Code Execution over MCP: Cheaper Tokens, a Privacy Boundary, and a Mandatory Sandbox

Anthropic reports that presenting MCP servers as code APIs instead of direct tool calls cut a representative agent task from 150,000 tokens to 2,000, a 98.7% saving (Anthropic). The mechanism: instead of the model invoking each tool and reading each result, the model writes a script, the script runs in a sandbox, and only what the script explicitly logs comes back into context. The same move that saves the tokens also builds a containment boundary, because data the model never sees is data the model cannot leak. The bill arrives as infrastructure. The sandbox that runs model-generated integration code is now mandatory, not optional, which is fine for a team that already runs one and a real new cost for a developer who does not.

Direct tool calls pay twice

The Model Context Protocol is the open standard for connecting agents to external systems; since its launch in November 2024 the community has built thousands of MCP servers, and agents now routinely connect to hundreds or thousands of tools. At that scale, the default client design has two token sinks. First, most MCP clients load all tool definitions into context upfront, so an agent connected to thousands of tools can process hundreds of thousands of tokens before it reads the request. Second, every intermediate result passes through the model. Anthropic's worked example is moving a meeting transcript from Google Drive to Salesforce: the full transcript flows through context twice, which for a 2-hour meeting can mean an extra 50,000 tokens. Larger documents can exceed the context window entirely and break the workflow, and models copying large payloads between tool calls are more likely to make mistakes.

Tools become files the agent reads on demand

The code-execution pattern generates a file tree from the connected servers: ./servers/google-drive/getDocument.ts, ./servers/salesforce/updateRecord.ts, each file a typed wrapper around a callMCPTool shim. The agent explores the filesystem, reads only the definitions the current task needs, and writes a short script that imports them. That is the 150,000-to-2,000 reduction. Cloudflare published similar findings under the name "Code Mode," with the same core insight: models are better at writing code than at orchestrating long chains of direct tool calls, so let them write code.

Control flow moves into the runtime too. A polling loop ("wait for the deployment message in Slack") becomes a while loop the sandbox executes, rather than alternating tool calls and sleeps through the agent loop. Conditionals get evaluated by the execution environment instead of by a model inference, which cuts both cost and time-to-first-token.

Data the model never sees is data it cannot leak

With code execution, intermediate results stay in the execution environment by default. Fetch a 10,000-row spreadsheet, filter it in code, log five rows: the model sees five rows. Anthropic pushes this further with harness-level tokenization. The MCP client intercepts results and replaces PII with placeholders ([EMAIL_1], [PHONE_1]) before anything reaches the model, then untokenizes on the way back out through the next tool call. Real customer emails flow from Google Sheets to Salesforce without ever entering the model's context, and the client can enforce deterministic rules about where data may flow. For the lethal trifecta, this removes one leg from the model context: the model cannot directly leak data it was never shown. It is a containment control, not a complete one; generated code still acts on systems holding that data, so tool-flow policy and egress control still matter.

There is a compounding benefit for long-running work: the sandbox filesystem persists state. Agents write intermediate results to files, resume where they left off, and can save working code as reusable skills with a SKILL.md alongside.

The price is a sandbox you must take seriously

Anthropic states the tradeoff plainly: running agent-generated code "requires a secure execution environment with appropriate sandboxing, resource limits, and monitoring," overhead that "direct tool calls avoid." For a single developer on a laptop, that is a real new cost. For a team running the architecture this guide describes, the sandbox already exists, and this pattern is mostly upside: the generated script runs inside the per-task isolated environment, its network reach is bounded by egress control, and the callMCPTool shim means tool access is mediated by the client rather than wired into the generated code, consistent with keeping credentials out of the sandbox.

The 98.7% figure is one worked example, not a benchmark across workloads; neither Anthropic nor Cloudflare publishes a failure rate for the glue code agents write, and the corpus is silent on how often a generated script fails in ways a direct tool call would not. Saved skills are agent-authored code that future runs will trust, and the corpus says nothing about reviewing them. Treat skill files like any other dependency the agent introduces: surfaced and reviewed, not silently accumulated.