Code mode for MCP and plugins: discovery without re-pinning, then typed bindings through one shared gate

[Hmbown]

Design research (2026-09-24). References: Cloudflare Code Mode, Anthropic "code execution with MCP" and "advanced tool use", Cursor's per-server schema folders (−46.9% tokens in MCP runs).

Evidence (founder's sessions, 81 sessions, 11,574 tool calls)

• MCP is 3% of calls (345), and 71% of those come in bursts of 3+, which a script could collapse.
• 77% of tool_search calls that return MCP tools activate them. Each activation re-pins the tool list, so the next request's cache hit falls to 54% vs 96% (Token efficiency: per-request usage telemetry, cost-based compaction trigger, stable tool list, smaller static prefix #6541).
• Always-loaded computer-use schemas (two duplicate servers) add ~2.5k tokens per request.
• execute_tools was used 0 times. It refuses every MCP tool (codemode.rs:212-218) and re-implements part of the approval gate instead of prepare_tool_call.
• The sub-agent MCP adapter requires approval for every MCP tool and ignores readOnly/destructive hints (registry.rs:1548-1562). The parent path honours them.

Phases

0. (S–M) Fix Code mode (execute_tools) drops the receipt of finished nested calls on its fixed 30 s timeout and reshapes oversized results #6509: keep the receipt on timeout (including in-flight calls), spill instead of reshaping, and take the deadline from the turn budget/config. Add telemetry: tool-array bytes per request, nested calls, timeouts.
1. (M) Discovery without re-pinning:
   • a static one-line-per-server index built from config;
   • a tool_search describe mode that returns TS/JSDoc signatures (new JSON Schema → TS generator) without activating;
   • optionally a stable mcp_call dispatcher, so direct calls never re-pin.
2. (M–L) Typed mcp.<server>.<tool>() bindings in execute_tools through one NestedCallGate built on prepare_tool_call:
   • deny/ask rules, auto-review and hooks;
   • shared with the sub-agent gate, folding in the adapter's separate approval logic;
   • arguments validated against inputSchema.
     An approval-gated nested call fails clearly with a ready-to-run direct call.
     2b. (M) Pause the script for an approval in place (blocked by 0.10.2 R1: runtime raises child approvals (owner-labelled, off the event loop, no default timeout) #6469).
3. (S–M) Plugins: the same namespace over plugin MCP servers and script tools.

On by default. [features] code_mode_mcp = false or a per-server code_mode = false opts out. Computer Use and authenticate stay direct. Secrets and MCP auth stay host-side. Gate: the eval harness (#6506) A/B on cost per completed task, success, tool errors, turns and cache hit rate.

Founder decisions

• the mcp_call dispatcher;
• default off until the eval passes;
• auto-approve execute_tools once the gate lands;
• hooks per nested call;
• whether the sub-agent vs parent MCP approval difference is intentional.

Decisions (founder, 2026-09-24)

1. Add the stable mcp_call dispatcher: yes.
2. Code mode for MCP is ON by default. Founder override: "just do the MCP code mode, period — DS models are good enough." No eval gate. The shared approval gate still applies to every nested call.
3. Once the shared gate lands, execute_tools is auto-approved (every nested call is gated) and hooks run per nested call: yes.
4. Sub-agents follow the parent's MCP approval rules (honour readOnly/destructive hints through the one gate): yes. The separate always-approve logic in the sub-agent MCP adapter is removed.