JA EN
shiichan

MCP Portals Let Admins Turn On Code Mode by Default!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#ai#security

Hey everyone, it's Shiichan! Today's update is a small but genuinely useful one for anyone running an MCP (Model Context Protocol) server portal.

Cloudflare Changelog developers.cloudflare.com

What was announced?

Cloudflare's Changelog announced new policy controls for Code Mode on MCP portals. Code Mode lets clients search for and execute tools exposed by an MCP server, and now admins can control exactly how it behaves per portal using four policy levels.

  • Off — Code Mode is unavailable
  • Opt-in — clients can choose to turn it on
  • On by default — enabled out of the box
  • Enforced — Code Mode is required for every session

The story so far

Previously, whether Code Mode was allowed came down to a single boolean, allow_code_mode. Each portal only had an on/off choice, with no way to make it the default or require it.

That boolean is now deprecated. Existing portals migrate automatically without changing behavior: portals that previously allowed Code Mode become Opt-in, and portals that didn't become Off. New portals default to Opt-in.

What changes

The biggest win is cutting token usage on portals with large tool catalogs. Turning Code Mode on by default means clients get efficient tool search and execution from the start, without needing to enable it themselves.

Clients still keep some control:

  • On an Opt-in portal, clients turn it on themselves with ?codemode=search_and_execute
  • On an On by default portal, clients can opt out with ?codemode=off (useful if a client already runs its own Code Mode implementation and wants to avoid nested code execution)
  • On Off and Enforced portals, client overrides are ignored — the admin's policy wins

Dive Deep

You can also set this through Cloudflare's API using the code_mode field.

{ "code_mode": "default_on" }

Supported values are off, opt_in, default_on, and enforced. Since the old allow_code_mode boolean is deprecated, code_mode is the field to use going forward.

Wrap-up

  • MCP portals gained four Code Mode policies: Off, Opt-in, On by default, and Enforced
  • Existing portals migrate automatically, and new portals default to Opt-in
  • The API now exposes this through the code_mode field, replacing the deprecated allow_code_mode boolean
  • Turning it on by default can drastically cut token usage on portals with large tool catalogs

This one's especially handy if you're running MCP servers behind a portal for others to use.

Related posts