rexy-js

Run JavaScript in a sandboxed workerd V8 isolate, a self-hosted Dynamic Worker. Like Pydantic Monty, but for JS (and Python via Pyodide/Python Workers).

Install

npm install -g rexy-js

CLI

# JavaScript
rexy "console.log('hello')"
rexy -e "1 + 2"
rexy worker.js

# Python
rexy -py "print('hello from python')"
rexy -py "result = [x**2 for x in range(10)]"
rexy script.py

# Environment bindings
rexy --env API_KEY=sk-123 "async (env) => env.API_KEY"
rexy -py --env NAME=Matt "print(f'Hello, {env[\"NAME\"]}')"

# Stdin
echo 'console.log(42)' | rexy --stdin

# Fetch control (blocked by default)
rexy --dangerously-enable-fetch "async () => { const r = await fetch('https://example.com'); return r.status; }"
rexy --dangerously-enable-fetch --allowed-fetch-origin example.com,api.github.com "async () => { ... }"

Programmatic API

import { run } from "rexy-js";

// JavaScript
const { result, logs } = await run("async () => 1 + 2");

// Python
const { result } = await run("result = [x**2 for x in range(10)]", {
  language: "python",
});

// With env bindings
const { result } = await run("async (env) => env.SECRET", {
  env: { SECRET: "hunter2" },
});

// Enable outbound fetch
const { result } = await run(
  'async () => { const r = await fetch("https://example.com"); return r.status; }',
  { allowFetch: true },
);

// Restrict fetch to specific origins
const { result } = await run(code, {
  allowFetch: true,
  allowedFetchOrigins: ["example.com", "api.github.com"],
});

What runs in the sandbox

JavaScript:

• Full V8 engine via workerd
• Web APIs: crypto, URL, TextEncoder/TextDecoder, Response, Headers, etc.
• console.log/warn/error captured and returned
• async/await
• No filesystem, no network (by default), no Node.js APIs

Python:

• CPython via Pyodide (WebAssembly)
• Standard library: json, re, datetime, math, sys, io, asyncio, etc.
• print() captured and returned
• Set result variable or define async def main() to return values
• No filesystem, no network (by default)

Fetch control

Outbound network access is blocked by default at the workerd level via globalOutbound. This is not a JavaScript-level override — it's enforced by the runtime via service workers that intercept all outbound requests.

• --dangerously-enable-fetch — allow all outbound requests
• --allowed-fetch-origin origin1,origin2 — allow only specific origins (implies fetch enabled)

How it works

rexy spawns workerd (the open-source Cloudflare Workers runtime) directly. Your code is injected into a harness worker via the unsafeEval binding, executed in a V8 isolate, and the result is returned as structured JSON.

Python support uses workerd's native Python Workers — Pyodide runs inside the V8 isolate, not in a separate process.

Note: Despite the name, unsafeEval is safe for this use case — the code runs inside workerd's V8 isolate with no filesystem access, no process spawning, and network controlled at the runtime level via globalOutbound. The "unsafe" label refers to bypassing the eval() CSP restriction within Workers, not an escape from the sandbox.

License

MIT