Leval

License

A limited expression evaluator

A little more suited for dynamic usage than ast.literal_eval() while remaining as safe as the functions you pass in.

Under the hood, it uses the ast module to parse the expression, then walks the AST in Python to evaluate the result. You can also specify a depth limit for the complexity of the expression, as well as a time limit for the evaluation.

Example usage

Simple API

For many use cases, the simple_eval() function is sufficient. You can specify depth, time and expression size limits, and optional mappings of variables and functions.

The values mapping can also be keyed by a tuple of strings, which is what attribute accesses are folded to.

Operations are generally limited to numbers only in the simple API.

from leval.simple import simple_eval

assert simple_eval('1 + 2') == 3
assert simple_eval('x < -80 or x > 125 or x == 85', values={'x': 85})
assert simple_eval('abs(x) > 80', values={'x': -85}, functions={'abs': abs})
assert simple_eval('x.y.z + 8', values={('x', 'y', 'z'): 34}) == 42

Advanced API

Under the hood, simple_eval simply

initializes an evaluation universe, which defines the functions, variables and operations available
creates an Evaluator to evaluate the expression with the given universe

Both of these classes are designed to be easily subclassable. There are examples in the test_leval.py file.

Security

leval walks the AST itself and never uses getattr, subscripting, or calls to anything other than the functions you explicitly register by name.

The evaluator is only as safe as what you put into the universe, so keep the following in mind:

You own the functions and values. Any function you register can be called with attacker-controlled arguments, and operators (==, <, in, arithmetic, …) invoke the corresponding dunder methods on the values you provide. Do not register anything with side effects (open, eval, importers, ORM objects, …) or pass in objects whose comparisons/arithmetic do something dangerous.
max_time is cooperative, not preemptive. It is only checked between AST node visits, so a single slow function call or a single expensive operation runs to completion regardless of the limit. Enforce hard timeouts out of process if you need them.
Exceptions are not all wrapped. Errors from operators and registered functions (e.g. ZeroDivisionError, TypeError, ValueError) propagate as their native types, not only as leval.excs.EvaluatorError. Catch broadly around evaluation.

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

leval-1.4.0.tar.gz (10.2 kB view details)

Uploaded Aug 13, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

leval-1.4.0-py3-none-any.whl (15.3 kB view details)

Uploaded Aug 13, 2026 Python 3

File details

Details for the file leval-1.4.0.tar.gz.

File metadata

Download URL: leval-1.4.0.tar.gz
Upload date: Aug 13, 2026
Size: 10.2 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for leval-1.4.0.tar.gz
Algorithm	Hash digest
SHA256	`859083230a3a1f334d58bd266a4109e7504c88be26eacffe2e77ae291f1f35d0`
MD5	`cfc60acb12211e5099e7f23d51598df1`
BLAKE2b-256	`1e9c6308a7b248eba9b45755b55a1de22ef5e16b18e40397e0ab9a5f360d32b0`

See more details on using hashes here.

Provenance

The following attestation bundles were made for leval-1.4.0.tar.gz:

Publisher: ci.yml on valohai/leval

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: leval-1.4.0.tar.gz
- Subject digest: 859083230a3a1f334d58bd266a4109e7504c88be26eacffe2e77ae291f1f35d0
- Sigstore transparency entry: 2450663159
- Sigstore integration time: Aug 13, 2026
Source repository:
- Permalink: valohai/leval@3f5c1914d15afbd836cbdf4e1b35607e314b0edc
- Branch / Tag: refs/tags/v1.4.0
- Owner: https://github.com/valohai
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: ci.yml@3f5c1914d15afbd836cbdf4e1b35607e314b0edc
- Trigger Event: push