# Code mode

Discover operation schemas, execute allowlisted requests, and return only the evidence a task needs.

Canonical: https://docs.tamperbox.dev/mcp/code-mode/
Updated: 2026-10-19
Applies to: MCP 0.2.0
Prerequisites: A connected Tamperbox MCP server
Outputs: Focused schema fragments or composed operation results
Limitations: Each execution has time, memory, result-size, and API-call budgets.

## Search before execution

Filter `operations` by the task language and return the operation ID, method, path, descriptions, and schemas you need.

```js
return operations
  .filter((op) => /spf|dmarc|dkim/i.test(`${op.summary} ${op.description}`))
  .map((op) => ({
    operationId: op.operationId,
    method: op.method,
    path: op.path,
    inputSchema: op.inputSchema,
    outputSchema: op.outputSchema,
  }));
```

Avoid returning the full OpenAPI document. Focused discovery keeps context small and reduces schema mistakes.

## Execute documented calls

Use the uppercase HTTP method and exact path returned by discovery. Put path parameters in the path, scalar query values in `query`, and JSON input in `body`.

```js
const formatted = await tamperbox.request({
  method: 'POST',
  path: '/v1/tools/json_format',
  body: {
    input: { mediaType: 'application/json', value: '{"ready":true}' },
    options: { indent: 2 },
  },
});
return formatted.output;
```

## Preserve interpretation

Return warnings and provenance when they affect the conclusion. A DNS failure is not an empty answer. A decoded token is not verified. A server-side HTTP observation is not a complete security audit.

## Compose carefully

Feed one operation's artifact into another only when the output and input schemas match. Await every request. Outstanding requests are cancelled when the execution ends.

## Browse website tools by task

The bundled `spec['x-tamperbox-directory']` lists all 67 website tools in 11 categories, including six browser-only tools and the website-only Locator Checker. Use MCP `search` to inspect this metadata without making a network request:

```js
const directory = spec['x-tamperbox-directory'];
return {
  categories: directory.categories,
  tools: directory.tools.filter(tool => tool.category === 'localization'),
};
```

Each tool includes its category, related tool IDs, website and documentation URLs, execution mode, and `operationIds`. An empty `operationIds` list means the tool has no executable API operation; open its website page instead. Ordinary related links carry no input. Result actions transfer only compatible derived values.