> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tracecat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Python script

## `core.script.run_python`

Execute a Python script.

### Inputs

<ParamField path="script" type="string" required>
  Python script to execute. Must contain at least one function. If multiple functions are defined, one must be named 'main'. Returns the output of the function.
</ParamField>

<ParamField path="allow_network" type="boolean">
  Whether to allow network access during script execution. Default is False. Note: package installation always has network access.

  Default: `false`.
</ParamField>

<ParamField path="dependencies" type="array[string] | null">
  Optional list of Python package dependencies to install via pip. Packages are cached between executions for performance.

  Default: `null`.
</ParamField>

<ParamField path="env_vars" type="map[string, string] | null">
  Environment variables to set in the sandbox. Use this to inject secrets or configuration.

  Default: `null`.
</ParamField>

<ParamField path="inputs" type="object | null">
  Input data passed as function arguments to the main function. Keys must match the parameter names in the function signature. Missing parameters will receive `None`.

  Default: `null`.
</ParamField>

<ParamField path="timeout_seconds" type="integer">
  Maximum execution time in seconds. Default is 300 seconds (5 minutes).

  Default: `300`.
</ParamField>

### Examples

**Enrich a payload**

```yaml theme={null}
- ref: normalize_findings
  action: core.script.run_python
  args:
    inputs:
      findings: ${{ TRIGGER.findings }}
    script: |
      def main(findings):
          return [
              {
                  "id": finding["id"],
                  "severity": str(finding["severity"]).lower(),
              }
              for finding in findings
          ]
    timeout_seconds: 60
```