Philipp Schmid on Agent tool calling shifting to Code Mode: exposing only one exec

Agents are quickly being reduced to a single tool: string together actions in code and come back

From a share by @_philschmid, who found that Agent tool calling is converging from "one JSON action per turn" into Code Mode: the model only gets one exec(code), and inside a sandbox uses TypeScript/Python to chain together queries, filters, edits, and parallelism, with most intermediate results never entering the context. https://t.co/yp52gsX360

Over the past two years of building Agents, the core work has been designing tools, splitting granularity, and revising schemas and system prompts. Philipp believes the direction is reversing: the entire tool catalog is condensed into a single exec—this is Code Mode. The harness no longer stuffs dozens of JSON Schema tools into the model interface, but instead compiles them into compact type declarations (declare namespace tools { ... }); when the model needs to do something, it writes a short script that, in an isolated sandbox, awaits tools. xxx(...), using Promise.all, filtering, and branching to complete dependent actions in one go.

Tool calling has roughly gone through several stages: when models were weak, they could only be given a few tools; once stronger, they were connected to dozens of tools or MCP, hitting context limits, so tool search and on-demand disclosure were used; even with dynamic loading, standard calling was still basically "one action per turn"—emit a structured call, wait for the raw output to be written back to history, then reason about the next step. Recently models have become noticeably more stable at "composing dependent actions within a single generation," which is what makes Code Mode viable: research can query, filter, and extract answers in one round; multi-file edits can be completed and then validated in the same script; browser/computer operations don't need every click to go back to the model; parallel fan-out can await Promise.all and then feed the next step, without repeatedly squeezing intermediates into the context. Driving factors include: frontier models being trained heavily on code, vendors starting post-training for Code Mode, and MCP increasingly providing both inputSchema and outputSchema, so the model knows the return types before running and can easily wire Tool A to Tool B in the same script.

In implementation, only exec(code) is exposed on the surface. A large catalog doesn't need to be fully mounted at once; tool search can still be used, or a global ALL_TOOLS can be mounted in the sandbox for the model to filter with code. text() / image() / audio() determine which outputs enter the next round's context; store / load keep state in host memory, avoiding large JSON occupying tokens every round. The Linear example in the article: list projects → fetch issues in parallel → filter out unassigned → archive in parallel; the sandbox can run dozens of underlying API calls, and often only a one-line summary returns to the model.

Why prefer a JS/Python sandbox over just giving bash: typed functions map directly to MCP/internal APIs, with native objects, Promise.all, try/catch, and less suffering from shell escaping; custom CLIs often force the model to first --help and read source code to figure out flags, while type contracts save this exploration tax; shell basically only has stdout, and viewing images for multimodality requires another tool, whereas image(screenshot) can be attached directly to the next round; each tools.* goes through the host bridge, allowing OAuth injection, schema validation, and pausing for confirmation on destructive operations outside the sandbox; standard tool calling can almost only use prompt history as its state store, while KV can save tokens across turns.

The article gives a runnable pseudo-example using the Gemini Interactions API and gemini-4-argon: only exec is registered; the script lists PR files, filters by condition, runs a security scan, and posts a comment; the intermediate file objects and raw scan results don't enter the model, and the second round only gets back a one-line summary. In the ecosystem, Pi, Factory Droid, OpenAI Codex, and others already default to or support Code Mode; after Factory switched Droid 1.0 over, Terminal-Bench 4 accuracy was about +3.5 and model cost about -15%. Pydantic AI, LangChain, Cloudflare Agents SDK, and others also have similar capabilities. The author also leaves room: not every Agent will truly be left with only one tool; many CLIs and Skills optimized for bash and human-readable text may not adapt smoothly to typed execution, and it may be necessary to go back and inventory what the Agent actually needs.