Basilisk
An ICP Python Canister Development Kit and Application Framework. Write decentralized applications in Python efficiently on the Internet Computer.
Live demo: https://ic-basilisk.tech/.
Quick Start
Prerequisites
- icp-cli (
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/dfinity/icp-cli/releases/latest/download/icp-cli-installer.sh | sh) - Python 3.10+
"Hello World" with icp-cli
To create a simple "Hello World" project with icp-cli, run:
# 1. Scaffold a new project from the Basilisk template
icp new my_project --git https://github.com/smart-social-contracts/basilisk --subfolder icp-cli/templates/hello-world
# 2. Install dependencies and deploy to the local replica
cd my_project
# Optional: python -m venv venv && source venv/bin/activate
pip install -r requirements.txt
icp network start -d
icp deploy
# 3. Call your canister
icp canister call my_project greet '("World")'
# ("Hello, World!")
Alternatively, you can install Basilisk directly: pip install ic-basilisk
Features
- Based on CPython 3.13, compiled to WASM — deploy in seconds with a pre-built template, no Rust toolchain needed
- Near-complete standard library —
os,json,re,math,datetime,hashlib,collections, networking stubs, and more. A few modules requiring native OS threads or sockets (e.g.threading,subprocess,socket) are not available
Built-in Application Framework:
- Persistent storage — Rust-backed stable data structures (
StableBTreeMap,StableBTreeSet,StableVec,StableLog,StableCell,StableMinHeap) powered byic-stable-structureswith tagged binary encoding — data persists across canister upgrades with no serialization step. Supports explicit type hints (nat8,int32, etc.) for compact, correctly-ordered keys and values - Filesystem — standard
open()andoscalls, automatically persisted to stable memory across upgrades - IC system APIs —
ic.caller(),ic.time(),ic.canister_balance(), inter-canister calls, timers, and Candid types (Principal,Record,Variant, etc.) - Sandboxed execution — run untrusted Python (extensions, rule modules) in an isolated CPython subinterpreter with a capability-gated host bridge, a deterministic instruction budget, and validated plain-data results. See Sandboxing Untrusted Code
Interactive shell, ORM, Schema Upgrade Checking, file transfer, task management, wallet, and more are provided by ic-basilisk-toolkit (
pip install ic-basilisk-toolkit).
┌─────────────────────────────────────────────────────────┐
│ Basilisk CDK │
├─────────────┬────────────┬──────────────────────────────┤
│ Filesystem │ Storage │ IC System APIs │
│ POSIX-like │ BTreeMap, │ Timers, Inter-canister calls │
│ os/open() │ Vec, Log, │ Candid types, Lifecycle │
│ auto-persist│ Cell, Heap │ │
├─────────────┴────────────┴──────────────────────────────┤
│ MemoryManager (ic-stable-structures) │
├─────────────────────────────────────────────────────────┤
│ CPython 3.13 (compiled to WASM) │
├─────────────────────────────────────────────────────────┤
│ Internet Computer (ICP) │
└─────────────────────────────────────────────────────────┘
Built-in AI/Agent Endpoints
Basilisk can auto-inject standardized __shell__ and __browse__ endpoints into your canister at build time. Enable them with a single line:
__basilisk_features__ = ["shell", "browse"]
__shell__ — full Python execution (controller-only @update):
icp canister call my_canister __shell__ '("print(1 + 1)")'
# ("2\n")
__browse__ — read-only data introspection (controller-only @query, instant, free):
# Discover data schema
icp canister call my_canister __browse__ '("{\"action\": \"schema\"}")'
# Read keys from a stable map (paginated, default limit=100)
icp canister call my_canister __browse__ '("{\"action\": \"keys\", \"map\": \"users\"}")'
# Get a specific value
icp canister call my_canister __browse__ '("{\"action\": \"get\", \"map\": \"users\", \"key\": \"alice\"}")'
Both built-ins answer controllers only: __browse__ returns every key and value in your stable structures. Both endpoints can be overridden with custom implementations (e.g. a different guard, filtered data access). If you define __shell__ or __browse__ yourself, the compiler uses yours instead of the default, guard included.
Sandboxing Untrusted Code
Run untrusted or semi-trusted Python (user-supplied extensions, rule modules) inside an isolated CPython subinterpreter. The sandbox has its own heap and GIL, an empty sys.path, and cannot import the privileged host surface — code inside it can only compute and talk back through a capability-gated rpc() bridge you control. Data crossing the boundary is plain data only (None/bool/int/float/str/list/dict), deep-copied in both directions; no live object references cross.
Key properties:
- Content-hash allow-list — a subinterpreter only runs source whose SHA-256 you explicitly approved host-side.
- Deterministic instruction budget — sandboxed code is metered in the interpreter's dispatch loop (bytecode instructions, never wall-clock); exceeding the budget raises
BudgetExceeded. The main interpreter is never metered. - Isolation by construction —
_basilisk_icand the spawn primitive itself are refused fail-closed inside the sandbox; the dangerous native surface (real filesystem, sockets, subprocesses) is simply absent, not denylisted.
Simple example
import _basilisk_sandbox as sandbox
from basilisk import update
# Untrusted extension code (imagine a user uploaded this).
EXTENSION = """
def score(numbers=None):
numbers = numbers or []
return {"total": sum(numbers), "count": len(numbers)}
"""
@update
def run_extension() -> str:
# 1. Approve the exact source by its content hash (host-side allow-list).
content_hash = sandbox.sha256(EXTENSION)
sandbox.approve_hash(content_hash)
# 2. Spawn an isolated subinterpreter running that source.
handle = sandbox.spawn_subinterpreter(EXTENSION, content_hash)
# 3. Call a function in it — args and result cross as plain data only.
result = sandbox.call_in_subinterpreter(handle, "score", {"numbers": [1, 2, 3]})
# 4. Tear it down (fresh-per-use by design; no pooling).
sandbox.close_subinterpreter(handle)
return str(result) # {'total': 6, 'count': 3}
For privileged operations, spawn with a capability and an rpc handler (basilisk.sandbox.build_capability / spawn_sandboxed), and validate anything the sandbox proposes to write with the two-pass validator + atomic commit (basilisk.sandbox.commit_result). See docs/SUBINTERPRETER_AUDIT.md for the full security model, capability intersection, result validation, and the bool/int/float type-checking notes.
Overhead: a call into an already-spawned sandbox costs ~10K instructions, boundary copies ~0.6K instructions per byte, metering 5–11%, and a full fresh-per-use spawn/call/close cycle ~55–100M instructions. Full numbers and amortization guidance in docs/SANDBOX_BENCHMARKS.md (benchmarks/sandbox/).
CPython vs RustPython
| CPython 3.13 | RustPython | |
|---|---|---|
| Build time | ~seconds (template) | ~60-120s (Cargo build) |
| Wasm size | ~5.3 MB | ~26 MB |
| Python compatibility | Full (reference implementation) | Partial (~3.10) |
Cross-Language Benchmark
Pure-compute benchmarks comparing Rust, Motoko, and CPython on identical algorithms. Measured via ic0.performance_counter on a PocketIC replica. On the IC, 1 instruction ≈ 1 cycle of compute cost. Lower is better. These numbers exclude the fixed per-call fee (~590K cycles for updates, ~260K for queries) and memory/storage costs.
| Benchmark | Rust | Motoko | CPython | vs Rust (CPython) |
|---|---|---|---|---|
| noop (call overhead) | 13,686 | 3,299 | 15,592 | 1.1x |
| increment (state mutation) | 12,827 | 3,411 | 15,159 | 1.2x |
| fibonacci(25) (iterative) | 12,750 | 5,713 | 36,553 | 2.9x |
| fibonacci_recursive(20) | 373,953 | 2,050,048 | 29,617,193 | 79.2x |
| sum_to(10000) (arithmetic loop) | 272,761 | 513,314 | 12,767,523 | 46.8x |
| ackermann(3,6) (deep recursion) | 3,285,678 | 15,225,081 | 284,158,839 | 86.5x |
| method_overhead (total prelude) | 12,334 | 2,863 | 10,172 | 0.8x |
Full CI logs: All backends
Python-Specific Benchmark (CPython vs RustPython)
These benchmarks use language-specific data structures (Python dict, list, str) so they only compare CPython against RustPython — not against Rust/Motoko, which have fundamentally different standard libraries.
| Benchmark | CPython | RustPython | RustPython / CPython |
|---|---|---|---|
| string_ops (100 concatenations) | 275,375 | 2,135,202 | 7.8x |
| list_ops (500 append + sort) | 602,711 | 5,819,267 | 9.7x |
| dict_ops (500 inserts + lookups) | 3,407,101 | 23,087,720 | 6.8x |
CPython is 6–10x faster than RustPython across the board, with the gap largest for recursive function calls and list operations.
Run it yourself: trigger the Benchmark workflow from the Actions tab — select
cpython,rust,motoko,sandbox, orallas the backend, andlocaloricas the network.
The benchmark sources are in benchmarks/counter/ (CPython), benchmarks/counter_rust/ (Rust), and benchmarks/counter_motoko/ (Motoko). The subinterpreter-sandbox overhead suite is in benchmarks/sandbox/, with results in docs/SANDBOX_BENCHMARKS.md.
Projects Using Basilisk
- Realms — Governance Operating System for building and deploying governance systems on the Internet Computer
Using Basilisk? Open a PR to add your project here.
Why "Basilisk"?
A basilisk fountain in Basel, Switzerland — where this project was written.
This project was written in Basel, Switzerland — a city guarded by basilisks since the Middle Ages. In European mythology, the basilisk is the king of serpents — part rooster, part snake — making it a fitting patron for a Python framework.
According to local legend, a basilisk once dwelt beneath Basel's streets, turning to stone anyone who dared look upon it. The citizens, unable to defeat it by force, outwitted the creature with a mirror: confronted with its own reflection, the basilisk was petrified by its own gaze. Impressed by the creature's power, the people of Basel didn't destroy it — they adopted it. To this day, basilisk statues stand watch over the city's fountains, their water said to carry a faint enchantment of protection.
In the shadow of the Tower of the Bank for International Settlements — where the world's central banks convene to shape global finance — a basilisk fountain stands watch. It is here, at the crossroads of ancient myth and modern power, that we chose to unleash the dormant power of Python onto the Internet Computer.
The fountains still flow in Basel. And now, so does Python on the IC. Great power requires great responsibility. Handle with care.
Security
See SECURITY.md.
Documentation
For detailed architecture notes, see CPYTHON_MIGRATION_NOTES.md.
Discussion
Feel free to open issues.
Disclaimer
This software is not production-ready. Do not deploy to mainnet or use with real assets or canister state you cannot afford to lose.
Basilisk is in early development (alpha). It may contain bugs, breaking changes, and unknown security vulnerabilities. It has not undergone an independent security audit. Use at your own risk.
- Not recommended for production deployments on the Internet Computer
- No extensive automated property tests
- No guarantee of correctness, availability, or security
- APIs and behavior may change without notice
License
MIT — see LICENSE.
1 maintainer
Metadata
1 maintainer
Release files for ic-basilisk 0.16.1
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | |
|---|---|---|---|
| ic_basilisk-0.16.1.tar.gz | 376.1 kB | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ic_basilisk-0.16.1-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 753.8 kB
Release files / ic_basilisk-0.16.1.tar.gz
| Download URL | ic_basilisk-0.16.1.tar.gz |
|---|---|
| Size | 376.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
7cbd28fcf78a96bf7aa3a34b88bf3b4a4e58039bdc4ac7272d9c619af732919a
|
|
BLAKE2b-256 checksum How to use checksums |
12bf0f1d685189756075f49df906534be547bc40b2c44d888bc678857fcd4fd9
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 14, 2026.
Transparency logRelease files / ic_basilisk-0.16.1-py3-none-any.whl
| Download URL | ic_basilisk-0.16.1-py3-none-any.whl |
|---|---|
| Size | 377.7 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
9de7df0446e2c8fc1de798b77d019eb088c9ed4d1dfece5ef993349667733ac5
|
|
BLAKE2b-256 checksum How to use checksums |
b2a4886cb265de6f1080e6285a1b31b52bd2ab94c5847b80bfd318731d5289d0
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 14, 2026.
Transparency log
