest code runs on V8 with node:fs, node:child_process, sockets, and npm packages. It is not a stripped-down interpreter.
• Deny by default. The guest sees a virtual filesystem and no network until you allow it.
• No infrastructure. npm install secure-exec. No containers, no vendor account, no API keys.

Where to start

• Quickstart installs the package and runs your first snippet.
• Agent Code Tool wires it into an agent tool.
• Security covers what is isolated and what is denied by default.