MCP Tool Token Costs: How Code Mode Cuts Context by 92%

TL;DR

• Loading 508 tools across 16 servers into an agent context burns 75.1 million input tokens and costs $377 in standard benchmark runs.
• Bifrost Code Mode cuts MCP tool token costs by 92.8% at 500+ tools by replacing raw schema injection with on-demand discovery and Python orchestration.
• Average input tokens per query drop from 1.15 million tokens to 83,000 tokens while preserving a 100% benchmark pass rate.
• Sandboxed execution in a Starlark runtime processes intermediate tool outputs outside the prompt, preventing multi-turn payload bloat.

Connecting hundreds of tools to an AI agent through the Model Context Protocol causes input payloads to swell past 100,000 tokens per turn before user instructions are even evaluated. Bifrost, an open-source AI gateway built by Maxim AI, addresses this through Code Mode, an execution path that replaces prompt schema injection with sandboxed code orchestration. While classic tool calling saturates context windows with repetitive JSON schemas, Code Mode decouples tool availability from prompt overhead. This article examines the mechanics of tool-driven token bloat, analyzes benchmark data across 500+ tools, and details how code execution changes agent economics.

The Mathematical Reality of MCP Schema Injection

The Model Context Protocol standardizes how applications expose tools to frontier models, but its default operational pattern relies on full schema injection. Every tool registered on an MCP server requires an explicit JSON Schema defining its name, descriptive summary, argument types, required fields, and nested properties. In a production deployment, a single descriptive tool definition typically consumes between 200 and 800 tokens.

{
  "name": "query_customer_database",
  "description": "Executes a parameterized SQL query against the enterprise customer data warehouse and returns structured records.",
  "parameters": {
    "type": "object",
    "properties": {
      "query": {
        "type": "string",
        "description": "The parameterized SQL read query to run against customer tables."
      },
      "timeout_seconds": {
        "type": "integer",
        "description": "Maximum execution window before the query terminates."
      },
      "max_rows": {
        "type": "integer",
        "description": "Row limit for the returned dataset."
      }
    },
    "required": ["query"]
  }
}

When an agent connects to five MCP servers with 30 tools each, roughly 150 tool schemas enter the request payload. At an average of 400 tokens per definition, 60,000 tokens of static interface metadata accompany every single model invocation. Because multi-agent workflows and coding assistants execute multiple reasoning loops to complete a task, this metadata repeats across every turn. An eight-turn troubleshooting task does not process 60,000 tokens of schema once; it processes 480,000 tokens of schema across the session.

The financial arithmetic deteriorates further as organizations scale tool libraries. Connecting 16 servers exposing 508 tools pushes baseline schema overhead above 200,000 tokens per turn, consuming the entire default context window of many production models before any application prompt or conversation history is loaded.

Measuring the Token Overhead: 96, 251, and 508 Tools in Production

To quantify how schema bloat scales in production environments, benchmark tests compared classic MCP execution against code execution across three distinct tool topologies using the same query set. The evaluations measured pass rates, cumulative input tokens, and estimated infrastructure costs under identical task conditions.

The testing suite simulated real enterprise tasks requiring discovery, data transformation, and multi-step tool calls across disparate services, including databases, issue trackers, internal wikis, and search endpoints.

Metric	Round 1 (96 Tools / 6 Servers)	Round 2 (251 Tools / 11 Servers)	Round 3 (508 Tools / 16 Servers)
Classic MCP Pass Rate	64/64 (100%)	64/65 (98.5%)	65/65 (100%)
Code Mode Pass Rate	64/64 (100%)	65/65 (100%)	65/65 (100%)
Classic MCP Input Tokens	19.9M	35.7M	75.1M
Code Mode Input Tokens	8.3M	5.5M	5.4M
Input Token Reduction	-58.2%	-84.5%	-92.8%
Classic MCP Estimated Cost	$104.04	$180.07	$377.00
Code Mode Estimated Cost	$46.06	$29.80	$29.00
Total Cost Change	-55.7%	-83.4%	-92.2%

The benchmark data illustrates an inverse scaling curve. Under classic MCP, input tokens increased linearly from 19.9 million to 75.1 million as the tool count expanded from 96 to 508 tools. Under Code Mode, input tokens dropped from 8.3 million down to 5.4 million even as the tool footprint quintupled.

At 508 tools, classic MCP burned an average of 1.15 million input tokens per query across the multi-turn benchmark suite, generating a cumulative test run cost of $377.00. Under Code Mode, average input tokens dropped roughly 14-fold to 83,000 tokens per query, cutting the total run cost to $29.00 while maintaining a flawless 65/65 pass rate. Published data from the Bifrost benchmarks confirms that these savings stem from structural context reduction rather than truncated outputs or dropped verifications.

How Code Mode Replaces Schema Flooding with Progressive Discovery

Code Mode fundamentally changes how an AI agent discovers capabilities. Rather than serializing hundreds of JSON schemas into the prompt, the gateway exposes tools as a virtual filesystem containing lightweight Python stub files. The model interacts with four compact meta-tools instead of a massive catalog of direct operational calls.

The model navigates the available tools using progressive disclosure, inspecting signatures only for the interfaces required by the specific task.

/servers
├── customer_db/
│   ├── query.py
│   └── get_customer.py
├── payment_gateway/
│   ├── refund.py
│   └── get_transaction.py
└── internal_wiki/
    ├── search.py
    └── get_article.py

Instead of sending hundreds of complex JSON schemas, Bifrost registers four static meta-tools via its MCP Gateway architecture:

Meta-Tool	Primary Function	Input Context Overhead
listToolFiles	Lists available MCP servers and exported tool scripts across the virtual filesystem.	~40 tokens
readToolFile	Fetches typed Python stub signatures and parameter definitions for a specific tool on demand.	~80-150 tokens
getToolDocs	Retrieves extended markdown documentation and operational examples for complex tools.	~100-300 tokens (optional)
executeToolCode	Executes a generated Python orchestration script inside a secure, sandboxed runtime environment.	Variable based on script length

Because the model discovers tools on demand, an agent performing database queries never loads the parameter schemas for email services, document converters, or continuous integration pipelines. Unused tools impose zero context overhead on the prompt.

Sandboxed Execution: Keeping Intermediate Payloads Outside the Context Window

Direct tool calling suffers from a second, compounding token trap: intermediate payload accumulation. When an agent calls an API that returns a 4,000-word customer record or a 10,000-line server log, classic MCP forces that entire raw payload into the conversation history so the model can inspect it and formulate the next tool call.

Classic MCP Round-Trip:
Model -> "Fetch customer record" -> MCP Tool
MCP Tool -> 15,000-token JSON payload -> Context Window
Model -> "Extract address and update shipping" -> Shipping Tool
Shipping Tool -> 2,000-token confirmation -> Context Window

In this classic pattern, large payloads consume context budget and remain in the prompt for every subsequent turn of the conversation.

Code Mode resolves this by shifting intermediate data handling into a sandboxed execution runtime. Bifrost executes generated scripts inside an embedded Starlark interpreter. Starlark is a deterministic, hermetic language dialect derived from Python, originally developed for the Bazel build system. It provides standard Python syntax without allowing direct host filesystem access, uncontrolled network sockets, or external process spawning.

# Generated by the agent and executed inside the Bifrost sandbox
import servers.customer_db as db
import servers.shipping_service as shipping

# Step 1: Retrieve raw customer data within sandbox memory
customer_data = db.get_customer(customer_id="cust_98231")

# Step 2: Extract only the required address fields programmatically
shipping_payload = {
    "destination": customer_data.get("shipping_address"),
    "priority": "standard",
    "account_id": customer_data.get("billing_id")
}

# Step 3: Invoke the second tool directly inside the runtime
result = shipping.create_shipment(**shipping_payload)

# Only this minimal summary returns to the model's context window
print(f"Shipment created successfully: {result['tracking_number']}")

Because data transformation, filtering, and cross-tool orchestration occur inside the sandbox runtime, intermediate data never touches the LLM context window. Anthropic highlighted this architectural advantage in their research on code execution with MCP, demonstrating that moving a Google Drive file transfer to Salesforce from prompt-based tool calling to code execution reduced token consumption from 150,000 tokens down to 2,000 tokens (a 98.7% reduction). The model receives only the final standard output emitted by the script.

Benchmark Breakdown: Token Reduction, Latency, and Task Accuracy

Reducing tokens often raises concerns about execution latency and problem-solving reliability. However, empirical analysis reveals that Code Mode improves latency while preserving task accuracy.

In the 508-tool benchmark, classic MCP completed the evaluation suite with an execution time that scaled directly with message size. Transferring large JSON payloads across HTTP transport boundaries and processing massive prompt contexts inside the model's attention mechanism introduces substantial time-to-first-token (TTFT) delays.

Total Execution Time per Query (508-Tool Benchmark)
Classic MCP:   |████████████████████████| ~18.4s
Code Mode:     |███████████             | ~11.1s (~40% faster)

Code Mode cuts end-to-end task execution latency by roughly 40% in complex multi-tool tasks. The latency savings stem from two mechanical factors:

1. Fewer inference round-trips: Chaining three tools together in classic MCP requires three separate model generation steps, three network round-trips, and three queue intervals. In Code Mode, the model writes a single script that executes all three tool operations in one pass inside the gateway runtime.
2. Accelerated prompt processing: Reducing prompt size from 200,000 tokens to under 10,000 tokens allows model providers to compute KV-cache activations significantly faster.

Task success rates remained identical across both modes. In Round 1 (96 tools), both approaches achieved 64/64 completed tasks (100%). In Round 2 (251 tools), classic MCP failed on one task due to argument hallucination caused by tool definition crowding, scoring 64/65 (98.5%), while Code Mode passed 65/65 (100%). In Round 3 (508 tools), both reached 65/65 (100%). By shielding the model from irrelevant tool definitions, Code Mode eliminates tool-selection confusion.

Architectural Comparison: Classic MCP vs Code Mode

The structural differences between classic tool invocation and code-driven execution alter the entire request lifecycle between client applications, gateways, and underlying services.

Feature / Dimension	Classic MCP Tool Calling	Gateway Code Mode
Tool Interface Format	Verbose JSON Schema injected into prompt	Python stub signatures loaded on demand
Discovery Mechanism	Static upfront declaration on every request	Progressive filesystem navigation via meta-tools
Multi-Tool Chaining	Multiple model turns; model parses every output	Single script execution inside a sandboxed runtime
Context Window Impact	Scales linearly with total tool count ($O(N)$)	Stays near-constant regardless of catalog size ($O(1)$)
Execution Environment	Client application or host runtime	Sandboxed Starlark interpreter inside Bifrost
Intermediate Payload Handling	Re-enters model context on every turn	Filtered in memory; only final output returned
Provider Support	Universal (OpenAI, Anthropic, Bedrock, Vertex)	Universal via OpenAI-compatible endpoints

Under classic MCP, scaling an enterprise tool catalog inevitably degrades developer experience. Platform teams are forced to curate small, rigid tool subsets for specific agents to prevent context overflow. Code Mode decouples the total catalog size from prompt consumption, enabling an agent to access hundreds of enterprise services simultaneously without penalty.

Gateway Governance: Virtual Keys and Endpoint Control

While Code Mode dramatically cuts token consumption, granting models the ability to execute code and orchestrate tools requires strict infrastructure safeguards. Uncontrolled tool execution can expose internal APIs to unintended modifications or unbudgeted usage spikes.

Bifrost implements governance at the gateway layer using virtual keys. Virtual keys act as policy-enforcing access proxies between consuming agents and connected providers. Administrators configure granular limits on each virtual key, defining maximum spend per hour, rate limits, and allowed model routes.

Beyond general routing, Bifrost applies governance and security controls (virtual keys, budgets, guardrails, audit logs) centrally, and Bifrost Edge extends that same governance and security to AI traffic on employee machines, with endpoint enforcement on each device.

Using Bifrost's native tool filtering and MCP governance, platform teams specify exactly which MCP servers and functions each virtual key can discover. Even if 500 tools are connected to the central gateway, a developer testing an internal assistant can be restricted to documentation tools, blocking access to production databases or payment processors.

# Virtual key policy configuration in Bifrost
virtual_key:
  id: "vk_analytics_agent_prod"
  name: "Analytics Agent Key"
  budget:
    max_limit_usd: 150.00
    reset_interval: "monthly"
  mcp_tools:
    allow:
      - "servers.data_warehouse.*"
      - "servers.reporting_api.generate_chart"
    deny:
      - "servers.data_warehouse.drop_table"
      - "servers.payment_service.*"
  code_mode:
    enabled: true
    max_execution_time_ms: 5000
    memory_limit_mb: 128

For large organizations, enterprise MCP tool groups allow security teams to assemble approved server collections that automatically map to SSO roles and active directory groups. Every tool call executed through Code Mode generates an entry in the gateway's audit logs, capturing the generated code, invoked tools, input arguments, execution duration, and token usage for regulatory compliance.

When to Use Code Mode Versus Direct Tool Calls

Although Code Mode delivers substantial savings for expansive tool libraries, direct tool calling remains effective for simpler architectures. Engineering teams should select the execution pattern matching their infrastructure footprint:

                  ┌──────────────────────────────┐
                  │ How many MCP tools connected?│
                  └──────────────┬───────────────┘
                                 │
                 ┌───────────────┴───────────────┐
                 ▼                               ▼
          [ 1 to 20 Tools ]              [ 25+ Tools ]
                 │                               │
                 ▼                               ▼
   ┌───────────────────────────┐   ┌───────────────────────────┐
   │ Are multi-step operations │   │ Use Bifrost Code Mode:    │
   │ chaining large payloads?  │   │ - Progressive discovery   │
   └─────────────┬─────────────┘   │ - Sandboxed execution     │
                 │                 │ - 80% to 92% token cuts   │
        ┌────────┴────────┐        └───────────────────────────┘
        ▼                 ▼
     [ No ]            [ Yes ]
        │                 │
        ▼                 ▼
┌──────────────┐   ┌──────────────┐
│ Use Classic  │   │ Use Bifrost  │
│ Tool Calling │   │  Code Mode   │
└──────────────┘   └──────────────┘

Adopt Code Mode when:

• An agent connects to three or more MCP servers exposing more than 30 total tools.
• Multi-step tasks pass large intermediate datasets (spreadsheets, SQL dumps, PDF text) between tools.
• Token budgets and context limits constrain agent reliability or operational viability.
• Tasks require programmatic loops, conditional logic, or batch processing across multiple APIs.

Retain Classic MCP when:

• An agent connects to one or two specialized servers with fewer than 15 total tools.
• Every user request requires a straightforward, single-tool invocation (for example, fetching current weather).
• The execution client cannot parse meta-tools or lacks support for code-generation prompting patterns.

Bifrost supports a hybrid operational model: teams can enable Code Mode for heavy data servers (such as Google Drive, Jira, and PostgreSQL) while exposing lightweight utilities as direct tools through the same unified endpoint.

Frequently Asked Questions

What causes high MCP tool token costs in AI agents?

High MCP tool token costs stem from the protocol's default practice of injecting complete JSON Schemas for every connected tool into the model's prompt on every turn. As teams add servers and tools, tens of thousands of tokens are consumed by static interface definitions before the model processes user instructions.

How does Code Mode reduce MCP token usage without losing tools?

Code Mode replaces upfront schema injection with progressive discovery via four compact meta-tools. The gateway exposes tools as virtual Python stub files that the agent inspects only when needed. Unused tools never enter the context window, reducing prompt size by up to 92.8%.

Does Code Mode impact agent task completion rates?

No. In controlled benchmark evaluations across 508 tools and 16 servers, Code Mode achieved a 100% pass rate (65/65), matching or slightly exceeding classic MCP. By eliminating tool-catalog clutter, Code Mode reduces prompt confusion and parameter hallucination.

What execution environment runs the generated code in Code Mode?

Code Mode executes Python scripts within an embedded, sandboxed Starlark interpreter inside Bifrost. Starlark enforces deterministic execution without permitting host filesystem access, uncontrolled network requests, or external shell access, ensuring secure execution at line-rate speed.

Can Code Mode and classic MCP tool calling be combined?

Yes. Bifrost allows administrators to configure Code Mode selectively per client or per server group. High-footprint data sources can run through Code Mode's progressive discovery, while small, frequently used utility tools remain directly exposed as classic function calls.

How does an MCP gateway enforce security on dynamic code execution?

Bifrost secures code execution by running scripts inside an isolated Starlark sandbox, applying virtual key access policies, and filtering tool availability before execution. Sensitive actions require explicit policy grants, and every executed script and tool call is captured in immutable audit logs.

Managing MCP Tool Costs at Scale

Connecting hundreds of enterprise tools to autonomous agents no longer requires sacrificing context budgets or accepting runaway token bills. By replacing static schema injection with on-demand discovery and sandboxed orchestration, Bifrost Code Mode cuts MCP tool token costs by over 92% while accelerating execution speed and preserving complete task accuracy. Combined with automatic fallbacks, semantic caching, and centralized policy governance, the gateway delivers the infrastructure foundation needed to scale agentic workflows sustainably.

Teams evaluating MCP optimization can request a Bifrost demo, explore Bifrost Enterprise, or inspect the open-source repository.

Sources

• Anthropic Engineering: Code execution with MCP: building more efficient AI agents
• Model Context Protocol: Protocol Specification and Architecture
• Cloudflare Blog: Code Mode: Executing Agent Code
• Bifrost Documentation: Code Mode Benchmark and Architecture