Code Mode for AI agents: one program instead of many tool calls

Anthropic, OpenAI and Cloudflare have all shipped the same idea for AI agents: stop making the model call tools one by one, and let it write one small program that calls them instead. Cloudflare calls it Code Mode. Anthropic and OpenAI call it programmatic tool calling. Block's open source agent Goose ships it too.

MCP stays. Calling tools one at a time is what goes.

New to the protocol? Start with the MCP servers setup guide. If you build AI agents for your own business or for clients, this changes three things you care about: how many tools one agent can handle, what it costs per run, and whether your customers' data has to pass through the model at all. This guide maps the idea to real agent builds, with what each company says, in their words.

Read this guide: https://codewithnishant.dev/free/code-mode-ai-agents/ and audit the AI agent in this repository for Code Mode. List every tool it can call, how many tokens the tool definitions take, and which workflows chain 3 or more tool calls in a row. For each chained workflow, propose a version where the model writes one program that calls the tools in a sandbox and returns only the final result. Flag any step that moves customer data (emails, phone numbers, names) through the model's context and propose how to keep it out. Do not change code yet: give me a short plan, ranked by tokens saved, and ask before each change.

01. What changed, and who shipped it

02. Why one program beats many calls

Two problems with calling tools one by one

• Every result floods the model's memory. Anthropic's example: asking which of 20 employees went over their travel budget pulls 2,000+ expense lines into context the old way. With programmatic tool calling, Claude's context gets only the two or three people who went over, "reducing consumption from 200KB of raw expense data to just 1KB of results".
• Every call is a full trip through the model. Anthropic: when Claude runs 20+ tool calls in one code block, "you eliminate 19+ inference passes". On their complex research tasks, average tokens dropped from 43,588 to 27,297, a 37% cut.
• Tool definitions themselves cost tokens. Cloudflare measured its full API as one-tool-per-endpoint MCP at 1,170,523 tokens, against 1,069 for the two Code Mode tools. Per Cloudflare's table, that is 585% of a 200K context window.
• Models write code better than tool calls. Cloudflare's reasoning: models have read millions of real programs, but only a small set of made-up tool-call examples.

03. Which of your tools to put behind code

04. Keep customer data out of the model

For client work this matters more than the token savings. In Anthropic's code execution with MCP post, the agent harness swaps personal data for stand-in tokens before anything reaches the model, and swaps the real values back in when the next tool call needs them: "The real email addresses, phone numbers, and names flow from Google Sheets to Salesforce, but never through the model."

• Tokenize on the way out of the source tool. The program sees [EMAIL_1], not the address.
• Untokenize only inside the next tool call, in your client code, never in the prompt.
• Return counts and IDs to the model, not rows: "imported 412 contacts, 3 failed (rows 18, 51, 77)".
• Write the rule down for the client: which fields may ever reach the model. Usually none of the contact fields.

05. The sandbox rules

Model-written code runs on every request, so the sandbox is the product

• No file system and no secrets inside. Cloudflare runs the code in a V8 isolate "with no file system, no environment variables to leak through prompt injection and external fetches disabled by default".
• Only the tools you hand it. The program gets client objects for your tools, nothing else. Outbound network stays off unless you allow a host.
• Scoped credentials. Cloudflare's server downscopes the OAuth token to the permissions the user approved when connecting. Do the same per client.
• Time and memory limits, and log every program the model wrote, so you can replay a bad run.

06. Cut the token bill: three ways in

Cloudflare: the Code Mode SDK and the API server

Cloudflare's Agents SDK ships a codemode helper that wraps your tools and system prompt so the model writes code that calls them, MCP servers included. Their own example from the launch post:

import { codemode } from "agents/codemode/ai";

const { system, tools } = codemode({
  system: "You are a helpful assistant",
  tools: {
    // your tool definitions
  },
});

To try the two-tool Cloudflare API server in any MCP client, Cloudflare's config is:

{
  "mcpServers": {
    "cloudflare-api": { "url": "https://mcp.cloudflare.com/mcp" }
  }
}

Anthropic: programmatic tool calling + tool search

On the Claude Developer Platform you add the code execution tool and mark which of your tools may be called from code (allowed_callers), so Claude's script calls them and only the script's output comes back. Pair it with the Tool Search Tool: mark rarely used tools defer_loading: true and Claude loads them only when it searches for them. Anthropic reports an 85% cut in tool-definition tokens with tool search, and Opus 4.5 going from 79.5% to 88.1% on their MCP evaluations. Exact request fields: Anthropic's post and the API docs it links.

OpenAI: programmatic tool calling in the Responses API

OpenAI's version lets GPT-5.6 write and run JavaScript that coordinates your tools, in hosted V8 runtimes, so you do not manage containers. Check OpenAI's current API docs for the request fields before you build; I quote only their launch post here.

07. Is MCP dead?

No. The two Cloudflare tools, search() and execute(), are MCP tools. Goose's team wrote a whole post titled Code Mode Doesn't Replace MCP. Cloudflare's own argument for keeping it: MCP gives agents a uniform way to connect to a tool, handle authorization and read its docs, even when neither side has heard of the other. What changes is the model's job: it stops calling tools one at a time and starts writing the program that does.

08. Mistakes to avoid

• Running model-written code without a sandbox. Never on your own machine, never with production secrets in reach.
• Moving everything behind code. One-shot calls get slower, not cheaper.
• Returning raw rows to the model "just in case". That undoes the savings. Return summaries and IDs.
• Trusting the program blindly. The model must write correct code. Log each program and test the common workflows like any other code.
• Mixing clients. One sandbox config and one set of scoped credentials per client.

09. Copyable prompts

Find the workflows worth converting

List every tool call my agent makes in a typical run of [workflow]. For each call, show the tokens of its result that enter the context and whether the model actually needs them. Then write one program that does the same work in a sandbox and returns only [the final answer].

Keep customer data out

In this agent, find every place where emails, phone numbers or names enter the model's context. Propose a tokenize-before-model, untokenize-in-the-next-tool-call design, and show the exact functions to change. Do not edit yet.

Client handover note

Write a one-page note for my client explaining which tools their agent calls through code, what runs in the sandbox, which data fields can never reach the model, and what each run costs before and after the change. Plain words, no jargon.

FAQ

What is Code Mode?

Cloudflare's name for letting the model write code against your tools instead of calling each tool directly. The code runs in a sandbox and only the result goes back to the model.

Is programmatic tool calling the same thing?

The same idea. Anthropic and OpenAI both use that name for their API features: the model writes a program (Python for Claude's code execution tool, JavaScript for OpenAI's hosted V8) that calls your tools.

Is MCP dead?

No. Code Mode runs on top of MCP. Cloudflare's two tools are MCP tools, and MCP still handles the connection, the authorization and the docs.

How much does it save?

It depends on the workflow. Cloudflare: about 1,000 tokens instead of 1.17 million for its whole API. Anthropic: 150,000 tokens down to 2,000 in their code execution example, and 37% fewer tokens on average on complex research tasks with programmatic tool calling.

Does it keep customer data private?

It can. Anthropic shows a harness that tokenizes personal data before it reaches the model and restores it only inside the next tool call, so contacts move from Google Sheets to Salesforce without passing through the model. You have to build that layer.

When should I not use it?

For one-off calls and small tool sets used every time. Writing a program adds a step, and the model has to write correct code.

Pick the one workflow that chains the most tool calls, move it behind code, and measure the tokens before and after. If you hand agents to clients, pair this with keeping client data private.