Eslam Tolba

Architecting Agentic Sandboxes: How Code Mode Solves Context Bloat in Model Context Protocol

Table of Contents

The Model Context Protocol (MCP) has quickly emerged as an open standard for connecting AI agents to enterprise systems, developer environments, and external data sources. By defining a universal JSON-RPC interface, MCP allows an agent to discover and invoke tools across diverse backends without bespoke integrations.

However, standard MCP deployments quickly hit an architectural bottleneck: the LLM context window. When an agent relies on naive, turn-by-turn tool invocations, the language model is forced to act as the primary data transit pipeline. For enterprise workloads involving telemetry analysis, repository traversal, or large API payloads, this pattern causes rapid token exhaustion, high latency, and severe context degradation.

Solving this challenge requires a fundamental shift in orchestration: transitioning from prompt-level Direct Tool Calling to sandboxed Code Mode.

1. The Context Chokepoint in Direct Tool Calling

In a standard MCP implementation, tool orchestration follows a rigid, synchronous turn loop:

  1. Schema Injection: The agent host queries connected MCP servers via tools/list and injects every tool schema directly into the model’s system prompt.
  2. Discrete Invocations: The model emits a structured JSON payload defining the target tool and arguments.
  3. Payload Injection: The host executes tools/call against the server, receives the raw payload, and appends the entire output back into the conversation history.
  4. Iterative Round-Trips: If a task requires inspecting, aggregating, or chaining across multiple tools, every intermediate result must pass through the LLM context.

When an agent searches a logging backend or queries an API returning thousands of records, the full raw response is dumped into the context window. An agent chaining five sequential queries makes five full inference round-trips, carrying an ever-expanding history of intermediate data.

The consequences are predictable:

  • Token Cost & Latency: Ballooning prompt tokens drive inference costs up and response times down.
  • Context Degradation: Large volumes of operational data dilute the model’s attention, increasing the likelihood that it loses track of system instructions or subtle edge cases.
  • Schema Scalability Limits: Injecting schemas for dozens of tools consumes a significant portion of the model’s initial context before execution even begins.

2. Code Mode: Programmatic Tool Orchestration

Code Mode re-architects this relationship by moving data transformation and control flow out of the LLM context and into a localized execution runtime.

Instead of generating individual JSON tool calls, the model receives lightweight, typed SDK signatures representing available MCP tools. The LLM then writes a single script in a high-level language such as Python or TypeScript that expresses the entire workflow natively.

Under this pattern:

  • Native Control Flow: Loops, conditional branching (if/else), error handling (try/catch), and array transformations happen directly in code rather than through sequential prompting.
  • In-Memory Filtering: Large intermediate payloads (such as 10 MB of server logs or an extensive database query) remain in the runtime’s memory. The script filters, groups, and summarizes the dataset locally.
  • Minimal Context Return: Only the final output or specific error report enters the conversation history. A pipeline that once required 50,000 tokens of raw telemetry can be reduced to a 30-token structured summary.

3. The Sandbox Substrate: Security and Runtime Models

A sandbox in this context is not a simulated environment. It processes live operational data, but executes within strict isolation boundaries designed to contain untrusted model output.

Isolation and Defense-in-Depth

LLM-generated code cannot be executed directly on the host system. Sandboxes enforce three structural safeguards:

  • Filesystem Jails: Ephemeral, isolated storage prevents scripts from accessing host credentials, configurations, or sensitive directories.
  • Network Allowlisting: Network access is restricted to internal bridges and designated endpoints, preventing data exfiltration.
  • Resource Controls: Enforced memory ceilings, CPU execution quotas, and strict timeouts neutralize infinite loops and resource starvation.

Communication between the sandbox and external services is mediated through an internal host bridge. When the script invokes an MCP method, the call routes through the broker, reaches the upstream MCP server, and returns the result directly to the sandbox memory space.

4. Software Engineering Agents: Scratchpad vs. Artifact Code

A common misconception is that Code Mode is only relevant for analytical queries like log parsing, or that running in Code Mode means the agent cannot deliver production source code.

In software engineering agents, Code Mode establishes a clean separation between scratchpad execution and artifact generation:

  • Scratchpad Code: Ephemeral logic written by the agent to inspect abstract syntax trees (ASTs), grep repositories, verify dependency signatures, or test assumptions against an API. This code runs exclusively inside the sandbox to gather precise architectural context without polluting the conversation history.
  • Artifact Code: The actual production implementation written for the target application. This code is synthesized by the LLM using the refined context gathered during the scratchpad phase.
  • The Self-Healing Verification Loop: Rather than delivering code directly to the user and hoping it compiles, the agent writes temporary test cases, runs linters, and executes the compiler inside the sandbox. If an error occurs, the agent captures the stack trace locally, patches the implementation, and re-verifies before delivering the final artifact.

5. The Production Blueprint: A Read/Write Hybrid

In production systems, Direct Tool Calling and Code Mode are complementary patterns rather than mutually exclusive choices. The standard architecture separates responsibilities based on operational impact:

  • Code Mode for Reads, Traversals, and Aggregations: Querying log stores, filtering metrics, inspecting large codebases, and executing multi-step diagnostic pipelines. These tasks benefit from high execution speed, low token overhead, and native algorithmic control flow.
  • Direct Tool Calling for High-Impact Mutations: Modifying production databases, executing financial transactions, or triggering deployments. These actions remain discrete JSON-RPC invocations where granular authorization, clear audit trails, and deterministic Human-in-the-Loop (HITL) review gates are critical.

Moving data orchestration into sandboxed runtimes ensures that the LLM focuses entirely on high-level reasoning and synthesis, leaving the heavy data processing to deterministic, isolated compute.