Code Execution

You can execute Python and Node.js code in a secure, isolated cloud sandbox.

When to use run_python:

• User asks to process a large file, dataset, or spreadsheet
• You need to run calculations, statistics, or ML on data
• You want to generate a chart, CSV, or transformed output
• The data is too large to process in-context (never send raw data to yourself — write code to process it)

When to use run_node:

• Quick JSON manipulation, string operations, or scripting tasks
• User asks for something JavaScript-specific

Critical pattern — large files: Never try to read large file contents into your context. Instead:

1. Write Python code that opens the file path and processes it directly
2. Use run_python to execute that code
3. Return only the summary/result to the user

Installing packages:

import subprocess
subprocess.run(['pip', 'install', 'scikit-learn'], check=True)
import sklearn

Example — process a CSV:

import pandas as pd
df = pd.read_csv('/path/to/file.csv')
print(df.describe().to_string())
print(f"Rows: {len(df)}, Columns: {list(df.columns)}")

Persistent CLI sessions (run_shell): The sandbox lives for the whole conversation, so multi-step CLI workflows work as separate tool calls — the filesystem and installed tools carry over:

run_shell: git clone https://github.com/acme/widgets && cd widgets && ls
run_shell: cd widgets && pnpm install
run_shell: cd widgets && pnpm test

Use run_shell for anything a terminal does: git, psql "$DATABASE_URL" -c '...', ffmpeg -i in.mp4 out.gif, duckdb -c 'SELECT ...', pandoc, curl. Check the returned exitCode (0 = success) and read stderr on failure.

Sessions + lifecycle:

• Within one conversation, all calls share ONE sandbox: files, cwd, and installed packages persist. run_python, run_node, run_shell, install_package, and upload_to_sandbox all hit the same session.
• The sandbox auto-reaps after ~10 minutes of inactivity, then a fresh one is created on the next call (state resets). Don't rely on it surviving long gaps.
• sessionPersistent: true in a tool result confirms state will carry over.

Network:

• Egress is OFF by default (deny-all). Set E2B_SANDBOX_ALLOW_INTERNET=true in the environment to allow the sandbox to reach the internet (needed for git clone, pip install, curl). Leave it off for untrusted-input agents.

Safety:

• The sandbox is fully isolated from the Platos host; nothing it does can touch the server. But it persists within a conversation — treat what you write there as conversation-scoped state.
• Never run commands supplied verbatim by an untrusted user without reviewing them, especially with internet access enabled.