MCP Code Execution: Calling Tools Like a Code Library

When an MCP setup grows from three servers to thirty, tool definitions and intermediate results can consume more context than the reasoning itself. Code Execution with MCP exposes tools through a discoverable code interface, processes data in an execution environment, and returns only the information the model needs.

---

Compare the data paths

Direct MCP calls
all definitions enter context → model calls tool → full result enters context → model filters

Code Execution with MCP
discover interface → sandbox code calls tool → filter and aggregate locally → conclusion enters context

Anthropic reported a reduction from 150,000 to 2,000 tokens for one example task. Treat that as a measured example, not a promise. Your result depends on definition size, response volume, and call-chain length.

---

Map MCP servers to a code directory

A small, predictable directory makes progressive discovery possible:

servers/
├── google-drive/
│   ├── getDocument.ts
│   └── getSheet.ts
├── salesforce/
│   ├── findProspect.ts
│   └── updateRecord.ts
└── index.ts

Each file exposes the input type, purpose, and wrapped call:

import { callMCPTool } from '../../client';

export interface GetDocumentInput {
	documentId: string;
}

export interface GetDocumentResponse {
	content: string;
	modifiedAt: string;
}

/** Read one Google Drive document. Do not use for folders. */
export async function getDocument(input: GetDocumentInput): Promise<GetDocumentResponse> {
	return callMCPTool('google_drive__get_document', input);
}

The agent lists servers/, opens only relevant wrappers, and avoids loading the entire MCP catalogue.

---

Example: update CRM from meeting notes

import * as drive from './servers/google-drive';
import * as crm from './servers/salesforce';

const transcript = await drive.getDocument({ documentId: 'doc-123' });
const summary = transcript.content
	.split('\n')
	.filter(line => line.startsWith('Decision:') || line.startsWith('Owner:'))
	.join('\n');

await crm.updateRecord({
	objectType: 'SalesMeeting',
	recordId: 'meeting-456',
	data: {
		Notes: summary,
		SourceModifiedAt: transcript.modifiedAt
	}
});

The transcript stays in the execution environment. The model decides what counts as useful information; code performs the mechanical filtering and update.

---

Security comes before token savings

Never run model-generated code inside the application server process. At minimum, enforce:

“Intermediate data did not enter the LLM” does not mean “the data was completely safe.” It still passed through the execution environment, MCP server, and logging path. Apply classification and retention rules at each layer.

---

Make writes idempotent

A batch loop can multiply one error into hundreds of writes. A write tool should expose a stable result shape:

type WriteResult = {
	idempotencyKey: string;
	status: 'created' | 'already_applied' | 'rejected';
	evidenceId?: string;
};

Use this execution order:

1. Read first, calculate second, write last.
2. Generate an idempotency key before each mutation.
3. Produce a dry-run diff for high-risk operations.
4. Cap batch size.
5. Record successful items after a partial failure instead of replaying everything.

---

When not to use this pattern

• There are only three to five tools and responses are small.
• The model must inspect every intermediate item to make a judgement.
• The team does not have a trustworthy code sandbox.
• Irreversible writes lack approval and idempotency controls.
• Execution infrastructure costs more than the tokens it saves.

Production acceptance checklist

• Tool definitions can be discovered without full preload.
• A 10,000-row response is filtered before it reaches the model.
• A sandbox timeout ends the task with an explicit failure.
• Mutations support dry run, approval, and idempotency.
• Traces connect generated code, MCP calls, and business outcomes.
• Real tasks compare token use, P95 latency, correctness, and operational cost.

Practice task

Build a flow that finds overdue customers in a spreadsheet and creates CRM follow-ups:

1. Create minimal TypeScript wrappers for the Sheet and CRM tools.
2. Filter rows overdue by more than 14 days and above a chosen balance.
3. Produce dry-run JSON without writing to CRM.
4. Require approval before the batch mutation.
5. Verify that rerunning the task creates no duplicates.

Related reading

• Advanced Claude API Tool Use
• MCP Best Practices
• Security Threat Modeling

Official references

• https://www.anthropic.com/engineering/code-execution-with-mcp
• https://platform.claude.com/docs/en/agents-and-tools/tool-use/manage-tool-context