Code execution with MCP: Building more efficient agents

생각 덩어리

MCP는 사실상 표준 — 다음 병목은 토큰

MCP provides a universal protocol—developers implement MCP once in their agent and it unlocks an entire ecosystem of integrations.

Since launching MCP in November 2024, adoption has been rapid: the community has built thousands of MCP servers ... and the industry has adopted MCP as the de-facto standard for connecting agents to tools and data.

However, as the number of connected tools grows, loading all tool definitions upfront and passing intermediate results through the context window slows down agents and increases costs.

비용 1 — 툴 정의가 컨텍스트 창을 점령한다

Most MCP clients load all tool definitions upfront directly into context, exposing them to the model using a direct tool-calling syntax.

Tool descriptions occupy more context window space, increasing response time and costs. In cases where agents are connected to thousands of tools, they’ll need to process hundreds of thousands of tokens before reading a request.

비용 2 — 중간 결과가 모델을 두 번 통과한다

For example, you might ask your agent: "Download my meeting transcript from Google Drive and attach it to the Salesforce lead."

Every intermediate result must pass through the model. In this example, the full call transcript flows through twice. For a 2-hour sales meeting, that could mean processing an additional 50,000 tokens. Even larger documents may exceed context window limits, breaking the workflow.

With large documents or complex data structures, models may be more likely to make mistakes when copying data between tool calls.

해법 — MCP 서버를 코드 API로, 150,000토큰이 2,000토큰으로

With code execution environments becoming more common for agents, a solution is to present MCP servers as code APIs rather than direct tool calls. The agent can then write code to interact with MCP servers.

The agent discovers tools by exploring the filesystem: listing the ./servers/ directory to find available servers (like google-drive and salesforce), then reading the specific tool files it needs (like getDocument.ts and updateRecord.ts) to understand each tool's interface.

This reduces the token usage from 150,000 tokens to 2,000 tokens—a time and cost saving of 98.7%.

Cloudflare published similar findings, referring to code execution with MCP as “Code Mode." The core insight is the same: LLMs are adept at writing code and developers should take advantage of this strength to build agents that interact with MCP servers more efficiently.

Progressive disclosure — 모델은 파일시스템 탐색에 능하다

Models are great at navigating filesystems. Presenting tools as code on a filesystem allows models to read tool definitions on-demand, rather than reading them all up-front.

Alternatively, a search_tools tool can be added to the server to find relevant definitions.

Including a detail level parameter in the search_tools tool that allows the agent to select the level of detail required (such as name only, name and description, or the full definition with schemas) also helps the agent conserve context and find tools efficiently.

필터링과 루프는 실행 환경에서 — 1만 행 대신 5행

When working with large datasets, agents can filter and transform results in code before returning them.

The agent sees five rows instead of 10,000. Similar patterns work for aggregations, joins across multiple data sources, or extracting specific fields—all without bloating the context window.

Loops, conditionals, and error handling can be done with familiar code patterns rather than chaining individual tool calls.

Additionally, being able to write out a conditional tree that gets executed also saves on “time to first token” latency: rather than having to wait for a model to evaluate an if-statement, the agent can let the code execution environment do this.

프라이버시 — 민감 데이터가 모델을 영영 거치지 않는다

When agents use code execution with MCP, intermediate results stay in the execution environment by default. This way, the agent only sees what you explicitly log or return, meaning data you don’t wish to share with the model can flow through your workflow without ever entering the model's context.

The MCP client intercepts the data and tokenizes PII before it reaches the model ... The real email addresses, phone numbers, and names flow from Google Sheets to Salesforce, but never through the model. This prevents the agent from accidentally logging or processing sensitive data.

You can also use this to define deterministic security rules, choosing where data can flow to and from.

상태 지속과 Skills — 에이전트가 자기 도구상자를 키운다

Code execution with filesystem access allows agents to maintain state across operations. Agents can write intermediate results to files, enabling them to resume work and track progress

Agents can also persist their own code as reusable functions. Once an agent develops working code for a task, it can save that implementation for future use

Adding a SKILL.md file to these saved functions creates a structured skill that models can reference and use. Over time, this allows your agent to build a toolbox of higher-level capabilities, evolving the scaffolding that it needs to work most effectively.

공짜는 아니다 — 그래도 해법은 소프트웨어 공학에 이미 있다

Running agent-generated code requires a secure execution environment with appropriate sandboxing, resource limits, and monitoring. These infrastructure requirements add operational overhead and security considerations that direct tool calls avoid.

The benefits of code execution—reduced token costs, lower latency, and improved tool composition—should be weighed against these implementation costs.

Although many of the problems here feel novel—context management, tool composition, state persistence—they have known solutions from software engineering. Code execution applies these established patterns to agents, letting them use familiar programming constructs to interact with MCP servers more efficiently.