I think we're don't do that because it's too dangerous and user would have too much privileges. I'm referring to something like AWS Lambda, but handled by your library on your web server. Say you can run JS snippet only for 10ms and the only global non-standards variables are those that contain data that can be queried. Or even pass them through function params, look:

ctx => ctx.users.filter(u=>u.name.contains('Janusz')).slice(0,10);

And that will return 10 firsts users as JSON.