<- all tokdocs
2026.09.17@agentic.james

Code Mode MCP: Replacing a Wall of Tool Schemas With One Execute Call

AI
Watch on TikTok

View on TikTok ->

Code mode MCP is a real, documented pattern with primary write-ups from both Anthropic and Cloudflare, and the video describes its mechanics accurately. James argues that instead of registering dozens of MCP tools whose schemas all sit in the context window, you register one tool that runs a script, and the script calls whatever tools it needs. The hand-drawn slides in the video show the two claims he leans on: compose tools (search, describe, call tool A and tool B, combine, emit) and less context (hundreds of tool schemas loaded up front versus one execute tool). He names Docker's gateway and the Executor gateway as implementations. The pattern checks out. The specific product claims need a closer look.

What the pattern actually changes in the protocol

The MCP spec defines tools/list for discovery and tools/call for invocation. Each tool definition carries a name, a description, and a JSON Schema for its inputs. A client that connects five servers with twenty tools each pulls a hundred definitions into the model's context before the user has typed anything, and every intermediate result flows back through the context on its way to the next call.

Code mode does not modify the protocol. It changes what the gateway advertises. The gateway exposes one or two tools, typically a search function and an execute function, and hides the rest behind a code API. The model writes a script that calls tools.github.listIssues() or similar, the gateway runs it in a sandbox, and only the script's return value reaches the model. Filtering happens inside the sandbox, so a 40,000-token JSON response can be reduced to the five fields the agent wanted before it costs a single context token.

Cloudflare published the first well-known write-up of this on 26 September 2025, authored by Kenton Varda and Sunil Pai. Their argument is that models have seen far more code than tool-call traces in training, so presenting an MCP server as a TypeScript API produces better results than presenting it as function-calling schemas. They run the generated code in V8 isolates rather than containers, which start in milliseconds. Anthropic published its version on 4 November 2025, using a filesystem of TypeScript files on disk as the tool API.

The token numbers exist, but they are vendor examples

The video says code mode reduces context consumption. It does not cite figures, which is the honest move given what is actually published.

Anthropic's post reports one worked example: downloading a meeting transcript from Google Drive and attaching it to a Salesforce lead record went from roughly 150,000 tokens to roughly 2,000, a 98.7% reduction. The saving comes from two places, not loading every tool definition up front and not passing the full transcript through context twice.

Cloudflare's February 2026 follow-up reports that exposing its 2,500-endpoint API through a search and execute pair costs about 1,000 input tokens, against an estimated 1.17 million tokens for an equivalent conventional MCP server. That is a 99.9% figure on their own API.

Both numbers come from the companies selling the approach, and both describe favorable cases. A workflow with three tools and small payloads will see very little. Cloudflare's original September 2025 post contains no benchmarks at all, only the qualitative argument. I found no independent benchmark of code mode against conventional MCP across a varied task set.

The CLI comparison is right and incomplete

James says code mode is similar to CLI tools in being composable, with the added benefit that its description loads into the agent's context automatically so the agent knows it is there. That is accurate. A CLI only helps if the agent has been told the CLI exists, usually through a system prompt or a project instruction file, whereas an MCP tool description arrives through tools/list on connection.

What the video skips is that the same discovery gap applies inside code mode. Once the gateway hides its tools behind an execute function, the agent has to search for tools before it can call them, which is why every implementation ships a search or describe step alongside execute. The slide in the video shows this correctly (search, then describe, then call). The context cost moves from a fixed up-front load to a variable per-task lookup. That is usually cheaper, and it is not free.

What is verifiable about Executor and Docker

Executor is real. The site at executor.sh describes itself exactly as the video's screen recording shows, "Executor is an MCP gateway," with the three-step pitch and Cloud and Self-hosted tabs. It is a Y Combinator Summer 2026 company founded by Rhys Sullivan, previously at Vercel. The source is on GitHub under the MIT license at UsefulSoftwareCo/executor, and it can be self-hosted on Docker or Cloudflare, run as a CLI, or run as a desktop app.

The video calls it "completely free, self-hostable." Self-hosting is free, which matches. The cloud tier is free for up to three people, and the paid Team tier is $15 per member per month. The frame captured in the video also shows a monthly execution cap on the free cloud tier, so "completely free" applies to the self-hosted path more cleanly than to the hosted one.

The single-tool shape is less clear from Executor's own documentation than the video implies. The homepage says "Give your agent the Executor tool," singular, and describes running TypeScript in a sandboxed runtime where credentials attach host-side so secrets never enter the model's context. The MCP proxy documentation page describes something different, a shared catalog where upstream MCP servers, OpenAPI specs, and GraphQL endpoints all appear as tools to the agent. Whether an agent connecting to Executor sees one execute tool or a full catalog is not settled by the public docs I could read.

Docker's gateway does have this, as the video says. The docker/mcp-gateway dynamic MCP feature exposes mcp-find, mcp-add, mcp-config-set, mcp-remove, mcp-exec, and a code-mode tool that builds custom JavaScript tools combining several servers. Docker's own documentation marks dynamic MCP as experimental and says code mode specifically is "in early development and is not yet reliable for general use," and deliberately omits usage examples. The video mentions Docker's implementation without that caveat.

The security cost the video does not mention

Ninety-six seconds is not much room for caveats, but this one matters. Anthropic's post states it plainly: running agent-generated code requires a secure execution environment with sandboxing, resource limits, and monitoring, and that operational overhead is a cost direct tool calls avoid. Cloudflare solved it by using V8 isolates with no internet access, reaching MCP servers only through explicit bindings. Docker solved it by putting each MCP server in its own container with constraints applied by default.

There is a second cost that is easier to miss. When an agent filters output inside the sandbox, the filtering itself is model-generated code, and a wrong filter drops data silently. A conventional tool call returns whatever the server returns, and the model sees all of it. Code mode trades some observability for the token savings. The MCP specification's own security guidance asks clients to keep a human in the loop and show tool inputs before calling, which is harder to do meaningfully when the input is a script rather than a named tool with typed arguments.

Key Takeaways

  • Code mode MCP exposes one execute tool that runs generated code against your other MCP tools, which keeps tool schemas and large intermediate results out of the context window.
  • The pattern is documented by Cloudflare (September 2025, February 2026) and Anthropic (November 2025). The video describes it correctly.
  • The published token savings, 98.7% in Anthropic's example and 99.9% on Cloudflare's own API, are vendor-reported single cases. No independent cross-task benchmark surfaced in my search.
  • Executor is verifiable: MIT licensed, on GitHub, YC Summer 2026, founded by Rhys Sullivan. Self-hosting is free, cloud is free for up to three people, Team is $15 per member per month.
  • Docker's code-mode tool exists but Docker's documentation calls it early development and not yet reliable for general use, which the video does not mention.
  • Unverified: the 30-minute tutorial and the Skool community referenced in the video are behind a bio link I did not open, so I cannot confirm their contents. I also could not confirm from Executor's public docs whether an agent sees a single execute tool or a full tool catalog, since the homepage and the MCP proxy docs describe it differently.
  • Running model-written code needs a sandbox, resource limits, and monitoring. That overhead is the real price of the token savings, and the video does not raise it.

Resources

Published September 17, 2026. Writeup generated from a favorited TikTok.