Code mode for MCP
Run many MCP tools in one step and stop paying for data the model never needed
On a data-heavy task a tool-at-a-time agent makes dozens of calls and reads every intermediate list into the context window. Code mode lets the agent write one short program that calls your MCP tools, filters and joins their results in a locked-down sandbox, and returns only the answer. On multi-step workflows this cuts token usage by up to 90–99% — and it is faster.
Live on AnythingMCP Cloud and self-hosted · off by default · runs in an isolated sandbox with no network, filesystem or secrets · every run audited
What is code mode?
Code mode is a way for an AI agent to call your MCP tools from inside a short program instead of one tool at a time. Rather than making a separate round trip for every tool — each result travelling back through the model — the agent writes a small piece of JavaScript that discovers, reads and runs several tools, filters and joins their results, and returns only what matters. The program runs in a sandbox next to the data, so the megabytes of intermediate rows it filters over never enter the model's context window.
MCP (Model Context Protocol) is the open standard Claude, ChatGPT, Copilot and Cursor use to call external tools. Code mode is an AnythingMCP capability on top of it, available on Cloud and self-hosted.
Why multi-tool agents burn so many tokens
One tool, one answer is cheap. The cost explodes when a task needs several tools and the model has to read everything in between.
A round trip per tool call
Ask an agent to join orders, customers and invoices and it calls one tool, reads the result, calls the next, reads that — dozens of round trips, each one a full pass through the model.
Intermediate data fills the context
The model pulls every intermediate list — hundreds or thousands of rows — into its context window just to keep a handful of ids at the end. You pay for all of it, token by token.
Cost scales with the data, not the answer
On a filter-and-join task the intermediate rows, not the final answer, dominate the bill. Double the data behind the tools and the token cost doubles with it.
And it is slow
Every round trip waits on the model. A dozen sequential calls with large results is not just expensive, it is noticeably slower than running the loop once, next to the data.
The same task, with and without code mode
“List the open invoices for every customer active this year.” A tool-at-a-time agent reads thousands of rows to answer it. Code mode reads none of them into the model.
search invoices → model reads 400 rows
list customers → model reads 1,200 rows
for each open invoice, fetch its customer
→ hundreds of calls, every result read backThe model drives every step and reads every result. Thousands of rows pass through the context window to return a short list.
// Discover, read and call your tools inside the sandbox.
const invoices = await amcp.run('list_invoices', { status: 'open' });
const customers = await amcp.run('list_customers', { activeSince: '2026-01-01' });
const active = new Set(customers.map((c) => c.id));
return invoices
.filter((i) => active.has(i.customerId))
.map((i) => ({ id: i.id, amount: i.amount, customer: i.customerId }));The model writes one program; only the result returns. The 1,600 rows it filtered over never enter the context window.
On multi-step, filter-heavy tasks this cuts token usage by up to 90–99%, and it runs faster because the loop executes next to the data instead of through the model.
How AnythingMCP does code mode
Code mode uses the same tools, roles and audit log as a direct tool call — nothing new to trust, and nothing runs until you opt in.
An amcp bridge to your tools
Inside the sandbox a program calls amcp.search to find tools, amcp.describe to read their schemas and amcp.run to call them. It reaches exactly the tools the caller is already allowed to use — no more.
Saved code tools
A reusable tool whose body is a stored program, created in the dashboard like any other tool. It shows up in the tool list, obeys role access and is audited — perfect for a workflow your team runs again and again.
Inline code
A generic Run code tool the agent calls with a program it writes on the spot, always read-only and with the caller's own permissions. An agent can also propose a saved code tool for an admin to approve.
Read the code mode guideOff until you turn it on
Code mode is off by default. A workspace enables it per MCP server — saved code tools, or saved tools plus inline code — and inline code is further gated by the caller's role. Nothing runs until you opt in.
Bounded every run
Each run is capped by a time limit, a memory ceiling and a limit on how many tool calls it may make, so a runaway loop stops itself. Monthly run quotas and per-organisation concurrency keep one workspace from starving the rest.
Reach and rules unchanged
A program can only call tools the caller already has, under the same role access and read/write rules as a direct call, and every run is written to the audit log. Write-enabled code tools are an Enterprise feature.
Untrusted by design
A program is written by a model, and a prompt-injected tool result could try to steer it. So code mode never runs in the AnythingMCP backend — it runs in a separate code-runner that can do nothing but call your tools.
One locked-down subprocess per run
Every run gets its own short-lived subprocess, created fresh and torn down afterwards. Nothing leaks from one run to the next.
No network, filesystem, env or secrets
The sandbox has no outbound network, no filesystem, no environment variables and no access to stored credentials. The only thing a program can do is call MCP tools through the amcp bridge.
The caller's own permissions
The backend answers each bridge call under the caller's role and permissions. A program cannot reach a tool, a connector or a record the person running it could not reach directly.
Audited and bounded
Every tool call a program makes is recorded, and the run is bounded by a time limit, a memory ceiling and a cap on the number of calls. There is no way for a run to quietly run forever.
Two ways to use it
Save the workflows you repeat; let the agent improvise the one-offs. Both obey the same access rules and audit log.
Saved code tools
A reusable tool whose body is a stored program. Create it in the dashboard, give it a name and parameters, and it appears in the tool list like any other tool. Included from the Starter plan up.
Inline code
A generic Run code tool the agent calls with a program it writes on the spot — always read-only, with the caller's own permissions. On Team and above.
Agent proposals
An agent can draft a saved code tool and propose it for an admin to review and approve, so a good one-off becomes a governed, reusable tool. On Team and above.
Where it runs
The same open-source code runs in both deployments, and code mode behaves the same way in each.
Self-host with Docker
Run the bundled code-runner service next to AnythingMCP on your own servers. It is a separate, locked-down process, so a run is isolated from your backend and your data. Saved code tools are included from the Starter tier; write-enabled code tools come with Enterprise.
Open on GitHubAnythingMCP Cloud (EU)
On AnythingMCP Cloud the code-runner is managed for you, on isolated infrastructure in Frankfurt, Germany. Nothing to install or operate: enable code mode on an MCP server, connect it to your AI client and run a multi-step task. Start with a free 7-day trial.
Try it freeQuestions about code mode
What is code mode in MCP?
Code mode lets an AI agent call your MCP tools from inside a short program instead of one tool at a time. The agent writes a small piece of JavaScript that discovers, reads and runs several tools, filters and joins the results in a sandbox, and returns only the answer. The intermediate data never enters the model's context window, which is what cuts token usage.
How much does code mode reduce token usage?
On multi-step, filter-heavy workflows — the kind that would otherwise make dozens of tool calls and read every intermediate list — code mode typically cuts token usage by up to 90–99%, because only the final result returns to the model. On a single tool call there is nothing to save; the gain grows with the number of calls and the size of the data in between.
Is it safe to let an AI agent run code?
Code mode never runs in the AnythingMCP backend. Each run executes in a separate, locked-down subprocess with no network, no filesystem, no environment variables and no access to stored secrets. The only thing a program can do is call the MCP tools the caller is already allowed to use, through the amcp bridge, under that caller's role and read/write rules. Every run is audited and bounded by a time limit, a memory ceiling and a cap on tool calls.
Is code mode on by default?
No. Code mode is off until a workspace turns it on, per MCP server — saved code tools, or saved tools plus inline code. Inline code is further gated by the caller's role. A program can only reach the connectors the server exposes and the tools the caller already has.
Which plans include code mode?
Saved code tools are included from the Starter plan up (with a per-plan limit on how many you can save). Inline code and agent proposals are on Team and above. Write-enabled code tools are an Enterprise feature. Monthly run quotas and per-organisation concurrency scale with the plan. See the pricing page for the exact numbers.
Does it work with Claude, ChatGPT, Copilot and Cursor?
Yes. Code mode is exposed through the same standard MCP endpoint the gateway already serves, so any client that supports remote MCP servers can use it. Saved code tools appear in the tool list; inline code appears as a Run code tool. Connect the server to your client and ask it to run a multi-step task.
Do I need to run anything extra to self-host it?
Self-hosted, code mode uses a bundled code-runner service that runs alongside AnythingMCP — a separate, locked-down process so runs stay isolated from your backend. On AnythingMCP Cloud the runner is managed for you. The repository documents how to run it.
Related pages
Code mode guide
How code mode cuts token usage, with a before/after example and the safety model.
MCP gateway
One MCP endpoint for all your systems, self-hosted or EU cloud.
Pricing
What each plan includes, Cloud and Enterprise.
Connector marketplace
Ready-made connectors the tools behind your code can call.
Enterprise
Write-enabled code tools, SSO, SCIM and more.
Who builds AnythingMCP
The team, the company and how we work.
Stop paying for data the model never needed
Enable code mode on AnythingMCP Cloud, or run it on your own servers, and let your agents answer data-heavy tasks in one step.