Code Mode on Node: a drop-in Executor for CLIs and MCP servers

[a-saeedia]

The runtime docs say the Executor is replaceable, and the package ships two: DynamicWorkerExecutor (Workers) and IframeSandboxExecutor (browser). Nothing ships for Node, which is where most MCP hosts actually run — and importing the package there is still a problem (#2142).

I built the missing third one as a standalone package: a-saeedia/codemode-node (MIT).

import { codeMcpServer } from "@cloudflare/codemode/mcp";
import { NodeExecutor } from "codemode-node";

codeMcpServer({ server, executor: new NodeExecutor() })

How it works. One disposable child process per execution. Code runs in a fresh vm context with no require, import, process or filesystem; providers are injected as namespaces that proxy tool calls back to the host over IPC, so tool implementations and credentials never leave the parent. The timeout is a hard SIGKILL — vm timeouts only cover synchronous execution, so while (true) await sleep(...) needs a process to kill.

Measured, same task both ways on Windows 11 / Node 22, 3 runs median:

	round trips	payload to model	local wall
5 discrete tool calls	5	41,812 B	2,240 ms
one code call	1	145 B	2,733 ms

Caveats, stated plainly: this is capability isolation, not a security boundary — node:vm is not a jail, and the host tools really do things (shell, fs, http). It's unofficial and pinned to @cloudflare/codemode@0.5.5, because a minor bump on a Workers-first package can add a cloudflare:workers import that Node can't load. If you're on Workers, DynamicWorkerExecutor is strictly better — use it.

Install today from the tarball (npm publish is pending):

npx -y https://github.com/a-saeedia/codemode-node/tarball/main --stats

--stats prints what your current MCP config costs in schema tokens versus what a single code tool costs. Happy to take feedback on the executor shape if anyone wants a different transport.

[a-saeedia]

Published on npm: npx -y node-code-mode (v0.1.2).

Heads up on the name: npm rejected codemode-node as too close to the existing codemode package (404 on publish, no explanation). The package is node-code-mode and the repo moved to https://github.com/a-saeedia/node-code-mode — GitHub redirects the old URL. Same code as described above.