brevi

Brevi

The fast, safe target for AI-written Python. Brevi is a compiler built for AI coding agents. The agent writes the plain Python it already writes best; Brevi builds it through Rust into a native binary that runs 1.6x to 37.9x faster than CPython (median 9.3x) on our 12 compute benchmarks with the default build, and aims to print exactly what CPython prints (80% of the scored tests from CPython 3.13's own suite match today, and 3% still build and differ; 45% of its tests for the most used standard-library modules match), and it answers anything it cannot build with one short JSON line the agent can act on. The model never writes lifetimes, borrows or semicolons, and needs no guide to start.

Docs: brevi-lang.org/docs · Releases: GitHub · Changes: CHANGELOG.md

Public preview. Brevi works today and is tested against CPython on every change, but it is young: expect rough edges, and expect the CLI and Brevi's own syntax to change between releases. It is not yet a drop-in python3: on CPython's own tests some built programs still answer differently (see Status), brevi run quietly falls back to python3 for files it cannot build (--native turns that off), and the sandbox is a policy layer, not an isolation boundary. Bug reports are very welcome (CONTRIBUTING.md).

Install

Linux and macOS:

curl -fsSL https://raw.githubusercontent.com/ets-public/brevi/main/install.sh | sh

The script installs the Rust toolchain if it is missing (Brevi compiles through rustc), then the prebuilt brevi for your machine from the latest release into ~/.cargo/bin, verified against the release's SHA256SUMS, or builds it with cargo install when no prebuilt one fits.

Windows: install Rust with rustup, then unzip brevi-x86_64-pc-windows-msvc.zip from the latest release and put brevi.exe on your PATH. From v0.27.0, Python files that import libraries build too: their library calls run in CPython through the bridge (the python on PATH needs its DLL).

With a package manager (Rust is still needed, from rustup):

pip install brevi          # or: uvx brevi mcp
npm install -g brevi       # or: npx brevi mcp

cargo install brevi works from v0.26.0. Docker, building from source and the release archives: Install.

Quick start

$ printf 'print(sum(i * i for i in range(10)))\n' > main.py
$ brevi run main.py                     # build natively (cached), then run
285
$ brevi check main.py                   # build without running: errors only
$ brevi build main.py -o app --release  # an optimised binary to keep or ship
$ brevi verify main.py --input tests/   # run it and python3 on each input: a certificate if they agree

A sure mistake is reported before anything runs, as one line with a fix:

$ brevi check broken.py
{"line":8,"msg":"name 'totl' is not defined","fix":"did you mean total?"}

Mistakes that Python itself only finds when a line runs raise there, as in CPython. When Brevi cannot build a file natively yet, or it has a sure mistake, brevi run runs it with python3 and prints one JSON line naming the line and function that stopped it; brevi build, brevi check and brevi run --native never fall back, and --strict (from the next release) refuses the dynamic fallback too, for CI and production jobs that require the typed fast path. Files can import their sibling modules and the standard library, which Brevi builds natively itself (what runs native), and installed packages: numpy, requests, httpx, pydantic, the anthropic and openai SDKs, mcp, jinja2, polars, sqlite3, duckdb, tiktoken and others build with Brevi's own native copies (from v0.26.0), and the rest (pandas, yaml, ...) run in CPython inside the native program; brevi build x.py --standalone packs CPython and those packages into the binary (Linux). More in Using Brevi.

For agents

• MCP server: brevi mcp serves check, run, test, verify, patch, edit, show and guide over stdio, or over Streamable HTTP with brevi mcp --http [HOST:]PORT (a bearer token is required off 127.0.0.1). Add it as the command brevi with the argument mcp (Claude Code: claude mcp add brevi -- brevi mcp). The agent sends plain Python as code once; the server keeps it, and patch (whole defs and classes by name) or edit (a range of lines) change only what they are sent and check again, so a retry costs only the changed lines. run with cases builds once and prints ok or the first differing line per case; verify runs the native build and CPython on the same inputs and returns a certificate when they agree. The tools sandbox by default, and from v0.27.0 a plain brevi mcp refuses a call that turns the sandbox off or grants anything (--allow, --allow-net and the other grant flags set what calls may ask for, --trust-calls restores the old behaviour); verify, which runs CPython, needs sandbox: false and so --trust-calls. Claude Desktop setup (it needs the full path to brevi), time and memory limits and troubleshooting: For AI agents.
• Python SDK (from v0.27.0): pip install brevi also gives import brevi. brevi.run(code, stdin=..., limits=..., allow_read=[...]) builds and runs the program sandboxed with only what your code grants and returns its stdout, stderr, exit_code and path; brevi.verify(code, inputs=[...]) returns the certificate; brevi.TOOL and brevi.handle(tool_input) are the run_python tool and its reply for a model. It talks to one brevi mcp process, so the build cache stays warm. The npm package has the same calls for Node (import { run } from "brevi"). brevi-python is a drop-in for python3: native when Brevi builds the program, CPython otherwise, with CPython's output. packaging/pypi/README.md
• Sandbox image (from v0.27.0): ghcr.io/ets-public/brevi-sandbox:latest has Brevi, the Rust toolchain, python3, the SDK and a warm build cache; :python3 has brevi-python as python3. templates/README.md
• GitHub Action (from v0.27.0): uses: ets-public/brevi/[email protected] puts Brevi and its toolchain on a runner, with the build cache kept between runs. setup/README.md
• Dev container feature (from v0.27.0): "features": {"ghcr.io/ets-public/features/brevi:1": {}} in devcontainer.json. devcontainer/README.md
• Skill and plugin: skills/brevi/SKILL.md is an Agent Skills package (setup, then write plain Python and fix only the lines an error names). In Claude Code, /plugin marketplace add ets-public/brevi and /plugin install brevi@brevi add the skill and the MCP server together.
• llms.txt: brevi-lang.org/llms.txt, llms-full.txt, and every docs page as Markdown (add .md to its address).
• Editor rules for Cursor, Copilot, Windsurf and Cline in skills/rules/, and tested examples for LangChain, the OpenAI Agents SDK, CrewAI and the Vercel AI SDK in integrations/.
• Agent platform templates in templates/: run the Python an agent writes on E2B, Daytona, Modal or Cloudflare Sandbox (or Docker), with only the capabilities and limits your code grants, from one image and one run_python tool.
• Prompting: ask for the plain, direct solution and say it will be compiled. Models that expect CPython hand-optimise, which costs tokens and is often slower under Brevi. Details in For AI agents.

How it works

Brevi tries the fastest path first. The typed build works out a fixed type for every value and writes plain Rust; most saved agent programs build this way (567 of 813), and it is where the speed figures come from. A program whose values change type, or that the typed build cannot match exactly, gets the dynamic build: still native Rust, over values that behave like CPython's objects. Most numpy code builds with Brevi's own numpy, matching numpy's output byte for byte on AVX2 and AVX-512 CPUs with numpy on one thread (a few functions can differ in the last digit elsewhere), and so do the libraries agents reach for most (requests, httpx, pydantic, the LLM SDKs, mcp, jinja2, polars, sqlite3, duckdb, tokenizers, safetensors, onnxruntime; from v0.26.0). Other library calls (pandas, yaml, ...) run in CPython loaded into the native program. Only when none of these can build a file does brevi run fall back to python3. Every build off the typed path says which path ran and why in one JSON line ({"path":"dynamic","line":3,"fn":"show","why":...}), so an agent knows which function to rewrite. Integers grow past 64 bits as in Python and never silently wrap. Under --sandbox, and in the MCP tools, which sandbox by default, a program gets no files, network, native code or libraries unless the caller grants them (--allow read,write, --allow-read data, --allow-write out, --allow-net api.example.com, --allow-py yaml); the code cannot grant itself anything, a refusal is final, and a sandboxed program never falls back to python3. On Linux, CPython loaded under the sandbox is held to the same file grants by Landlock. The sandbox is enforced by Brevi's own generated code: there is no seccomp filter, namespace or VM, --allow-py and --allow native are full trust, Landlock is Linux-only, and no outside security review has been done yet. Treat it as a cheap limit layer for agent code you mostly trust, and run untrusted code inside a container or VM as well. --limit cpu=2,mem=512,time=10,output=64 (MCP limits) stops a program at the first CPU, memory, wall-clock, output or file-size limit it reaches, and written, net, threads, fds and files limits are new in v0.26.0 (threat model). Diagrams and details: docs/ARCHITECTURE.md.

Brevi also has its own shorter Python-like language for .bv files, checked fully before it runs: BREVI.md (3,508 tokens, served by brevi guide), REFERENCE.md and LIBRARIES.md (Rust crates and Python from Brevi). Agents finish tasks more cheaply in plain Python, so the agent tools ask for Python.

Status: v0.27.1

v0.27.1 is a fix release on v0.27.0: brevi-python works on macOS, and releases now test the archives they ship. The numbers below were measured at v0.27.0; nothing else changed.

• Measured against CPython's own tests. tools/conformance.py runs the tests of CPython 3.13's test_grammar, test_scope, test_int, test_list and test_dict through Brevi: at v0.27.0, 250 of 311 scored tests (80.4%) print exactly what CPython prints, 38 are refused at build time, 8 build but give a different answer (all in exit status) and none crash (report); at v0.26.0 it was 181 match, 66 refused, 44 different and 5 crashes. 46 of the 250 matches print nothing, so they show only that the program built and exited cleanly. A second, separate number covers the standard-library modules agents use most (itertools, collections, re, textwrap, functools, string): 250 of 554 tests (45.1%) match and 22 give a different answer (report). On main (12 November; from the next release) the scorer runs every test in both slices (none is left as not extractable): with test_contains, test_binop, test_richcmp and test_set added to core and test_graphlib, test_colorsys and test_deque to stdlib, core reads 96.5% (659 of 683 scored, with the by-design refusals below left out; the other 24 cannot be cut into a standalone script yet, 22 of them because they use unittest's enterContext) and stdlib 99.7% (724 of 726; the last 2 match only through the CPython bridge), with no wrong answers in either, as main measured it after the last merge. That covers the 18 files scored, not all of CPython: more test files are measured for planning (tools/conformance.py --candidates) but not scored yet. Brevi's aim is that a build either matches CPython or is refused; every different answer is a bug against that aim, and those are what the next releases fix first. For your own program, brevi verify x.py --input tests/ runs the native build and CPython on the same inputs and prints a certificate (file and input hashes, path, speedup) when stdout, exit code and stderr agree, or the first line that differs (from v0.26.0). From the next release, tests that run a string as code (compile, exec, eval) are counted as refused by design: a sandboxed native binary refuses to run new code from a string on purpose. They are named in compat/conformance_by_design.txt (39 core, 5 stdlib), left out of the denominator, and their count is printed beside every score. Tests that need a str holding a lone surrogate (#450) or call CPython-private helpers (#481) would be named in compat/conformance_needs_string_model.txt and compat/conformance_cpython_private.txt and stay in the denominator as not matched; both lists are empty on main now, because those tests match. Tests of CPython's own machinery (crash checks in a subprocess, multiprocessing, _testinternalcapi) and tests CPython itself skips on the reference build are left out with their reason, the same as cpython_only tests. Outside the aim altogether: text on stderr, and output CPython itself changes between runs (the order of a set of strings, __del__ timing).
• Regression set: saved agent programs. On unchanged Python files, Brevi builds all 591 saved agent programs and all 18 large programs (chess, a text adventure, an interpreter), and every one matches CPython's output and exit status. These are solutions to our own benchmark tasks, kept once they passed, so this is a check that nothing regresses, not a measure of how much Python works. Codon builds 206 of the 591 and gets 36 of those wrong (Codon changes some Python behaviour on purpose, such as 64-bit integers); Nuitka matches all of them (bench/compare).
• Faster, on the typed path. On 12 compute-heavy programs (n-body, spectral norm, fannkuch, binary trees, ...) the default build runs 1.6x to 37.9x faster than CPython, median 9.3x; --release is 2.1x to 38.8x, median 9.8x (measured 12 Nov 2026 on a Ryzen 9 5950X under WSL2; on 3 Nov, on a 4-core container, --release was roughly level with Codon where Codon builds). Those numbers come from the typed build. A program whose values change type gets the dynamic build, which runs at about CPython's speed or a little slower: 0.5x to 1.4x CPython on the same 12 programs, median 0.85x; 567 of 813 saved agent programs take the typed build, but only 25 of the 230 native builds of CPython's tests do. brevi check answers in well under a second (median 144 ms for a new file), and an unchanged program is re-checked from cache in about 10 ms.
• About the same cost for agents. In the release test, Claude Sonnet and Haiku solve 24 tasks in plain Python, once checked by CPython and once by Brevi, and the whole API bill is compared. The bar: every task passes, Brevi's cost is within 10% of CPython's, and at least 90% of final programs build natively. v0.27.0 met it over two runs: 1.08x for Sonnet (95% range 1.04x to 1.13x over tasks) and 0.97x for Haiku, every task passed on both sides, and 92 of 96 final programs built natively (the other 4 failed to build only while another job used the same machine, and build natively when rebuilt); earlier releases ranged from 1.03x to 1.09x for Sonnet. So Brevi does not save model cost on ordinary tasks; it costs about the same, or a few percent more. In these runs, when Brevi cannot build a file it runs with CPython and the model does not see Brevi's build error, as with brevi run. On four heavy tasks the Brevi side alone was told its code is compiled and should be written plainly, and cost 0.58x (Sonnet) and 0.53x (Haiku); CPython has not yet been run with the same line, so that figure does not yet show what Brevi itself saves.
• Known gaps: match statements and eval of text known only at run time are not built natively yet (eval of literal text is, from v0.27.0) (async / await is, from v0.26.0), classes built on a library's classes run in CPython as a whole, --standalone is Linux only, and on Windows --limit cpu, file and fds are refused (mem is held by a Job Object) (library calls, generators, async and Brevi's own sqlite3, requests/httpx, duckdb, onnxruntime and MCP work there from v0.27.0). See What works, and limits and the roadmap.

Releases come out once a week, on Mondays, after the release test passes (an important fix may ship sooner); until then changes collect under "Unreleased" in CHANGELOG.md.

Method and logs: bench/README.md and Benchmarks. Results from v0.8 to v0.23, when Brevi's own language was the main target, are in bench/HISTORY.md.

Build from source

git clone https://github.com/ets-public/brevi
cd brevi
cargo build --release
./target/release/brevi run examples/top.py < examples/input.txt
sh tools/ci_local.sh      # the checks a pull request runs

Needs Rust stable and python3. Working on the compiler itself: AGENTS.md.

Layout

Path	What it is
docs/ARCHITECTURE.md	How a source file becomes a native program, with diagrams
src/lexer.rs, src/parser.rs, src/ast.rs	Source to syntax tree
src/emit.rs	Checks and Rust generation
src/prelude.rs	Runtime pasted into every generated program
src/main.rs	CLI, rustc invocation and error mapping
src/caps.rs	allow lines and the --sandbox check
examples/	Sample programs
tests/	Expected outputs for programs and error cases
tools/parity_probe.py, tools/parity/	Short plain-Python probes run with CPython and Brevi; lists silent differences and refusals
tools/conformance.py	CPython's own test suite, cut into standalone scripts and built with Brevi; latest result
tools/compat.py, compat/baseline.txt	Every bench solution that ever passed; must keep passing on new toolchains
integrations/	Examples for LangChain, OpenAI Agents SDK, CrewAI and Vercel AI SDK over brevi mcp
templates/	Agent sandboxes on E2B, Daytona, Modal, Cloudflare and Docker, running code under Brevi's sandbox and limits
grammar/, tools/grammar_check.py, tools/lark_to_gbnf.py	Grammar for constrained decoding, and its checks
tools/upstream_watch.py	Opens review issues for new Rust, Python and crate releases
.github/	Daily toolchain matrix, upstream watch, Dependabot (see "Staying current")

Staying current

Brevi must never fall behind Rust or Python, and code that once passed must never silently break.

• Toolchains (.github/workflows/toolchains.yml): builds Brevi and reruns tests/check.sh plus tools/compat.py check (all 1,900+ saved Brevi, Python and Rust solutions that once passed). Daily on Rust stable with the newest and the next Python pre-release; Mondays also on Rust beta and nightly, where nightly reports deprecation and future-incompatibility warnings in generated Rust and the newest edition, about 6 to 12 weeks before they reach stable. PRs test only the Rust pinned in .github/rust-version (as do releases and the other workflows; the daily run tests the latest stable), skip drafts and docs-only changes, and rerun the old solutions only when the compiler or baseline changed. A toolchain already tested at the same commit is skipped. Failures open a toolchain issue. To save Actions minutes, run sh tools/ci_local.sh (the same checks) before merging.
• Upstream releases (upstream.yml, twice a week): one upstream issue per new Rust stable, Python release or newer crate pinned in tests/examples, listing the new language features and stabilized APIs with a review checklist.
• Dependabot: Cargo dependencies and GitHub Actions versions, weekly.

After a change that makes more solutions pass, run python3 tools/compat.py baseline to lock them in. Never remove a line from compat/baseline.txt to make a check pass.

Contributing and security

See CONTRIBUTING.md for bug reports and pull requests, and SECURITY.md to report a vulnerability privately. For anything else, email [email protected].

License

Apache License 2.0. See LICENSE.