The number that should stop you is not 92.8%. It is 81%.
Two vendors, different runtimes, different languages, different customers, deleted the same component from their agent architecture within months of each other. Bifrost, Maxim AI's open-source gateway, replaced its MCP tool catalog with a Starlark sandbox in February 2025. Cloudflare did the same thing in TypeScript against its Agents SDK, executing through the Dynamic Worker Loader API, updated through October 2026. Neither framed it as a deprecation. Both called it Code Mode.
The shared name is the signal. When competitors independently arrive at one conclusion and label it identically, you are not watching innovation. You are watching a constraint become visible.
The architecture being abandoned is barely three years old and was never elegant. An agent that talks to external systems through MCP holds a catalog: a list of function definitions, each with a name, a description, a JSON schema, and frequently a dependency chain. The model reads that catalog into context on every turn. Nothing about this is free. Tool descriptions are input tokens, and input tokens scale linearly with catalog size. A 40-tool deployment and a 400-tool deployment are not the same system with more features. They are the same system with a different cost curve.
The TGVP report frames the problem as four layers that must mature: memory, execution, tooling, governance. Tooling is the layer that decides how cheaply an agent can reach the outside world. Leave the catalog in place and every added capability taxes every call. That is a structural ceiling, and it is why both vendors moved.
Builders are not waiting for the debate to resolve. A freshly funded project with $100M and a six-week roadmap ships whichever pattern has the shorter tutorial. That is how architectural standards actually get set — not by committee, but by whichever default is easiest to copy while the market is euphoric.
The mechanism is identical in both cases, and it is worth stating plainly because the marketing obscures it. Instead of exposing N tools, expose four generic ones. Instead of asking the model which function to call, ask it to write a script that calls whatever it needs. Bifrost runs that script in Starlark, a Python subset built for safe, deterministic execution. Cloudflare runs TypeScript in a sandboxed Worker.
The reported reductions are 92.8% and 81% respectively. Do not compare them. The baselines differ, the catalogs differ, the workloads differ, and neither vendor published the measurement harness. What is comparable is the shape of the curve: code generation breaks the linear dependency between catalog size and context cost. The agent no longer needs to know every tool. It needs to know how to write code that reaches one.
Cloudflare's variant deserves a specific note. Running TypeScript in a Worker means generated code inherits the isolation model of a serverless platform that has been attacked continuously for years. That is a real advantage over a bespoke interpreter. It also means generated code inherits that platform's blast radius.
Anthropic's engineering team noted in November 2025 that code execution with MCP is a natural extension of tool use. Bifrost and Cloudflare went further. They made code execution the primary interface, not an opt-in extension. That is the actual architectural claim, and it is the one builders should be reading instead of the percentage.
This is where my own audit history makes me uncomfortable rather than impressed. In 2017 I spent six weeks reverse-engineering Paragon Coin's reward distribution logic and found an integer overflow that would have drained 12 million tokens at peak volatility. I found it because the code was published, static, and small enough to read line by line. Generated code is none of those things. It is produced at runtime, per task, and discarded. There is no artifact to audit after the fact unless someone deliberately logs it.
That is the trade nobody is pricing. A tool catalog is declarative: you can enumerate it, diff it, review it in a pull request. Generated code is imperative: it does exactly what it says, including the parts you did not anticipate. The catalog was never the elegant interface. It was the auditable one.
Now the part the convergence narrative hides. Two vendors reaching the same conclusion is evidence of a shared constraint, not evidence the conclusion is correct. Correlation is not causation, and consensus among infrastructure vendors is not validation. It is a shared reading of the same cost data, from vendors fielding the same customer complaints.
The token reduction is a proxy metric, and proxies get gamed. Cutting input tokens by 81% means nothing if output tokens rise, if sandbox cold-start latency dominates the request, or if the generated script needs three retries before it runs. I have watched enough volume metrics get inflated by connected wallets in 2021 to be permanently suspicious of any headline number that is easy to produce and hard to falsify.
The real shift is the trust boundary. Prompt injection in a catalog world is a bad instruction. Prompt injection in a code-mode world is arbitrary code execution inside a sandbox that now sits between your agent and every credential it holds. Starlark's determinism protects the interpreter, not the tools it calls. A deterministic script querying a non-deterministic oracle is still non-deterministic. The sandbox is the new trust boundary, and almost nobody has audited it.
When I built the trust-entropy framework for AI agents interacting with smart contracts, the finding that unsettled me was not the average. It was the tail: roughly 30% of automated trading bots were exploitable through adversarial input. Code mode widens that surface, because the adversarial input now writes the code.
The absence of a name matters more than it should. Standards do not spread through documentation; they spread through vocabulary. "Code mode" is currently two vendors' internal label. The moment it becomes a noun the ecosystem uses without attribution — the way "indexer" or "sequencer" did — the pattern is settled and the catalog debate is over.
The question the industry is asking is which runtime wins, Starlark or TypeScript Workers. That is the wrong question, and it is the comfortable one. The uncomfortable question is who signs off on the generated script before it touches a ledger.
Watch for the first sandbox escape disclosed in a code-mode deployment. Watch whether anyone publishes an execution audit trail alongside the token savings, or whether the savings are all we ever get. Watch the governance layer, the fourth of TGVP's four, which remains the one nobody has shipped. The ledger doesn't lie. The interface does.
