Confined Programs Collapse MCP Tool-Call Ping-Pong

·https://github.com/anomalyco/opencode/tree/dev/packages/codemode
repoaitypescriptmcptool-callingcode-executionagent-loopspi

A Pi extension could expose one confined execute tool over MCP servers, keeping catalog search, intermediate results, and multi-call orchestration out of the model loop.

OpenCode’s CodeMode hides a whole Model Context Protocol tool catalog behind one execute tool. The model writes a small JavaScript program that can search for tools, sequence dependent calls, run independent calls with Promise.all, filter large results, and return only the useful data. Intermediate results stay inside the program instead of sloshing through model context after every call.

The clever bit is the boundary. CodeMode uses an owned, Acorn-parsed interpreter rather than eval, with no ambient filesystem, process, network, modules, or credentials. The host supplies an explicit tree of schema-described tools; Effect schemas can validate the boundary, while JSON Schema can describe adapter-provided tools. Authentication, approval, idempotency, and durable side effects stay with the host where they belong.

This could be a killer model for handling MCP in Pi. Instead of dumping every connected tool into the prompt and paying for another model turn between calls, a Pi extension could expose one confined orchestration tool with a budgeted catalog and deterministic search. The first useful experiment is to steal the shape, not import the package blindly: @opencode-ai/codemode is private to the OpenCode workspace, and the current adapter is built around OpenCode, Effect, and its permission hooks.

Key Ideas

  • CodeMode turns many nested MCP calls into one model-facing execute invocation.
  • A budgeted catalog shows complete tool signatures until its token allowance is full, while $codemode.search keeps every namespace discoverable without stuffing the whole catalog into context.
  • The confined JavaScript subset supports branching, loops, transforms, and parallel calls, but blocks ambient machine authority and arbitrary package access.
  • Tool inputs and outputs cross explicit schema and plain-data boundaries; expected failures return structured diagnostics while unknown host failures stay sanitized.
  • The host still owns permissions and consequences. A sandboxed program cannot make an overpowered tool safe, so Pi would need to expose only the tools authorized for that execution.
  • OpenAPI documents can become namespaced tool trees, with credentials resolved host-side and unsupported transport semantics skipped instead of guessed.
  • OpenCode leaves timeout, tool-call, and output limits to the host. Any Pi version needs explicit limits rather than assuming the interpreter handles policy for us.

Links

← All discoveries