Claude Code's Code Mode: Claude writes JavaScript to call its tools, and auto mode reviews the script, not each call

Anthropic has published the documentation for Code Mode, the experimental option it added to Claude Code v2.1.323 on November 12. With it on, Claude stops asking for tool calls one at a time. It writes a piece of JavaScript that calls Bash, Read, Edit and the rest, and Claude Code runs that script in your session. You turn it on with the environment variable CLAUDE_CODE_EXPERIMENTAL_CODE_MODE=1; it is off by default, and the docs page went live after the release (it still returned 404 on the morning of November 13).

The idea is not new. Cloudflare's Kenton Varda and Sunil Pai called it "Code Mode" in September 2025, when they turned MCP tools into a TypeScript API and had models write code against it. Anthropic's own engineering post from November 2025, "Code execution with MCP", argued the same thing with a toy example that cut a workflow from 150,000 tokens to 2,000. The academic version is CodeAct (Xingyao Wang et al., arXiv:2402.01030), which reported up to 20% higher success rates when agents act in Python instead of JSON. What is new is that Anthropic now applies it to its own coding agent, and to the built-in tools rather than just MCP servers.

What a step looks like

The docs give this example for "raise a retry limit": find the file, edit it, run the tests, and hand back only what Claude needs to read.

const files = await $`rg -l "function retryPolicy" src`.text();
const target = files.trim().split("\n")[0];
await edit(target, "maxAttempts: 3", "maxAttempts: 5");
({ edited: target, tests: $`npm test -- retryPolicy`.nothrow() });

Without Code Mode that is three round trips, each with the full output pasted back into the context. Here the search result feeds the edit directly, and the last expression decides what comes back. Anthropic suggests it for changes that repeat across many files, searches whose results need filtering, and independent commands that can run in parallel. The terminal still shows the individual tool calls; the script itself sits behind Ctrl+O as a collapsed "Code" row.

The docs contain no measurements: no token counts, no speedups, no comparison with ordinary tool calling. The savings are plausible from the mechanism, but for Claude Code they are so far an untested assumption.

Permissions: the script gets reviewed, the values don't

This is the part worth reading before turning it on. Each tool call the script makes still goes through your deny and ask rules and PreToolUse hooks. What changes is auto mode: its classifier now reviews each piece of code before it runs, "not each tool call". The docs spell out the consequence: the classifier "doesn't see values computed at run time, such as a path taken from search output". A script that greps for a filename and then deletes whatever it found looks harmless at review time.

Anthropic's advice is to keep hard rules or hooks for anything you must control, and you can inspect the code yourself with a PreToolUse hook matching the REPL tool, which receives the JavaScript in tool_input.code. The page also repeats a warning that applies with or without Code Mode: Bash rules match command text, so a denied command can run in a form the rule doesn't match.

A few other choices show where Anthropic expects trouble:

• A cloned repository can't switch it on. Claude Code ignores the variable in a project's settings files; only your shell or ~/.claude/settings.json count. Administrators can block it with "CLAUDE_CODE_EXPERIMENTAL_CODE_MODE": "0" in managed settings, but can't force it on.
• Concurrent scripts lose their review. If Claude starts new code in auto mode while earlier code is still running, the earlier code's remaining calls fall back to prompts, with a two-minute countdown when no IDE is attached. Miss it and the call is refused.
• Hooks fail closed. A PreToolUse hook that crashes or times out on a call from Claude's code refuses the call, even without onFailure set.
• Time limits. A script Claude waits on stops after ten minutes, permission prompts included. In auto or bypassPermissions mode it can run in the background for up to two hours.

Who can use it

The requirements are narrow. Code Mode works with Claude Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.2, only in an interactive terminal session of the native build, and only against Anthropic's own API with a subscription or Console account. It does not work with claude -p, the Agent SDK, the VS Code panel, the Desktop app, cloud sessions, Amazon Bedrock, Google Cloud, Microsoft Foundry, gateways, zero data retention or HIPAA organizations. OpenTelemetry export, DISABLE_TELEMETRY (which also stops feature-flag downloads), API key helpers and agent teams all block it. A Code Mode session can only be resumed with Code Mode still on, and Remote Control, Claude in Chrome and computer use are unavailable inside one. The first troubleshooting reason in the table, "it isn't open to your account yet", suggests a staged rollout behind a server-side flag.

What the binary added

Before the docs existed, we pulled strings from the linux-x64 build of v2.1.323. They fill in a few details the page leaves out, with the usual caveat that strings show what the code can do, not how Anthropic uses it:

• Scripts run in a JavaScript vm context created with codeGeneration: { strings: false, wasm: false }, so code inside the REPL can't use eval, new Function or WebAssembly. There is also a per-script step budget and a tool-call counter. That limits the script itself; it is not a sandbox for what the tools do, which run with your permissions as before.
• Some tools exist only inside scripts. A ToolSearch message in the binary reads: "These tools also match ..., and only a REPL script can call them", followed by an example await toolName({...}). Flags such as codeModeHidesToolNamesFromApi point the same way: in Code Mode, part of the toolset is presented to the model as functions rather than as API tool definitions.
• Code Mode runs only on Claude Code's pinned Bun. Otherwise the REPL refuses with "the JavaScript engine under Claude Code failed Code Mode's engine check", which fits the docs' "native build" requirement.

Two releases in, the edges show

v2.1.325, released on November 13, already fixes three Code Mode bugs: scripts ignored a worktree entered with EnterWorktree and wrote ~ paths into the project, words typed alongside a "Yes" at a permission dialog never reached Claude, and resuming a session that ended mid-script made Claude start working on its own. None of that is unusual for an experimental flag, but the worktree bug is the kind that matters if you rely on worktrees to keep an agent's edits contained.

We looked at a related question last week, when a paper compared MCP and CLI tool access and found no consistent winner. Code Mode is a third answer: give the model a programming language and let it compose the tools itself. Whether that saves as much in a real coding session as it did in Anthropic's MCP example is the number nobody has published yet.