Codemode vs. MCP: Code as Orchestration Replaces Direct Tool Calling

Pi, OpenCode, Cloudflare, Block's Goose, Hugging Face's smolagents, and Anthropic have converged on a "Code as Orchestration" architecture that replaces direct Model Context Protocol tool calling with model-written JavaScript executed in an isolated QuickJS sandbox, according to a technical comparison. The article reports that preloading MCP tool schemas into the prompt costs 13,700 tokens for Playwright MCP's 21 tools, 18,000 tokens for Chrome DevTools MCP's 26 tools, and over 1.17 million tokens to expose Cloudflare's 2,500 API endpoints, exceeding production context windows. Pi creator Mario Zechner demoted MCP to an internal runtime library in Pi 0.99 after originally running the agent on four primitives: read, write, edit, and bash.

On this page Codemode vs. MCP: Code as Orchestration Replaces Direct Tool Calling Exposing MCP tools to language models burns 30,000 tokens on startup and turns the model into a single-step processor. Pi, OpenCode, Cloudflare, and Goose replaced tool calls with code. The industry adopted Model Context Protocol MCP as the integration standard of 2025. Direct model exposure turns that standard into an architectural bottleneck. When I wrote about Pi Agent https://kondasamy.com/blog/2026/pi-agent-multi-tool-workflow/ a few months ago, Mario Zechner avoided MCP entirely. Pi ran on four primitives: read, write, edit, and bash. Then Pi 0.99 shipped with native MCP support. Pi demoted MCP to an internal runtime library. Through a pattern called Codemode https://pi.dev/docs/latest/codemode which Zechner explored in his essay on skipping traditional MCP https://mariozechner.at/posts/2025-11-02-what-if-you-dont-need-mcp/ , Pi moves tool schemas out of the prompt and into an isolated QuickJS sandbox. Instead of emitting JSON function calls, the model writes JavaScript. OpenCode https://github.com/anomalyco/opencode , Cloudflare https://blog.cloudflare.com/code-mode/ , Block’s Goose https://goose-docs.ai/docs/guides/managing-tools/code-mode , Hugging Face’s smolagents https://huggingface.co/docs/smolagents , and Anthropic https://www.anthropic.com/engineering/code-execution-with-mcp converged on the same architecture: Code as Orchestration . The 30,000-Token Preload Penalty Traditional MCP clients connect to a server, call tools/list , and dump every tool’s JSON Schema into the model’s system prompt before the user types a single word. Every parameter name, description, enum value, and type definition occupies context space. Connecting multiple MCP servers exhausts the context window: - Playwright MCP : 21 tools consume ~13.7k tokens roughly 6.8% of a 200k context window . - Chrome DevTools MCP : 26 tools consume ~18.0k tokens 9.0% of context . - Cloudflare API : Exposing its 2,500 endpoints as traditional MCP tools requires over 1.17 million tokens , exceeding the context window of production models. Traditional MCP Startup Cost: ───────────────────────────────────────────────────────────── Playwright MCP 21 tools : 13,700 tokens Chrome DevTools MCP 26 tools : 18,000 tokens Two connected servers: 31,700 tokens burned upfront Cloudflare Full API 2,500 eps : 1,170,000 tokens impossible ───────────────────────────────────────────────────────────── This preload penalty causes tool dilution . When an LLM faces forty detailed JSON schemas at once, routing accuracy drops. The model confuses similar operations, hallucinates parameter names, and re-reads every schema on subsequent turns. You pay for all forty tools on turn ten, even when the task touches one. The Single-Step CPU Anti-Pattern Traditional MCP breaks control flow. A standard ReAct Reasoning + Acting loop treats the LLM like a clock cycle in a single-instruction processor. Checking 50 pull requests requires fifty separate network turns: 1. The model emits a tool call: github.list prs . 2. The runtime executes the call and injects the raw JSON response into the prompt. 3. The model inspects the response and emits the next tool call: github.get pr details { id: 1 } . 4. The runtime injects the details. 5. The model repeats this sequence 50 times. // Traditional MCP: 50 full LLM inference round-trips // Total time: ~150 seconds. Total context: 250,000+ tokens. for const pr of prs { // Step 1: Model generates JSON tool call - pauses // Step 2: Server executes call - dumps raw JSON into context // Step 3: Model reads context - generates next JSON call } Fifty round-trips to an API at two seconds per turn create over two minutes of idle latency. If each payload contains 20KB of metadata, the client injects 1MB of raw JSON into prompt history. That payload stays in context for every subsequent turn. Because the protocol lacks loops, conditionals, and concurrency, every decision requires another model inference call. Treating a frontier language model as a single-step processor wastes money and adds latency. Models Understand Code, Not Synthetic Tool Schemas In September 2025, Cloudflare engineers Kenton Varda and Sunil Pai pointed out a basic training mismatch in Code Mode: the better way to use MCP https://blog.cloudflare.com/code-mode/ : Language models see trillions of tokens of idiomatic TypeScript, Python, and C. They understand variables, loops, array filtering, and error handling because programmers publish code to GitHub. Models see almost no native tool calls during pre-training. In-band tokens like <|tool call| and JSON-RPC schemas are synthetic formats added during fine-tuning. In their follow-up analysis on giving agents an entire API in 1,000 tokens https://blog.cloudflare.com/code-mode-mcp/ , Cloudflare proved that replacing 2,500 endpoint declarations with two code tools cut token usage by 99.9%. Training data comparison: ───────────────────────────────────────────────────────────── Real-world code TS, JS, Python : Trillions of tokens Synthetic tool-call JSON schemas: Fraction of a percent Model comfort level: Prefers code over JSON ───────────────────────────────────────────────────────────── Asking an LLM to orchestrate work through sequential JSON dictionaries instead of a clean script forces the model to work against its training. Given a TypeScript API, the model already knows how to branch, map, and catch errors. Orchestration Inside the Sandbox Instead of loading individual tools into the model prompt, Codemode presents a minimal execution interface: the model writes a script, and a local sandbox runs it. Consider the difference when querying fifty issues across GitHub and checking their labels: js // What the model writes in Codemode: const issues = await tools.github.list issues { repo: "org/project", state: "open" } ; // Concurrency executed inside sandbox RAM in 80ms: const detailed = await Promise.all issues.slice 0, 50 .map i = tools.github.get issue { id: i.id } ; // Filter 1MB of raw JSON down to three lines before the model sees it: return detailed .filter d = d.labels.includes "urgent" .map d = { id: d.id, title: d.title, author: d.user.login } ; The 1MB JSON response stays in sandbox memory. The model never reads the raw payload; it receives only the three urgent issues. The task completes in one model turn and a fraction of a second of runtime execution , rather than fifty serial inference calls. How Sandboxes Clean the Data Traditional tool calling treats the prompt as an unmanaged heap where every intermediate response accumulates. Sandboxes act as garbage collectors: 1. Projection and Field Stripping: A standard GitHub PR payload contains over 50 fields, including hypermedia URLs, user metadata, and commit hashes. A single .map call strips 98% of these keys before serialization. 2. In-Memory Predicate Filtering: The sandbox evaluates .filter conditions in WebAssembly or native C memory at microsecond speeds. 47 non-urgent items vanish from RAM before touching the network serialization layer. 3. Local Joins and Aggregation: When a task spans two services, such as cross-referencing Jira issues with GitHub PRs, traditional agents send both datasets into the prompt for the model to join. A Codemode script joins the datasets locally with a standard hash map and returns only the final matches. 4. Credential and PII Redaction: Sensitive values like internal IPs, session cookies, and authorization headers remain inside live runtime bindings. The script can use them to make calls without exposing them in the returned text. Three Implementations, One Architecture Different teams arrived at this solution through different constraints, but their designs look remarkably similar under the hood. 1. Pi 0.99 Mario Zechner Pi embeds a C-based QuickJS sandbox with a strict 256MB memory cap. Described in the Pi Codemode documentation https://pi.dev/docs/latest/codemode and the pi codebase https://github.com/earendil-works/pi , the design follows three rules: - Deferred Schemas: MCP tools do not appear in the system prompt. Instead, tools share an inline budget of 3,000 estimated tokens. - Dynamic Search: The script discovers tools on-demand using BM25 relevance ranking via searchTools query or describeTool name . - Zero Host Access: The QuickJS environment has no Node APIs, no filesystem access, and no ambient network. It communicates strictly through injected tool callbacks. 2. OpenCode @opencode-ai/codemode The team behind OpenCode https://github.com/anomalyco/opencode built an Effect TS runtime for safe orchestration: - The 2,000-Token Budgeted Catalog: OpenCode allocates a fixed budget of 2,000 estimated tokens for tool signatures in the prompt. To keep multiple servers fair, it uses round-robin allocation across namespaces. - Deterministic Field Search tools.$codemode.search : When tools exceed the budget, the agent queries an internal search function with field-weighted scoring: exact path match 20 pts , path substring 8 pts , description match 4 pts , and parameter names 2 pts . - Supervised Fibers: Tool calls run on Effect fibers with a ceiling of 8 concurrent calls. If the model generates an infinite loop while true , the fiber supervisor interrupts the execution cleanly without hanging the agent. 3. Cloudflare Code Mode Varda, Pai, Carey Cloudflare collapsed their entire 2,500-endpoint API down to two tools : search code and execute code . Documented in the Cloudflare Agents SDK https://developers.cloudflare.com/agents/tools/codemode : - The Token Drop: Replaced an estimated 1.17 million tokens of raw OpenAPI schemas with roughly 1,000 tokens of meta-tool instructions. - V8 Isolates: Code executes in Dynamic Worker Loaders https://developers.cloudflare.com/workers/runtime-apis/bindings/worker-loader/ , which are disposable V8 isolates that boot in under 5 milliseconds. - Live Object Bindings: The sandbox holds no raw API keys. The parent worker injects authenticated live bindings at runtime. The Industry Convergence This pattern is not an isolated experiment. Across the AI engineering landscape, team after team has discarded direct tool-calling in favor of code execution. | Project / Framework | Orchestration Runtime | Discovery Mechanism | Token Reduction | |---|---|---|---| | Pi 0.99 Mario Zechner https://pi.dev/docs/latest/codemode | QuickJS VM 256MB cap | BM25 searchTools + 3k inline budget | ~95% vs raw schemas | | OpenCode anomalyco https://github.com/anomalyco/opencode | Effect TS supervised fibers | Budgeted catalog 2k tokens + field search | 90%+ on multi-server setups | | Cloudflare Varda & Pai https://blog.cloudflare.com/code-mode/ | V8 Worker Isolates | search code over OpenAPI spec | 99.9% 1.17M to 1k tokens | | Goose AAIF / Block https://goose-docs.ai/docs/guides/managing-tools/code-mode | pctx Deno sandbox | 3 meta-tools list , details , execute | Context capped at 3 tools | | smolagents Hugging Face https://huggingface.co/docs/smolagents | E2B / Docker / Local VM | Python imports from tools import ... | 30% fewer steps on GAIA | | Anthropic Claude SDK https://www.anthropic.com/engineering/code-execution-with-mcp | Container / Worker Sandbox | Virtual filesystem ls ./servers/ | 98.7% 150k to 2k tokens | The academic literature predicted this transition. In February 2024, researchers from UIUC, Apple, and UC Berkeley published the CodeAct paper “Executable Code Actions Elicit Better LLM Agents” , arXiv:2402.01030 https://arxiv.org/abs/2402.01030 . Agents using executable code actions outperformed JSON tool-calling agents by up to 20% on complex tasks. That research formed the foundation of OpenHands https://github.com/All-Hands-AI/OpenHands . Hugging Face reached the same conclusion when designing smolagents . By making CodeAgent the default and relegating ToolCallingAgent to simple prototyping, they proved that agents writing Python code solve multi-step reasoning problems with 30% fewer turns than agents passing JSON objects. CodeAct vs. Codemode: Two Paths to Code-First Agents Generalist agents like Manus https://manus.im/ and OpenHands https://github.com/All-Hands-AI/OpenHands popularized code execution, but their execution model differs from Codemode. Both patterns write code instead of JSON. The difference lies in the execution environment and the boundary: | Dimension | CodeAct Wang et al., 2024 https://arxiv.org/abs/2402.01030 / Manus | Codemode Cloudflare, Pi, OpenCode, Goose | |---|---|---| | Target Problem | General computer use and multi-step file tasks | Distributed tool composition without context bloat | | Sandbox Type | Heavyweight Linux VM or persistent Docker container | Disposable micro-runtime QuickJS, V8 Isolate, Deno | | Tool Interface | Shell commands bash , Python scripts, browser sessions | Typed virtual SDK functions tools.github.list prs | | System Authority | Ambient filesystem, package managers pip , full network | Zero ambient filesystem, no external fetch, bound RPC | | Lifecycle | Long-running container persisting across the task | Ephemeral execution sub-5ms boot, destroyed on return | Manus and OpenHands rely on CodeAct : giving a model a full Linux virtual machine where it writes Python and Bash to browse websites, install packages, and debug tracebacks. CodeAct answers: How does an agent perform general computing work? Codemode addresses a different problem: How does an agent call dozens of distributed tools and remote APIs without overflowing its context window? Codemode does not give the agent a Linux terminal or root access. It gives the model an ephemeral, memory-capped execution engine where external APIs and MCP servers appear as typed system calls. Compilers, CPUs, and Syscalls MCP belongs in the infrastructure layer, not the prompt. A resilient agent architecture separates responsibilities into three computing layers: 1. The LLM is the Compiler: It translates natural language from the user into an executable plan JavaScript, TypeScript, or Python . 2. The Sandbox is the CPU: A lightweight engine QuickJS, a V8 isolate, or Deno executes the plan. It handles control flow, loops, memory allocation, and concurrency locally. 3. MCP is the Syscall Layer: MCP provides standardized, authenticated RPC endpoints to the outside world. It acts as the driver layer between the sandbox and external services. Traditional MCP forces the compiler to act as a CPU, halting after every instruction to inspect state. Codemode lets the compiler emit the program once, the CPU run it in milliseconds, and MCP provide the system calls. Where Code Orchestration Goes Next The shift from direct tool calls to code orchestration points toward four developments: 1. Compile Once, Run Deterministically Current agents write new orchestration scripts for every prompt. As workflows stabilize, agents will verify scripts once and save them as reusable skills. If an agent checks production deployments every morning, it compiles the script on day one. On subsequent mornings, the host runs the script deterministically without calling a frontier model, eliminating inference costs. 2. Sub-Millisecond WASI Micro-Engines Docker containers take seconds to boot and consume hundreds of megabytes of RAM. As agents scale to thousands of concurrent subtasks, execution is moving to WebAssembly WASI and V8 isolates that instantiate in under two milliseconds, execute in memory, and clean up immediately. 3. Capability-Based Security and Live Bindings Passing raw API tokens into prompts creates prompt injection and data exfiltration risks. Modern runtimes replace raw credentials with live object bindings. The host provides an authorized client instance inside the sandbox. The model invokes methods on the binding, but the script cannot read, print, or leak the underlying authorization secret. 4. Tiered Compiler-Runtime Routing Frontier reasoning models act as the system architect, compiling ambiguous human instructions into typed TypeScript plans. Smaller, faster edge models inspect execution logs, handle network retries, and format final user summaries. Moving Past Direct Tool Calling Model Context Protocol solved a real problem by creating a vendor-neutral standard for external tools and authentication. Exposing that protocol to the model prompt created three bottlenecks: prompts bloated with unused schemas, slow ReAct loops, and context flooded with raw payloads. Codemode fixes the abstraction. Placing a lightweight sandbox between the model and the protocol turns tools into code libraries, runs loops in memory, and cuts token overhead by 98% or more. If you build agents, stop injecting raw tool schemas into system prompts. Give the model a compiler target, execute the script in a sandbox, and treat MCP as an operating system call. If you build coding agents or manage tool execution in production, reach out on LinkedIn https://www.linkedin.com/in/kondasamy/ .