# Code mode for MCP changes the orchestration boundary

With direct tool calling, the model may need a request for “search,” another for “fetch each result,” and another to combine them. With code mode, the model writes a small program that performs those calls and returns the useful subset.

This conceptual example is pseudocode; each harness exposes different names and result shapes:

```text
matches = await tools.search(query)
details = await concurrently(fetch(match) for match in matches)
emit only the fields needed for the answer
```

This can reduce model round trips and intermediate context. It also moves control flow into model-written code. You now need execution limits, cancellation, observable nested calls, explicit result/error shapes, and a clear policy boundary around the capabilities exposed to that code.

| Harness | Runtime and discovery | Nested-call boundary |
| --- | --- | --- |
| Codex | Fresh V8 cells, controlled globals, explicit cross-cell storage, yield/wait handling; deferred search is scoped to the originating step's tool catalog. | Nested calls reenter `ToolCallRuntime` with that step context. This is distinct from a persistent Node REPL. |
| pi | Selectable QuickJS code mode, deferred tool discovery, explicit state handling, MCP structured results. | `ctx.executeTool` preserves tool validation and extension hooks. Structured MCP errors may resolve with `isError`, so a script must inspect the result. |
| Goose | Feature-gated, default-disabled Boa extension with discovery tools and `tools.call`; some tools remain directly visible. | The outer code tool follows normal approval/execution. The nested callback calls an `ExtensionLease` directly; it does not independently rerun the outer approval operation or pre-tool hooks. |

Sources: [Codex runtime][c-code-runtime] and [nested dispatch][c-code], [pi nested execution][p-code], [Goose code execution][g-code] and [registration][g-code-gate].

The Goose distinction is an architectural scope finding, not a claim that nested tools have no checks anywhere. Its catalog restriction, lease routing, server-side behavior, cancellation, and outer policy still matter. Conversely, routing through a hook in Codex or pi only enforces the policy actually configured there.

Result shapes also differ. Goose's nested callback returns assistant-visible text, parsed as JSON where possible; it excludes arbitrary structured content, images, and hidden text from that adapter. Pi can expose declared MCP structured output to scripts. A program that assumes every tool returns the same JSON structure can fail even when both harnesses support the same server. [Goose result adapter][g-code-result], [pi MCP tool adapter][p-mcp-result].

**Design implication:** test a denied tool both directly and inside code mode. Do not assume an interpreter with no filesystem or network APIs is harmless: its injected tools can carry filesystem, network, and credential authority. Review the capability boundary as carefully as the JavaScript runtime.

## Sidekick: configured Python tools are a different mechanism

Sidekick can execute configured Python tool implementations and dispatch a skill’s declared built-in tool through `UseSkillTool`. Neither inspected mechanism is a model-authored program that discovers and composes MCP tools. Native MCP code mode was not established in this review; a wrapped external harness may bring its own facilities. Distinguish execution of an installed implementation from generation of an orchestration program during a run. [Configured Python execution][s-python], [skill dispatch][s-skill] (private source).

[c-code-runtime]: https://github.com/openai/codex/blob/8c076942cb70fba8e5c4732c23f1faabc4aed484/codex-rs/code-mode-runtime/src/runtime/mod.rs#L73-L260
[c-code]: https://github.com/openai/codex/blob/8c076942cb70fba8e5c4732c23f1faabc4aed484/codex-rs/core/src/tools/code_mode/mod.rs#L350-L474
[p-code]: https://github.com/earendil-works/pi/blob/482c1381a00d8d00bc81697e4a980c593db6803e/packages/coding-agent/src/extensions/codemode/execute.ts#L428-L557
[g-code]: https://github.com/aaif-goose/goose/blob/34a222e3f2b95d8b4a43482b53c2cc957ecce26d/crates/goose/src/agents/platform_extensions/code_execution.rs#L22-L335
[g-code-gate]: https://github.com/aaif-goose/goose/blob/34a222e3f2b95d8b4a43482b53c2cc957ecce26d/crates/goose/src/agents/platform_extensions/mod.rs#L154-L172
[g-code-result]: https://github.com/aaif-goose/goose/blob/34a222e3f2b95d8b4a43482b53c2cc957ecce26d/crates/goose/src/agents/platform_extensions/code_execution.rs#L240-L381
[p-mcp-result]: https://github.com/earendil-works/pi/blob/482c1381a00d8d00bc81697e4a980c593db6803e/packages/coding-agent/src/extensions/mcp/tools.ts#L312-L354

[s-python]: https://github.com/datex/sidekick/blob/463d653124e1c2cda46a3f14f01f3d6f384326b1/backend/src/sidekick_worker/services/tool_execution_service.py#L325-L369
[s-skill]: https://github.com/datex/sidekick/blob/463d653124e1c2cda46a3f14f01f3d6f384326b1/backend/src/sidekick_worker/tools/skill_executor.py#L349-L412