Is MCP Replaced by Cloudflare Code Mode? Short Answer: No

No, Cloudflare Code Mode does not replace the Model Context Protocol (MCP). Code Mode is a way of using MCP. Instead of handing a language model every MCP tool as a separate function to call, it turns the tools into a TypeScript API and asks the model to write code against it. That code runs in a sandbox, and its calls still travel to MCP servers. Cloudflare says Code Mode "does not replace MCP" and keeps MCP's connectivity, authorization and documentation, changing only how tools are presented to the model [1].

This article is a sourced analysis. It explains the problem Code Mode solves, how it works, how it compares with direct MCP tool calls, a step-by-step guide to trying it with Cloudflare's Agents SDK, its pros and cons, and when each approach fits. Numbered citations in brackets point to the reference list at the end.

#Abstract

• Question: does Cloudflare Code Mode replace MCP?
• Finding: no. Code Mode is an optimisation layer on top of MCP, and the underlying protocol is still used for connection, authentication and tool discovery [1][2].
• Why it matters: tool definitions and intermediate results consume a model's context. Code Mode and the similar "code execution with MCP" approach from Anthropic reduce that cost sharply in the cases their authors measured [2][3].
• Caveat: the headline savings are vendor-reported figures for specific, very large setups, and the approach adds a sandbox you must secure and operate [2][3].

#Key takeaways

• MCP is the protocol. Code Mode is a usage pattern. Code Mode still talks to MCP servers [1].
• The problem is context cost. Loading every tool definition up front, and passing every intermediate result through the model, wastes tokens [3].
• Reported savings are large but case-specific. Cloudflare reports about 1,000 tokens against 1.17 million for its own API server, and Anthropic reports 150,000 tokens falling to 2,000 in one workflow [2][3].
• Code runs in a sandbox. Cloudflare uses V8 isolates with no general internet access and with credentials kept outside the generated code [1][2].
• It is not always the right choice. With only a handful of tools, plain MCP tool calls are simpler.

#Background: what MCP is and where it hurts

MCP is an open protocol that lets AI applications connect to external tools and data through a standard interface. If you are new to it, start with our guide to the Model Context Protocol explained.

In the common setup, an MCP client loads the definition of every available tool into the model's context at the start, and the model calls tools one at a time. Anthropic's engineering team describes two costs of this pattern [3]:

1. Tool definitions overload the context. Each definition consumes tokens, so an agent connected to many tools may need to process hundreds of thousands of tokens before it even reads the user's request.
2. Intermediate results flow through the model. Anthropic's example is a long meeting transcript copied between two tools, which can add tens of thousands of tokens that the model never needed to read.

Tokens are the unit of both cost and context, as we explain in LLM tokens explained, so this overhead raises bills and slows responses.

#What is Cloudflare Code Mode?

Cloudflare introduced Code Mode on 26 September 2025 with the idea: "Convert the MCP tools into a TypeScript API, and then ask an LLM to write code that calls that API" [1].

Cloudflare's reasoning is that language models have seen far more real-world code than examples of tool calls, so they are better at writing code that calls an API than at calling tools directly. Chained calls benefit most, because intermediate outputs do not have to pass through the model, which reads back only the final results it needs [1]. These are Cloudflare's qualitative claims, and the original post did not publish benchmarks.

#How it works, step by step

1. Fetch the MCP schema. The Agents SDK reads an MCP server's tool schema and generates TypeScript declarations with doc comments [1].
2. Expose one code tool. The model gets a single tool that executes TypeScript instead of a long list of individual tools [1].
3. The model writes code. It writes a short program that calls the generated API, with loops, conditions and error handling as ordinary code [1][3].
4. Run it in a sandbox. The code runs in a V8 isolate created for that snippet and discarded afterwards [1].
5. Relay the calls. API calls in the sandbox are passed back to the agent, which dispatches them to the real MCP server [1].
6. Return the result. Output printed with console.log() is collected and returned to the model [1].

#The 2026 follow-up: a two-tool server for a whole API

On 20 February 2026 Cloudflare described an MCP server for its entire API that exposes just two tools, search() and execute() [2]. The model uses search() to explore the API's OpenAPI specification without that spec entering its context, and execute() to make API calls, handle pagination and chain operations in one run [2]. Cloudflare reports that this uses around 1,000 tokens, against 1.17 million for an equivalent server without Code Mode, a 99.9% reduction in input tokens [2]. That figure comes from Cloudflare's own measurement of a very large API, so expect smaller gains with smaller tool sets. The post's introduction also cites a larger "over 2 million" figure for exposing every endpoint as a tool, so the numbers on the page are not perfectly consistent with each other.

Cloudflare's server is still an MCP server. It speaks MCP, exposes two tools instead of thousands, and uses OAuth 2.1 with permissions limited to what the user approves [2]. That is the clearest evidence that Code Mode sits on top of MCP.

#Anthropic's parallel work: code execution with MCP

On 4 November 2025 Anthropic published a similar approach, which it calls code execution with MCP. It presents MCP servers as a file tree of code APIs, so the agent loads only the tool definitions it needs (progressive disclosure) and filters data in code before returning a small result to the model [3]. Anthropic reports a Google Drive to Salesforce workflow falling from 150,000 tokens to 2,000, a 98.7% saving, and notes the same idea appears in Cloudflare's Code Mode [3]. Anthropic also lists benefits beyond tokens: control flow as code, privacy because intermediate data can stay in the execution environment, state that persists in files, and reusable skills [3].

Two independent teams reaching a similar design is a useful signal that "let the model write code against MCP tools" is a real pattern, not a one-off feature.

#Code Mode vs direct MCP tool calls

#Step-by-step: trying Code Mode with the Cloudflare Agents SDK

These steps follow Cloudflare's documentation for using MCP tools with Code Mode [4]. The SDK is changing quickly, so check the docs for current signatures before you build.

Step 1: Start with an agent that already connects to an MCP server. The docs assume an existing Agents SDK MCP connection and a project with the Code Mode runtime configured [4].

Step 2: Install the package.

bashnpm i @cloudflare/codemode

Step 3: Pick an approach.

• Simple, no approvals: use createCodeTool from @cloudflare/codemode/ai and pass this.mcp.getAITools() as the tools option. MCP tools appear under the default codemode namespace. This path does not provide durable pause, approval or resume, and it does not provide search() or describe() [4].
• Durable runtime with McpConnector: create a connector class that extends McpConnector and implements name(), instructions() and createConnection(). Pass it to createCodemodeRuntime with an executor built on a Worker Loader binding [4]:

tsconst executor = new DynamicWorkerExecutor({ loader: this.env.LOADER });
// ...
connectors: [new GithubConnector(this.ctx, this.env, connection)],

Step 4: Keep MCP tools out of the direct tool list (Think agents). So the model does not see both the raw tools and the code tool, the docs set [4]:

tsincludeMcpTools = false;
waitForMcpConnections = true;

Step 5: Add approvals for risky tools. In a connector, the tool() hook can mark methods as needing approval, for example by returning { ...tool, requiresApproval: true } [4].

Step 6: Let the model discover tools. With the durable runtime, generated sandbox code can call codemode.search() and codemode.describe() to find tools before calling methods such as github.list_pull_requests() [4].

Step 7: Test and watch the details. Connector names must be unique, and if two MCP tool names sanitise to the same identifier the connector throws an error that you resolve by overriding toolName() [4]. Measure token use and task success against your old setup, using an evaluation set (see our LLM evaluation guide).

Cloudflare also documents a pattern for publishing a single-tool Code Mode MCP server of your own [5].

#Security considerations

Letting a model write and run code is powerful and needs controls.

• Network isolation. In Cloudflare's design the sandbox has no general internet access, and global fetch() and connect() throw errors. It can only reach the connected MCP servers through bindings [1].
• Credentials stay outside. API keys remain with the agent supervisor, which adds authentication to outgoing MCP requests, so generated code never handles them [1].
• Limited blast radius. For the Cloudflare API server, the sandbox has no file system and no environment variables to leak through prompt injection, and outbound requests are disabled unless explicitly allowed [2].
• You still own the operational burden. Anthropic is explicit that running agent-generated code needs sandboxing, resource limits and monitoring, and that these add overhead that direct tool calls avoid [3].

See AI guardrails and safety and the AI agent production readiness checklist for the wider controls an agent needs.

#Pros and cons

#When to use Code Mode, and when plain MCP is enough

Code Mode is a good fit when:

• You expose a large API or many tools, so definitions alone eat your context.
• Workflows chain many calls, filter large results or need loops and error handling.
• Sensitive intermediate data should not pass through the model.
• You can run and monitor a sandbox safely.

Plain MCP tool calls are enough when:

• You have only a few tools and simple tasks.
• You cannot or do not want to operate a code sandbox.
• Each step needs the model's judgement on the actual tool result.
• Predictability matters more than token savings.

A practical rule: measure first. Count the tokens your tool definitions use and see how many go unused on a typical task. If that overhead is small, keep it simple. Our guides to building AI agents with tool calling, LLM cost optimization and reliable AI agents in production cover how to decide.

#Other ways to cut MCP's context cost

• Progressive disclosure or tool search. Load only the tool definitions a task needs, as Anthropic describes [3].
• Fewer, better-designed tools. Combine narrow tools into higher-level ones.
• Prompt caching for stable definitions, which reduces cost without changing the architecture.
• Command-line tools. Cloudflare notes that CLIs need a shell, which not every environment provides, and carry a broader attack surface [2].

#Discussion: is "replace" even the right question?

MCP answers "how do an agent and a tool talk to each other?" Code Mode answers "how should the model see and use those tools?" These are different layers. The evidence is consistent: Cloudflare's server still speaks MCP [2], the Agents SDK documentation shows Code Mode consuming MCP connections [4], and Anthropic frames code execution as a way of using MCP more efficiently [3].

What may change is the default way clients present MCP tools. Some commentators speculate Code Mode could become a common pattern, but that is opinion, not an established standard. Treat it as a promising technique and check each vendor's current documentation.

#Conclusion

MCP is not being replaced by Cloudflare Code Mode. Code Mode is a way to make MCP cheaper and more capable when tool lists are large and workflows are complex, at the price of running a sandbox. Start by measuring your current token overhead, try Code Mode where the overhead is high, and keep plain MCP where it is not.

#Want an AI agent built on MCP or Code Mode?

We design and ship AI agents with tool use, MCP integrations, evaluation and guardrails. Get a scope estimate for your AI agent, read about our AI agent development service, or see what AI agents cost to build.

#FAQ

#Is MCP replaced by Cloudflare Code Mode?

No. Code Mode is a way of using MCP. It turns MCP tools into a TypeScript API that the model writes code against, and the code's calls still go to MCP servers. Cloudflare says it does not replace MCP.

#What is Cloudflare Code Mode?

It is an approach announced on 26 September 2025 in which an agent gets a typed code API in place of a long list of tools, writes code to call it, and runs that code in a sandbox. Results return to the model through printed output.

#How many tokens does Code Mode save?

Cloudflare reports about 1,000 tokens against 1.17 million for its full-API MCP server, a 99.9% reduction. Anthropic reports 150,000 tokens falling to 2,000 in one workflow. These are vendor-reported results for specific setups, so measure your own.

#Is Code Mode safe?

It can be if the sandbox is locked down. Cloudflare's design blocks general internet access, keeps API keys outside the generated code and, for its own server, has no file system or environment variables in the sandbox. You still need approvals, monitoring and testing.

#Do I need Cloudflare to use this idea?

No. Anthropic describes a similar code execution approach that works with any MCP setup and a sandbox you provide. Cloudflare's SDK is one implementation.

#When should I not use Code Mode?

When you have only a few tools, when you cannot run a secure sandbox, or when each step needs the model to reason about each individual tool result.

#Does Code Mode work with any MCP server?

Cloudflare's Agents SDK can wrap MCP connections and expose their tools to the sandbox, but details such as tool name conflicts and SDK versions matter. Check the current docs for your server.

#Is Code Mode production-ready?

At launch Cloudflare said its Worker Loader was in closed beta for production use, and the SDK has kept changing through 2026. Check the current status and test thoroughly before relying on it.

#References

1. Cloudflare. "Code Mode: the better way to use MCP." 26 September 2025. blog.cloudflare.com/code-mode
2. Cloudflare. "Code Mode: give agents an entire API in 1,000 tokens." 20 February 2026. blog.cloudflare.com/code-mode-mcp
3. Anthropic Engineering. "Code execution with MCP." 4 November 2025. anthropic.com/engineering/code-execution-with-mcp
4. Cloudflare Agents documentation. "Use MCP tools with Code Mode." developers.cloudflare.com/agents/tools/codemode/mcp
5. Cloudflare Agents documentation. "Build a single-tool Code Mode MCP server." developers.cloudflare.com/agents/model-context-protocol/guides/build-codemode-mcp-server
6. InfoQ. "Cloudflare Launches Code Mode MCP Server to Optimize Token Usage for AI Agents." April 2026. infoq.com/news/2026/04/cloudflare-code-mode-mcp-server
7. Cloudflare changelog. "Agents SDK reduces MCP schema conversion, adds exposure controls for MCP in Think and Code Mode SDK adds direct host APIs." 22 July 2026. developers.cloudflare.com/changelog/post/2026-07-22-mcp-codemode-updates

Method and limits: this article is based on the primary sources listed above, read in October 2026. We did not run independent benchmarks, so all token figures are the authors' reports. Product details change quickly, so verify against the current documentation.