What Is MCP Code Mode? Fewer Tokens and Round Trips for AI Agents

TL;DR: With plain MCP, an AI agent calls one tool, reads the whole result, decides, calls the next tool, and so on. Every step is a round trip through the model, and every intermediate result passes through its context window. Code mode lets the agent (or an administrator, ahead of time) write a short JavaScript program that makes those calls, filters and joins the results, and returns only the answer. In AnythingMCP the program runs in an isolated runner that can reach nothing but the MCP tools the caller is already allowed to use. Code mode is available in self-hosted AnythingMCP from v0.52.0 and coming soon to AnythingMCP Cloud; it is off until you turn it on.

The problem: tool calls go through the model

Take a question a sales lead might ask an assistant connected to the CRM and the ERP:

"Which of our open quotes belong to customers who still have an overdue invoice?"

With one tool call per step, the agent:

1. calls the CRM to list the open quotes (say 40 of them) and reads all 40 into its context;
2. calls the ERP once per customer to look up open invoices: 40 more calls, 40 more results in the context;
3. compares them in its head and writes the answer.

Each call is a turn: the model writes the call, the client runs it, the result goes back into the model, the model reads it and writes the next call. The full results stay in the context, although the answer needs perhaps five lines. That costs tokens (everything the model reads is billed and counts toward its context window), time (dozens of turns), and accuracy (comparing 40 lists by reading them is where models slip).

The idea: let the model write a program instead

Language models are good at writing short programs. So instead of making the calls itself, the agent writes one:

const quotes = await amcp.run('crm_list_open_quotes', {});
const overdue = [];
for (const q of quotes) {
  const invoices = await amcp.run('erp_open_invoices', { customer: q.customerId });
  const late = invoices.filter((i) => i.dueDate < new Date().toISOString().slice(0, 10));
  if (late.length) overdue.push({ quote: q.number, customer: q.customerName, overdueInvoices: late.length });
}
return overdue;

Tool names are illustrative; in practice they are the tools of your connectors.

The program runs next to the tools. The 40 quote records and 40 invoice lists never enter the model's context; only the returned list does. One turn instead of forty-one. The idea was popularised in 2025 under names like "code mode" and "code execution with MCP"; AnythingMCP implements it as a governed feature of the gateway.

Three forms in AnythingMCP

Saved code tools. An administrator writes a program once and saves it as a tool, for example customer_overview(customer), which reads the ERP and the CRM and returns one summary. To the AI client it is an ordinary MCP tool: listed, permissioned per role, audited. The agent just calls it. Build your first code tool.

Inline code (code_execute). On servers where it is enabled, the agent can write and run a program on the spot, over the tools the user may use. Always read-only, always with the caller's own permissions.

Proposals (code_propose_tool). When the agent notices a multi-step pattern worth keeping, it can propose it as a saved code tool. The proposal runs nothing and creates nothing; an administrator reviews the program and clicks Create tool. How proposals are approved.

What keeps it safe

Code written by a model is untrusted by construction: a prompt-injected tool result can steer what the model writes. So AnythingMCP never runs it in its own process. Every run goes to a separate code-runner service, one locked-down subprocess per run, with no network, no filesystem, no environment variables and no secrets. The only way out is amcp.run, which the gateway answers under the caller's role, with the same read/write rules as a direct tool call. Every run and every tool call inside it is in the audit log. The full model: Secure code execution for AI agents.

When code mode helps, and when it does not

It helps when the work is mechanical and repetitive: the same lookup for 100 articles, a sum across two systems, matching invoices to orders, a report that always takes the same five calls. See three recipes.

It does not help when there is one call to make (a program around a single call only adds a step), or when every step needs the model's judgement on what it just read ("read this contract and decide what to check next"). Writes are deliberately restricted: inline code never writes, and a saved code tool may call write tools only if an administrator allows it, on Enterprise.

Availability and limits

Per edition, as announced with v0.52:

A single run is limited to 10 seconds, 500 tool calls (16 at a time), and 1 MB of returned data. Code tools are served only on a workspace's own MCP servers, never on the shared /mcp endpoint used by directory AI clients. Compare plans.

FAQ

Is code mode a replacement for MCP? No. It is a way of using MCP tools. The program calls the same tools the agent could call directly, through the same gateway and permissions.

Which AI clients support it? All of them. A saved code tool is a normal MCP tool, and code_execute is a normal tool that takes a program as its argument. Claude, ChatGPT, Copilot, Gemini and Cursor can call both.

Which language? JavaScript, as the body of an async function. No imports, no packages: the program has amcp and the language itself.

How much does it save? It depends entirely on the task. A single lookup saves nothing. A task that would read dozens of intermediate results into the context saves most of those tokens and turns, because only the return value goes back to the model.

Related

• Build your first code tool, step by step: ERP orders and CRM account in one call
• Secure code execution for AI agents: how the isolated runner works
• Code mode recipes: monthly revenue, invoice reconciliation, 100 price lookups
• The agent proposes a code tool, the admin approves it
• What is MCP?
• MCP governance, user roles and permissions