Asteval

Asteval is a pure-Python library that safely evaluates Python expressions and statements by walking the abstract syntax tree produced by Python’s built-in ast module. Instead of calling the dangerous built-in eval(), it interprets a deliberately restricted subset of the language, giving you a sandboxed mini-interpreter that can handle user-supplied math and logic without exposing the full power of the host runtime.

With no required dependencies beyond the standard library, asteval supports variables, arithmetic, comparisons, conditionals, loops, comprehensions, and user-defined functions, while blocking access to imports, attribute lookups on dangerous objects, and other escape hatches. When NumPy is installed, many of its functions become available by default, making asteval a practical engine for configurable numerical expressions.

What You Get

• A restricted Interpreter class that evaluates expressions and statements from strings
• Support for a large subset of Python: arithmetic, comparisons, conditionals, loops, comprehensions, and functions
• A controllable symbol table for injecting and reading back variables
• Optional NumPy integration that exposes numerical functions when NumPy is available
• Zero required third-party dependencies beyond the Python standard library

Common Use Cases

• Evaluating user-entered mathematical formulas in scientific or engineering tools
• Building configurable rules or expressions in applications without arbitrary code execution
• Providing a safe calculator or scripting field where raw eval() would be unsafe

Under The Hood

Architecture - The library’s core lives in asteval/asteval.py (~1,000 lines), which defines the Interpreter class. It parses source with ast.parse, then dispatches on node type through a set of on_<node> handler methods that recursively evaluate the tree against a symbol table. Supporting helpers in astutils.py (~750 lines) supply the safe built-ins, name validation, and node utilities that keep evaluation confined to the allowed language subset.

Tech Stack - Pure Python targeting 3.10+ (including PyPy), built with setuptools and setuptools_scm for versioning. It has no required runtime dependencies beyond the standard library; NumPy is an optional enhancement whose functions are injected into the symbol table when present. Packaging is declared in pyproject.toml with a single top-level asteval package.

Code Quality - The project maintains a dedicated tests/test_asteval.py suite run under pytest with coverage reporting, and CI matrices across Ubuntu, macOS, and Windows with and without NumPy. It is marked Production/Stable, ships under MIT, and the codebase is compact and self-contained, making the security-sensitive evaluation paths auditable.

API Design - The public API is small and approachable: construct an Interpreter, call it (or its eval method) on a string, and read results back from the symbol table. Defaults are safe out of the box, and the restricted subset is documented, so getting a working safe evaluator takes only a couple of lines while still allowing customization of the available symbols.