---
title: "MCP Code Mode"
description: "Use AI Glot's search-and-execute MCP server for bounded multi-step API work inside a network-isolated Cloudflare Worker sandbox."
canonical: "https://ai-glot.com/docs/mcp/code-mode"
updated: "2026-08-09"
---

# MCP Code Mode

Code Mode exposes two tools at `https://mcp.ai-glot.com/mcp/code`:

- `search` finds relevant operations in the OpenAPI contract without loading the complete specification into the model's context.
- `execute` runs one JavaScript program whose `request()` function calls the normal AI Glot REST routes.

## Why use it

The standard server may require several model-tool round trips for a multi-step task. Code Mode lets the agent fetch several pages, filter them and return a small summary in one tool call.

```js title="Example execute program"
const first = await request({
  method: 'GET',
  path: '/batches',
  query: { status: 'completed', limit: 100 },
});

return first.data
  .filter(batch => !batch.archived)
  .slice(0, 10)
  .map(({ id, name, completed_at }) => ({ id, name, completed_at }));
```

Paths passed to `request()` are relative to `/v1`. Every call travels through the same route matching, validation, scope enforcement, workspace isolation and rate limiting as a direct HTTP request.

## Sandbox boundaries

The program has no outbound network, environment bindings or extra modules. It can only call AI Glot through `request()` using the connection's existing scopes.

| Limit                      |             Value |
| -------------------------- | ----------------: |
| Program size               |             64 KB |
| Execution time             |        30 seconds |
| API requests per execution |               100 |
| Returned JSON              |            256 KB |
| Console output             | 200 lines / 32 KB |

Each internal request counts against the credential's normal API rate limit. Large results are explicitly marked as truncated; filter or summarise inside the program rather than returning raw pages.

> **Warning: Code Mode is more powerful, not more privileged**
>
> A script can combine many allowed operations, but it cannot widen scopes, access another workspace, reach the private translation engine or call the internet. Because `execute` can reach destructive glossary operations, clients should treat it as potentially destructive.