Code Mode MCP: What It Fixes and When It Hurts

There is a number going around about MCP that sounds too good to be true. Cloudflare says it took the cost of handing an agent its entire API, more than 2,500 endpoints, from 1.17 million tokens down to roughly 1,000. Anthropic says a similar trick took a Google Drive to Salesforce job from 150,000 tokens to 2,000. Both numbers are published by the companies that built the thing, and both are real.

They come from the same idea, and it has a name. Code mode. Instead of showing the model a list of tools and asking it to pick one, you show it a TypeScript API and ask it to write code. The code runs in a sandbox. Only the answer comes back.

It works. I want that on the record before the rest of this post, because most of the rest of this post is about the cases where it does not. Anthropic’s own tool documentation says standard tool calling is the better fit below ten tools. Almost nobody quoting the 98.7% figure mentions that line.

What is code mode MCP?

Code mode is a pattern where an agent writes and runs code that calls your tools, rather than calling those tools directly. Cloudflare coined the name in a September 26, 2025 post arguing that models are simply better at writing code to call MCP than at calling MCP directly.

The reasoning is about training data. A model has read millions of lines of real code that calls real APIs. It has read a much smaller pile of contrived tool-call examples. So you play to the strength it already has.

Mechanically it looks like this. The runtime reads your MCP server’s schema, generates TypeScript type definitions with doc comments, and hands the model those definitions plus one tool that executes code. The model writes a snippet. The snippet runs in a disposable V8 isolate. Whatever the snippet returns is what enters the conversation.

That last sentence is the whole trick, and it is worth sitting with. In normal tool calling, every result passes through the model. Pull 800 rows to find 3, and all 800 rows land in the context window. In code mode, the filtering happens in the sandbox. Three rows come back.

Where the token numbers come from

Three published figures dominate the conversation. They measure different things, which is why they disagree so wildly.

Read the right-hand column before the numbers. Cloudflare’s 1.17 million token baseline is what you would spend if you loaded 2,500 API endpoints as 2,500 separate tool definitions. Nobody has ever shipped that. It is not a configuration people were running and then fixed. It is the theoretical cost of a thing code mode makes possible for the first time.

Anthropic’s 150,000 is closer to a real workload. Pulling a long meeting transcript out of one system and pushing it into another means the entire transcript passes through the model twice, once on the way out and once on the way back in, for no reason at all. That one is a genuine before-and-after, and the Anthropic engineering post describes it as a 98.7% saving in time and cost.

The 55,000 figure is the most useful of the three, because it describes what a working developer’s setup actually costs. Five connected servers, nothing exotic, and a third of a 200k context window is gone before anyone types a word.

Why does writing code beat picking a tool?

Three things happen at once here, and they get conflated constantly.

Fewer definitions in context: you show the model one execute tool instead of two hundred named ones. That is a load-time saving.

Smaller results coming back: the sandbox filters, sorts, joins and counts before anything reaches the model. That is a run-time saving, and on data-heavy work it is much larger than the first one.

Control flow in a single turn: a loop over 50 records is one code block, not 50 round trips. Conditionals, retries and joins all collapse into one execution instead of one conversation turn each.

There is a fourth benefit that gets less attention and deserves more. Data the model never sees cannot leak into a transcript. Anthropic points out that intermediate results stay in the execution environment, so personal data can be processed and even tokenized without entering the context window at all. If you have ever refused to connect a production database to an agent because of what would end up in the logs, that is the argument that should move you.

What code mode costs you

Every writeup leads with the savings. The costs are real and they are mostly not about tokens.

You lose the reviewable prompt. With standard tool calling, the approval dialog says the agent wants to run delete_project with these arguments. You can read that in a second. With code mode, the approval dialog shows fifteen lines of TypeScript, and now you have to audit code under time pressure to decide whether to click yes. That is a downgrade in safety wearing the costume of an upgrade in efficiency.

Error handling gets vaguer. A failed tool call returns a specific error the model can reason about and retry differently. A failed code block returns whatever the sandbox says, which is often generic. The model has less to work with.

You now run a sandbox. Anthropic says this plainly in the same post that reports the 98.7% saving. Code execution needs secure isolation, resource limits and monitoring, and those costs should be weighed against the benefits. Cloudflare’s implementation blocks outbound network access by default and gives the isolate no filesystem, which is the right default and also a reminder of what you are containing.

It does not do your authorization for you. Cloudflare’s own documentation states that code execution does not replace authorization, and that permissions must still be enforced inside the upstream tool handlers. Sandboxing the code does not sandbox the credentials the code is allowed to use.

Code mode, tool search, or neither?

Code mode is not the only fix, and it is not the first one to reach for. Anthropic’s tool search tool attacks the same problem from the other end. You send every tool definition as usual, mark the rarely used ones with defer_loading: true, and the model searches for what it needs instead of carrying all of it. The docs report over 85% less context spent on definitions, with only the 3 to 5 relevant tools loaded on demand.

The honest ordering is right to left. Cut the tools you do not need. If you still have too many, defer-load them. If the problem is not the tool list but the size of what comes back, then code mode is the one that helps, and nothing else on that table does.

When is code mode worth it?

Reach for it when at least one of these is true.

• You are aggregating many servers and the tool count runs into the hundreds. Tool selection accuracy starts degrading past 30 to 50 tools, per Anthropic’s own measurements.
• Your workflow moves large payloads between systems. Transcripts, exports, log files, anything where the model is acting as a very expensive pipe.
• You need real control flow. Loops over records, joins across two systems, conditional retries.
• Sensitive data must not enter the transcript.

Skip it when your server is small and your results are small. Anthropic’s guidance is specific here. Standard tool calling is the better fit below 10 tools, when every tool gets used on every request, or when the definitions total under 100 tokens.

The part nobody selling code mode says out loud

Most MCP servers do not have this problem. They have the problem of being installed alongside eleven others.

That 55,000-token figure is not a fact about MCP. It is a fact about someone who connected GitHub, Slack, Sentry, Grafana and Splunk and left all five switched on. Every one of those servers is well built. Together they eat a third of the window before work starts. The fix that costs nothing is turning off the four you are not using today, and it is the fix almost nobody writes a blog post about, because there is no SDK to sell alongside it.

I build MCP servers, so let me make this concrete with my own. ContextBolt SEO ships six tools plus a free credit check. Seven. Putting it behind code mode would add a sandbox, remove the readable approval prompt, and save a few hundred tokens of definitions that were never the bottleneck. It would make the product worse in exchange for a metric nobody using it cares about.

That is the test worth applying to any server. Count your tools. Measure your definitions. If both numbers are small, code mode is solving somebody else’s problem, and the tool count is a design decision rather than a fact of nature. A server with 47 tools is usually a server that never decided what it was for.

How to try it

Cloudflare ships the pattern in its Agents SDK, in two shapes. codeMcpServer() wraps an existing MCP server so the model gets generated TypeScript definitions plus a single execute tool. openApiMcpServer() handles the very large case, exposing search() and execute() against an OpenAPI document, which is the configuration behind the 1,000-token claim.

On the Anthropic side, the lighter move is tool search. Add tool_search_tool_regex_20251119 or the BM25 variant to your tools array, set defer_loading: true on everything you do not need immediately, and leave your three to five most-used tools loaded. If your tools arrive through the MCP connector, that flag goes on the toolset’s default_config rather than on individual definitions.

Measure before and after. The reason the published numbers vary by three orders of magnitude is that everyone is measuring a different baseline, and yours is the only one that decides anything.

What I would actually do

Start by counting. If your tool definitions cost under 10k tokens, do nothing. If they cost 50k, turn servers off. If they still cost 50k after that, defer-load them. Only when the problem is the size of what comes back, rather than the size of what goes in, does the sandbox earn its keep. The same instinct applies to how you structure anything an agent has to read, which is that the unit of retrieval should be small on purpose.

Code mode is a genuinely good idea aimed at a genuinely large problem, and it is being sold to a lot of people who do not have that problem yet. The framing that survives contact with a real project is the one Anthropic buried in a documentation page rather than a launch post. Below ten tools, plain tool calling wins.

If you want to see what a deliberately small server feels like, ContextBolt SEO is one. Six tools, one URL, live keyword, difficulty, SERP, domain and competitor data inside Claude Code, Claude Desktop or Cursor. No dashboard to learn and no sandbox to run. It starts with a 7-day free trial, then $35 a month with 1,000 lookups included, and the full SEO MCP server comparison is there if you want to see how it stacks up first.