What is Code Mode?

Code Mode is a way for an AI agent to call your tools by writing a short program instead of making one tool call per model turn. The code runs in a sandbox next to your server, loops and filters there, and returns only the final answer. Every call the program makes is still an ordinary, individually authorized tool call — what changes is that the intermediate data never travels back through the model.

Why forty tool calls cost more than forty tool calls

Ordinary MCP puts the model in the middle of every step. Ask “which open pull requests have failing CI, and who wrote them?” across forty pull requests and the agent makes one call, reads the whole response into its context, decides what to do next, calls again — forty-one times. Each intermediate payload is paid for twice: once in latency, once in tokens that stay in context for the rest of the conversation.

None of that data was the answer. It was scaffolding on the way to the answer, and the model had to hold all of it to get there.

What Code Mode changes

With Code Mode the agent writes the loop once and submits it as JavaScript. The program runs in a sandbox, calls your tools directly, filters and aggregates in place, and returns a value. The model sees the code it wrote and the answer that came back.

The work is identical — the same number of calls, against the same tools, through the same authorization path. What changes is who runs the loop.

The model spends one turn instead of one per call.
Intermediate payloads stay in the sandbox rather than accumulating in context.
Filtering happens where the data is, not after it has crossed the wire twice.

Every call is still a real, policed tool call

This is the part worth being precise about, because a sandbox that quietly bypassed the policy layer would be a serious regression rather than a feature. Inside the sandbox, a call to one of your tools becomes an ordinary tool call, dispatched through the same code path a direct request takes. Per-tool permissions, rate limits, upstream key injection, audit records and usage metering all apply exactly as they otherwise would.

The sandbox itself is deliberately small. Guest code gets your tools, a console, and standard JavaScript — no network, no filesystem, no host globals. It runs in a QuickJS interpreter compiled to WebAssembly, so even a flaw in the interpreter leaves the code inside a WebAssembly module whose only imports are functions we wrote.

What a program is not allowed to do

Tools are classified by effect: read, write, delete, or external effect. Reads and writes are permitted inside Code Mode; deletes and external effects are refused and must be called directly, where a human is closer to the decision. A tool whose effect cannot be determined is refused too, because an unclassified tool is not a safe default.

Each execution also carries a tool-call budget by plan, so a single mistaken or injected program has a bounded reach before anyone sees it. Budgets bound harm rather than cost — the calls themselves are metered at the ordinary rate.

When a program fails

A failure returns a structured digest rather than a stack trace: what class of error it was, where in the submitted code it happened with the surrounding lines, the shape of the values involved, and which calls had already committed an effect before it broke. The point is to let the agent correct its own code instead of guessing.

The full trace — every call, its arguments, its result and its timing — is recorded and can be fetched deliberately, rather than being returned into context by default. Recording everything and surfacing almost nothing is the same principle Code Mode itself runs on.

When to turn it on

Code Mode earns its keep when agents work over collections: filtering lists, joining two tools together, aggregating across pages. It does little for a server whose tools are called once at a time, and it composes with dynamic tool discovery rather than replacing it — discovery narrows which tools an agent sees, Code Mode changes how it calls them.

It can be off, available, or offered first. Ordinary tools stay listed under all three, so existing clients calling tools by name are unaffected.

Common questions

Does Code Mode let an agent bypass my tool permissions?

No. A call made from inside the sandbox is dispatched as an ordinary tool call through the same path a direct request uses, so per-tool permissions, rate limits, key injection and audit logging all apply. Destructive tools are refused inside the sandbox entirely and must be called directly.

What language does the agent write?

JavaScript. The program calls tools with `await tool(name, args)` and returns the final answer; loops, filtering and Promise.all all work. The server publishes a typed API listing of its tools as a fetchable resource, so the model reads real signatures rather than guessing.

Can the sandboxed code reach the internet or my filesystem?

No. The sandbox has no network access, no filesystem, and no host globals — only the tools you expose and standard JavaScript. It runs in a QuickJS interpreter compiled to WebAssembly, so the only functions reachable from guest code are the ones the runtime defines.

Does Code Mode cost more?

Each tool call a program makes is metered exactly as a direct call is, at the same rate — there is no separate Code Mode charge. In practice it usually costs less overall, because the model spends far fewer tokens and turns reaching the same answer.

Does it work on self-hosted servers?

Yes. The sandbox ships inside the runtime package, so an exported server running under Docker, Node or stdio serves Code Mode itself, with no call home. Dedicated container deployments run it the same way.