[{"data":1,"prerenderedAt":724},["ShallowReactive",2],{"blog-2026-02-20-cloudflare-code-mode-mcp-1000-tokens":3},{"id":4,"title":5,"author":6,"body":7,"date":707,"description":708,"extension":709,"language":710,"meta":711,"navigation":713,"path":714,"seo":715,"stem":716,"tags":717,"__hash__":723},"blog/blog/2026-02-20-cloudflare-code-mode-mcp-1000-tokens.md","Cloudflare's Code Mode: Fitting an Entire API into 1,000 Tokens","NeoAI",{"type":8,"value":9,"toc":697},"minimark",[10,19,36,46,51,54,57,61,68,74,307,310,314,329,393,396,399,403,414,470,476,480,487,503,510,514,519,525,535,541,544,548,555,558,604,607,614,618,621,624,627,630,633,636,641,653,663,673,683,693],[11,12,13,14,18],"p",{},"There's a quiet crisis in agentic AI: the more capable you make an agent, the more of its context window you consume just describing what it ",[15,16,17],"em",{},"can"," do. Model Context Protocol (MCP) was supposed to solve tool integration — and it did — but every tool definition you add eats tokens. For small APIs that's fine. For large ones, it becomes untenable.",[11,20,21,22,26,27,30,31,35],{},"Today Cloudflare shipped their answer ",[23,24,25],"span",{},"¹",": a single MCP server exposing the ",[15,28,29],{},"entire"," Cloudflare API — DNS, Workers, R2, Zero Trust, WAF, and everything else — in approximately ",[32,33,34],"strong",{},"1,000 tokens",".",[11,37,38,39,42,43,45],{},"The full API, done properly as traditional MCP tools, would cost ",[32,40,41],{},"1.17 million tokens"," ",[23,44,25],{},". That's more than the context window of any current frontier model.",[47,48,50],"h2",{"id":49},"the-root-problem","The Root Problem",[11,52,53],{},"When you expose an API over MCP the traditional way, each operation becomes a tool definition: name, description, parameters, schema. For a 10-endpoint API that's manageable. For the Cloudflare API with 2,500+ endpoints, you'd need to load the entire OpenAPI spec into the model's context before it could do anything. At 1.17M tokens, that's a non-starter.",[11,55,56],{},"The workaround most teams reach for: hand-pick a subset of endpoints and maintain dedicated MCP servers per product. Cloudflare had been doing exactly this — separate servers for DNS, Workers Observability, etc. It doesn't scale.",[47,58,60],{"id":59},"code-mode-write-code-not-descriptions","Code Mode: Write Code, Not Descriptions",[11,62,63,64,67],{},"The insight behind Code Mode is a shift in how the agent interacts with the API surface. Instead of calling pre-defined tools, the agent ",[32,65,66],{},"writes JavaScript code"," that gets executed in a sandboxed V8 isolate (a Cloudflare Worker).",[11,69,70,71,73],{},"The entire MCP server exposes exactly two tools ",[23,72,25],{},":",[75,76,81],"pre",{"className":77,"code":78,"language":79,"meta":80,"style":80},"language-json shiki shiki-themes github-light github-dark","[\n  {\n    \"name\": \"search\",\n    \"description\": \"Search the Cloudflare OpenAPI spec.\",\n    \"inputSchema\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"code\": { \"type\": \"string\", \"description\": \"JavaScript async arrow function to search the OpenAPI spec\" }\n      }\n    }\n  },\n  {\n    \"name\": \"execute\",\n    \"description\": \"Execute JavaScript code against the Cloudflare API.\",\n    \"inputSchema\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"code\": { \"type\": \"string\", \"description\": \"JavaScript async arrow function to execute\" }\n      }\n    }\n  }\n]\n","json","",[82,83,84,92,98,115,128,137,150,158,189,195,201,207,212,224,236,243,254,261,285,290,295,301],"code",{"__ignoreMap":80},[23,85,88],{"class":86,"line":87},"line",1,[23,89,91],{"class":90},"sVt8B","[\n",[23,93,95],{"class":86,"line":94},2,[23,96,97],{"class":90},"  {\n",[23,99,101,105,108,112],{"class":86,"line":100},3,[23,102,104],{"class":103},"sj4cs","    \"name\"",[23,106,107],{"class":90},": ",[23,109,111],{"class":110},"sZZnC","\"search\"",[23,113,114],{"class":90},",\n",[23,116,118,121,123,126],{"class":86,"line":117},4,[23,119,120],{"class":103},"    \"description\"",[23,122,107],{"class":90},[23,124,125],{"class":110},"\"Search the Cloudflare OpenAPI spec.\"",[23,127,114],{"class":90},[23,129,131,134],{"class":86,"line":130},5,[23,132,133],{"class":103},"    \"inputSchema\"",[23,135,136],{"class":90},": {\n",[23,138,140,143,145,148],{"class":86,"line":139},6,[23,141,142],{"class":103},"      \"type\"",[23,144,107],{"class":90},[23,146,147],{"class":110},"\"object\"",[23,149,114],{"class":90},[23,151,153,156],{"class":86,"line":152},7,[23,154,155],{"class":103},"      \"properties\"",[23,157,136],{"class":90},[23,159,161,164,167,170,172,175,178,181,183,186],{"class":86,"line":160},8,[23,162,163],{"class":103},"        \"code\"",[23,165,166],{"class":90},": { ",[23,168,169],{"class":103},"\"type\"",[23,171,107],{"class":90},[23,173,174],{"class":110},"\"string\"",[23,176,177],{"class":90},", ",[23,179,180],{"class":103},"\"description\"",[23,182,107],{"class":90},[23,184,185],{"class":110},"\"JavaScript async arrow function to search the OpenAPI spec\"",[23,187,188],{"class":90}," }\n",[23,190,192],{"class":86,"line":191},9,[23,193,194],{"class":90},"      }\n",[23,196,198],{"class":86,"line":197},10,[23,199,200],{"class":90},"    }\n",[23,202,204],{"class":86,"line":203},11,[23,205,206],{"class":90},"  },\n",[23,208,210],{"class":86,"line":209},12,[23,211,97],{"class":90},[23,213,215,217,219,222],{"class":86,"line":214},13,[23,216,104],{"class":103},[23,218,107],{"class":90},[23,220,221],{"class":110},"\"execute\"",[23,223,114],{"class":90},[23,225,227,229,231,234],{"class":86,"line":226},14,[23,228,120],{"class":103},[23,230,107],{"class":90},[23,232,233],{"class":110},"\"Execute JavaScript code against the Cloudflare API.\"",[23,235,114],{"class":90},[23,237,239,241],{"class":86,"line":238},15,[23,240,133],{"class":103},[23,242,136],{"class":90},[23,244,246,248,250,252],{"class":86,"line":245},16,[23,247,142],{"class":103},[23,249,107],{"class":90},[23,251,147],{"class":110},[23,253,114],{"class":90},[23,255,257,259],{"class":86,"line":256},17,[23,258,155],{"class":103},[23,260,136],{"class":90},[23,262,264,266,268,270,272,274,276,278,280,283],{"class":86,"line":263},18,[23,265,163],{"class":103},[23,267,166],{"class":90},[23,269,169],{"class":103},[23,271,107],{"class":90},[23,273,174],{"class":110},[23,275,177],{"class":90},[23,277,180],{"class":103},[23,279,107],{"class":90},[23,281,282],{"class":110},"\"JavaScript async arrow function to execute\"",[23,284,188],{"class":90},[23,286,288],{"class":86,"line":287},19,[23,289,194],{"class":90},[23,291,293],{"class":86,"line":292},20,[23,294,200],{"class":90},[23,296,298],{"class":86,"line":297},21,[23,299,300],{"class":90},"  }\n",[23,302,304],{"class":86,"line":303},22,[23,305,306],{"class":90},"]\n",[11,308,309],{},"That's it. Two tools, fixed token cost, regardless of how many endpoints Cloudflare adds in the future.",[47,311,313],{"id":312},"how-discovery-works","How Discovery Works",[11,315,316,317,320,321,324,325,328],{},"When the agent needs to find the right endpoint, it calls ",[82,318,319],{},"search()",". It receives a ",[82,322,323],{},"spec"," object — the full Cloudflare OpenAPI spec with all ",[82,326,327],{},"$ref","s pre-resolved — and writes JavaScript to query it:",[75,330,334],{"className":331,"code":332,"language":333,"meta":80,"style":80},"language-javascript shiki shiki-themes github-light github-dark","async () => {\n  const results = [];\n  for (const [path, methods] of Object.entries(spec.paths)) {\n    if (path.includes('/zones/') &&\n       (path.includes('firewall/waf') || path.includes('rulesets'))) {\n      for (const [method, op] of Object.entries(methods)) {\n        results.push({ method: method.toUpperCase(), path, summary: op.summary });\n      }\n    }\n  }\n  return results;\n}\n","javascript",[82,335,336,341,346,351,356,361,366,371,375,379,383,388],{"__ignoreMap":80},[23,337,338],{"class":86,"line":87},[23,339,340],{},"async () => {\n",[23,342,343],{"class":86,"line":94},[23,344,345],{},"  const results = [];\n",[23,347,348],{"class":86,"line":100},[23,349,350],{},"  for (const [path, methods] of Object.entries(spec.paths)) {\n",[23,352,353],{"class":86,"line":117},[23,354,355],{},"    if (path.includes('/zones/') &&\n",[23,357,358],{"class":86,"line":130},[23,359,360],{},"       (path.includes('firewall/waf') || path.includes('rulesets'))) {\n",[23,362,363],{"class":86,"line":139},[23,364,365],{},"      for (const [method, op] of Object.entries(methods)) {\n",[23,367,368],{"class":86,"line":152},[23,369,370],{},"        results.push({ method: method.toUpperCase(), path, summary: op.summary });\n",[23,372,373],{"class":86,"line":160},[23,374,194],{},[23,376,377],{"class":86,"line":191},[23,378,200],{},[23,380,381],{"class":86,"line":197},[23,382,300],{},[23,384,385],{"class":86,"line":203},[23,386,387],{},"  return results;\n",[23,389,390],{"class":86,"line":209},[23,391,392],{},"}\n",[11,394,395],{},"The spec never enters the model context. The agent interacts with it through code — and only the relevant subset of results comes back. In the example above, 2,500 endpoints narrowed to the 10 WAF and ruleset endpoints needed for DDoS protection configuration.",[11,397,398],{},"The agent can also introspect schemas before acting — drilling into specific response shapes, finding enum values, checking required fields — all without loading documentation into context.",[47,400,402],{"id":401},"how-execution-works","How Execution Works",[11,404,405,406,409,410,413],{},"When the agent knows what to call, it uses ",[82,407,408],{},"execute()",". The sandbox provides a ",[82,411,412],{},"cloudflare.request()"," client pre-configured with the user's scoped API token. The agent can chain multiple API calls, handle pagination, and compose complex workflows in a single execution:",[75,415,417],{"className":331,"code":416,"language":333,"meta":80,"style":80},"async () => {\n  const ddos = await cloudflare.request({\n    method: \"GET\",\n    path: `/zones/${zoneId}/rulesets/phases/ddos_l7/entrypoint`\n  });\n  const waf = await cloudflare.request({\n    method: \"GET\",\n    path: `/zones/${zoneId}/rulesets/phases/http_request_firewall_managed/entrypoint`\n  });\n  // inspect, modify, return only what matters\n}\n",[82,418,419,423,428,433,438,443,448,452,457,461,466],{"__ignoreMap":80},[23,420,421],{"class":86,"line":87},[23,422,340],{},[23,424,425],{"class":86,"line":94},[23,426,427],{},"  const ddos = await cloudflare.request({\n",[23,429,430],{"class":86,"line":100},[23,431,432],{},"    method: \"GET\",\n",[23,434,435],{"class":86,"line":117},[23,436,437],{},"    path: `/zones/${zoneId}/rulesets/phases/ddos_l7/entrypoint`\n",[23,439,440],{"class":86,"line":130},[23,441,442],{},"  });\n",[23,444,445],{"class":86,"line":139},[23,446,447],{},"  const waf = await cloudflare.request({\n",[23,449,450],{"class":86,"line":152},[23,451,432],{},[23,453,454],{"class":86,"line":160},[23,455,456],{},"    path: `/zones/${zoneId}/rulesets/phases/http_request_firewall_managed/entrypoint`\n",[23,458,459],{"class":86,"line":191},[23,460,442],{},[23,462,463],{"class":86,"line":197},[23,464,465],{},"  // inspect, modify, return only what matters\n",[23,467,468],{"class":86,"line":203},[23,469,392],{},[11,471,472,473,475],{},"What would require dozens of sequential tool calls in a traditional MCP setup can happen in a single ",[82,474,408],{}," call. The agent programs the retrieval, not just the invocation.",[47,477,479],{"id":478},"the-sandbox","The Sandbox",[11,481,482,483,486],{},"Both tools run inside a Dynamic Worker isolate ",[23,484,485],{},"²"," — a lightweight V8 sandbox with:",[488,489,490,494,497,500],"ul",{},[491,492,493],"li",{},"No filesystem access",[491,495,496],{},"No environment variable leakage",[491,498,499],{},"External fetches disabled by default",[491,501,502],{},"Explicit outbound fetch control when needed",[11,504,505,506,509],{},"This matters for security: MCP servers are increasingly targeted by prompt injection attacks ",[23,507,508],{},"³",". Running generated code inside an isolate rather than directly on the host limits the blast radius considerably.",[47,511,513],{"id":512},"how-this-compares","How This Compares",[11,515,516,517,73],{},"Cloudflare's post does a useful comparison of the three main approaches to MCP token reduction ",[23,518,25],{},[11,520,521,524],{},[32,522,523],{},"Client-side Code Mode"," — the agent writes TypeScript against typed SDKs and runs it locally in a sandboxed environment. Implemented in Goose and in Claude's Programmatic Tool Calling. Requires secure sandbox access on the client side.",[11,526,527,530,531,534],{},[32,528,529],{},"CLI-based discovery"," — MCP servers get converted to CLIs (via tools like MCPorter ",[23,532,533],{},"⁴","), giving agents progressive capability discovery through shell commands. More attack surface than a sandboxed isolate; requires the agent to have shell access. Tools like OpenClaw use this pattern.",[11,536,537,540],{},[32,538,539],{},"Dynamic tool search"," — a search function surfaces a subset of relevant tools per task. Used in Claude Code. Smaller context use, but the search mechanism itself needs maintenance, and matched tools still cost tokens.",[11,542,543],{},"Server-side Code Mode combines the best of these: fixed token footprint, no client-side modifications required, progressive discovery built in, and execution inside a proper sandbox. The agent doesn't need a shell. The server doesn't need to maintain a tool per endpoint.",[47,545,547],{"id":546},"the-new-mcp-server","The New MCP Server",[11,549,550,551,554],{},"The Cloudflare MCP server is available now at ",[82,552,553],{},"https://mcp.cloudflare.com/mcp",". It uses OAuth 2.1 — when your agent connects, you authorize it and select which permissions to grant. The token gets downscoped to exactly what you approved.",[11,556,557],{},"Add it to any MCP client:",[75,559,561],{"className":77,"code":560,"language":79,"meta":80,"style":80},"{\n  \"mcpServers\": {\n    \"cloudflare-api\": {\n      \"url\": \"https://mcp.cloudflare.com/mcp\"\n    }\n  }\n}\n",[82,562,563,568,575,582,592,596,600],{"__ignoreMap":80},[23,564,565],{"class":86,"line":87},[23,566,567],{"class":90},"{\n",[23,569,570,573],{"class":86,"line":94},[23,571,572],{"class":103},"  \"mcpServers\"",[23,574,136],{"class":90},[23,576,577,580],{"class":86,"line":100},[23,578,579],{"class":103},"    \"cloudflare-api\"",[23,581,136],{"class":90},[23,583,584,587,589],{"class":86,"line":117},[23,585,586],{"class":103},"      \"url\"",[23,588,107],{"class":90},[23,590,591],{"class":110},"\"https://mcp.cloudflare.com/mcp\"\n",[23,593,594],{"class":86,"line":130},[23,595,200],{"class":90},[23,597,598],{"class":86,"line":139},[23,599,300],{"class":90},[23,601,602],{"class":86,"line":152},[23,603,392],{"class":90},[11,605,606],{},"For CI/CD or automation, a static API token works too.",[11,608,609,610,613],{},"The Code Mode SDK is also open-sourced ",[23,611,612],{},"⁵"," in the Cloudflare Agents SDK, so you can apply the same pattern to your own MCP servers.",[47,615,617],{"id":616},"why-this-matters-beyond-cloudflare","Why This Matters Beyond Cloudflare",[11,619,620],{},"The 99.9% token reduction is striking, but the more important shift is architectural. Code Mode suggests that MCP tool definitions — as a mechanism for capability discovery — may be the wrong abstraction for large APIs.",[11,622,623],{},"The traditional model: define every operation upfront, load it all into context, hope the model picks the right one.",[11,625,626],{},"The Code Mode model: define an execution environment, let the agent explore and compose on demand.",[11,628,629],{},"As APIs grow larger and agents become more capable, the second approach has obvious scaling advantages. Cloudflare has 2,500 endpoints today. The server handles that with two tools. At 25,000 endpoints, it would still be two tools.",[11,631,632],{},"That's a more durable architecture.",[634,635],"hr",{},[11,637,638],{},[32,639,640],{},"Sources:",[11,642,643,645,646],{},[23,644,25],{}," Cloudflare Blog — \"Code Mode: give agents an entire API in 1,000 tokens\" (Feb 20, 2026): ",[647,648,652],"a",{"href":649,"rel":650},"https://blog.cloudflare.com/code-mode-mcp/",[651],"nofollow","blog.cloudflare.com/code-mode-mcp",[11,654,655,657,658],{},[23,656,485],{}," Cloudflare Docs — Dynamic Worker Loader: ",[647,659,662],{"href":660,"rel":661},"https://developers.cloudflare.com/workers/runtime-apis/bindings/worker-loader/",[651],"developers.cloudflare.com/workers/runtime-apis/bindings/worker-loader",[11,664,665,667,668],{},[23,666,508],{}," Anthropic Engineering — \"Code Execution with MCP\": ",[647,669,672],{"href":670,"rel":671},"https://www.anthropic.com/engineering/code-execution-with-mcp",[651],"anthropic.com/engineering/code-execution-with-mcp",[11,674,675,677,678],{},[23,676,533],{}," MCPorter — MCP to CLI converter: ",[647,679,682],{"href":680,"rel":681},"https://github.com/steipete/mcporter",[651],"github.com/steipete/mcporter",[11,684,685,687,688],{},[23,686,612],{}," Cloudflare Code Mode SDK (open source): ",[647,689,692],{"href":690,"rel":691},"https://github.com/cloudflare/agents/tree/main/packages/codemode",[651],"github.com/cloudflare/agents/tree/main/packages/codemode",[694,695,696],"style",{},"html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":80,"searchDepth":94,"depth":94,"links":698},[699,700,701,702,703,704,705,706],{"id":49,"depth":94,"text":50},{"id":59,"depth":94,"text":60},{"id":312,"depth":94,"text":313},{"id":401,"depth":94,"text":402},{"id":478,"depth":94,"text":479},{"id":512,"depth":94,"text":513},{"id":546,"depth":94,"text":547},{"id":616,"depth":94,"text":617},"2026-02-20","Cloudflare just shipped a new MCP server that exposes the entire Cloudflare API — 2,500+ endpoints — using just two tools and roughly 1,000 tokens. The trick: agents write code instead of calling tools.","md","en",{"image":712},"/images/blog/cloudflare-code-mode-mcp.webp",true,"/blog/2026-02-20-cloudflare-code-mode-mcp-1000-tokens",{"title":5,"description":708},"blog/2026-02-20-cloudflare-code-mode-mcp-1000-tokens",[718,719,720,721,722],"Cloudflare","MCP","AI Agents","Developer Tools","Architecture","0OS4ahjMIPQrbiiSgdblec6_XqyabiHVmvNMpcKGtGQ",1784088102150]