Code Mode asks models to generate executable JavaScript instead of making repeated JSON tool calls.
2
A small search-and-execute API reduced Cloudflare's 2,600-endpoint API surface from about 1.2 million tokens to about 1,000 tokens in the first call.
3
Code execution needs a harness that starts with no capabilities, grants access explicitly, and provides full observability.
Summary
Sunil Pai presents Code Mode as a way for AI agents to interact with systems by generating executable code. Traditional tool calling becomes slow and unwieldy when an application exposes hundreds or thousands of tools. Code can loop, hold state, sequence work, run operations in parallel, and complete several API actions in one execution. At Cloudflare, a search-and-execute interface compresses access to roughly 2,600 API endpoints into a much smaller model-facing surface. Pai then describes a harness: a fast sandbox with no default capabilities, where APIs and network access are granted explicitly. He connects this architecture to long-running workflows, stateful agents, and user-specific interfaces. The talk also argues that software teams should design APIs, documentation, errors, and discovery for agents that generate code. Pai is direct about the security requirement: these systems need detailed inspection of what code did and why.
Traditional tool calling becomes unwieldy when an agent has hundreds of tools
Pai says tool calling works when a run has only a few tools, but breaks down when an agent includes Google services, Jira, a wiki, and other systems. Hundreds of tools fill the context, composition becomes awkward, and repeated model-to-tool round trips are slow. Code Mode changes the interaction: the model generates code, usually JavaScript, and the system runs it against an environment. The model can use normal programming operations such as loops, state, sequencing, and parallel execution instead of coordinating every step through separate JSON calls.
Code can compress a very large API surface into a small interface
Cloudflare has about 2,600 API endpoints. Exposing each endpoint as a tool would require about 1.2 million tokens in the first call, according to Pai. The approach used by his colleague Matt Carey exposes only two tool calls, search and execute. Search accepts code that operates on the full OpenAPI JSON specification. Execute provides functions for the discovered API operations. Pai says this reduced the initial context from roughly 1.2 or 1.5 million tokens to 1,000 tokens, which he describes as about a 99.9% reduction.
One generated program can complete a multi-step operational task in one execution
Pai uses a DDoS response as an example. A customer might ask the system to find every offending IP address and block it while a site is under attack. With ordinary MCP-style calls, he estimates that this would take about eight round trips, without even counting the larger context problem. In Code Mode, the model generates JavaScript that runs close to the API surface. The program can find the addresses and perform the blocking operation in one execution. The model interacts with functions exposed by the system rather than with a large menu of separate tools.
A model can interact with a system's state without first generating a dedicated application
Pai describes a canvas built by Kenton, the creator of Cloudflare Workers. The canvas stored its contents as an array of strokes. When Kenton drew a tic-tac-toe board and asked the model to play, he stopped it from generating a tic-tac-toe application. Instead, the model inspected the strokes, recognized the board and the existing X, then drew a circle in response. There was no tic-tac-toe code in the system. Pai says the model had stopped generating a program and was instead inhabiting the state machine, using the state already exposed by the canvas.
The harness combines code generation with a restricted execution environment
Pai says teams are building a harness around coding agents because these agents can act as general-purpose computing machines. The harness gives generated code a safe place to run and exposes selected capabilities. His preferred design starts with something that has no capabilities beyond code execution. It cannot fetch data or call APIs until those abilities are granted explicitly. Cloudflare uses V8 isolates for this purpose, though Pai also mentions WebAssembly and custom JavaScript interpreters. The design can control outgoing fetches and network connections, with no outgoing fetches as the recommended default.
Agent execution needs detailed records of actions and reasons
Security is only part of the harness design. Pai says the system must be fast and provide absolute observability. Operators should be able to inspect why an agent made a particular decision, including an absurd example such as a trade worth $2.3 million. The generated code should be available for inspection after the fact. A sandbox can be implemented with V8 isolates, WebAssembly, or another fast execution system, but the important properties are explicit capability grants, controlled network access, and a way to understand what the code did.
The same architecture could support persistent workflows and user-specific interfaces
Once code can run safely against exposed capabilities, Pai says the system can move beyond one-off API tasks. Agents could generate workflows that run for days, months, or years and carry state through their lifetimes. They could also generate interfaces tailored to individual users. In e-commerce, a system might expose a return action for shoes and find a similar product under $100, or provide a different action for a delayed order. Pai argues that the backend system could support different programs for different users instead of forcing everyone through the same fixed interface.
Developers need to design systems for agents that generate code
Pai says a company's next billion users may be software agents that generate code, even though the customers remain human. APIs should be discoverable through search, documentation should be available in formats such as Markdown, and errors should tell an agent what to do next. He connects this design work with capability-based security, where code receives only the powers it has been granted. He says the pattern can work in JavaScript, Python, or WebAssembly. The result is a developer experience aimed at agents that reason through types, syntax, documentation, and executable programs.
"Instead of doing this JSON back and forth thing, we asked the model to generate code, usually JavaScript, that we could run against an environment."01:31
Who should watch
You are building an agent with many APIs and are seeing context growth or slow sequences of tool calls.
Your product needs agents to run stateful workflows or compose several backend services in a controlled environment.
You design APIs, documentation, errors, or user interfaces and need them to work well with code-generating agents.
