Code Mode

Let the agent write and run code against APIs instead of making discrete tool calls. The agent’s strongest trained skill (code) becomes the tool-use mechanism itself. Named and productized by Cloudflare (Sept 2025–2026); now the composition layer of choice across harnesses.

The core argument (Cloudflare, “code mode” — captured)

• Tool calls use special tokens LLMs have never seen in the wild — trained on synthetic data, fragile with many/complex tools. Hence MCP servers “dumb down” their APIs.
• Meanwhile LLMs write code against full, complex developer APIs just fine. Why? “LLMs have seen a lot of code. They have not seen a lot of tool calls.” The Shakespeare-in-Mandarin line: making an LLM use tool-calling is like putting Shakespeare through a month of Mandarin class and asking for a play — “it’s just not going to be his best work.”
• MCP survives as the uniform substrate: tools are “really just an RPC interface with attached documentation” — so expose them as a programming-language API instead of discrete tools. MCP still wins on uniform connectivity, auth, and doc delivery for APIs the agent’s developers never heard of. Code Mode doesn’t replace MCP; it changes how the agent consumes it (write code against it, not call it).

The mechanics (from the posts)

• MCP→TypeScript conversion: tools become typed functions with docs attached; the agent writes TS in a sandbox that proxies calls.
• Sandbox = Cloudflare Workers (“dynamic Worker loading: no containers here”) — startup in ms, network/permission fencing, per-run isolation; the Worker Loader API.
• The second post (code-mode-mcp, captured) extends it: code mode for MCP servers — run Codemode inside your server so visitors’ agents get composition + batching against your service, with your rate limits respected.

The 2026 diffusion (vault-captured)

• Cloudflare (origin; two posts) — the design everyone’s rediscovering, per LanLance24: “Pi and OpenCode are both writing Codemode blogs; most of it was already in Cloudflare’s articles last year.”
• Pi / mitsuhiko (lucumr.pocoo.org explainer, captured) — brains-vs-hands; QuickJS in a WASM sandbox (no network/fs/timers — “the only way is to call more tools”); larger outputs received structurally; probe-then-script pattern; harness-only APIs exposed via Codemode; “modern MCP is a fight,” Codemode-in-Codemode double-escaping pain; maybe Starlark over JS.
• Leviathan/CLIs-for-agents lane — same thesis at data tier: full-text index + cited cards beats tool-per-operation.

Why it matters

• Composition moves into the model’s best medium. Loops, batching, filtering, joins — things tool-call agents do stepwise with context bloat — become one code block.
• Context economics: structural ingestion instead of serialized dumps (kin: AI metrics that actually matter — fewer tokens per task).
• Security story improves: the sandbox boundary is explicit and inspectable (LLM security runtime lane; Agent sandbox).
• It does not obviate MCP reconsidered’s desires (structured content, consistent results, large binaries) — Codemode consumes the protocol better; the server-side contract still needs fixing.

Vault kin

• MCP reconsidered — the protocol critique Codemode answers; Ronacher’s Codemode writeup wired there
• MCP — the substrate being consumed
• pi durable — Codemode invocations + durable-workflow snapshotting convergence (Ronacher)
• Agent sandbox / LLM security — execution fencing
• CLIs for agents — the sibling lane (expose CLIs, not schemas)