Where the Orchestration Program Runs - Programmatic Tool Calling in the Claude and OpenAI APIs, and Code Mode in Agent Harnesses

First Published: 2026-10-15
Last Updated: 2026-10-15

When an agent calls tools repeatedly, there is a method that allows the agent to call them in bulk within a program written by the model, rather than sending each individual tool call back to the model. This article calls this approach orchestrating tool calls in code. The location where these bundled programs run varies depending on the provider. With Anthropic's Claude API, the program is Python in the container of the code execution tool. With OpenAI's Responses API, the program runs in JavaScript within a newly provisioned V8 runtime for each generated program. With Cloudflare and Pi, the program runs on the side that runs the agent, rather than on the side that provides the model. This article refers to that side as the "agent harness."

OpenAI's page on Programmatic Tool Calling states the following about the runtime:

OpenAI runs each generated program in a fresh, isolated V8 runtime.

Anthropic's page on Programmatic tool calling describes the allowed_callers field for tool definitions as follows:

Do not rely on `allowed_callers` as a security boundary.

Anthropic's page on the code execution tool describes the state when reusing a container as follows:

the Python interpreter state (such as variable bindings) also persists across requests that reuse the container.

Cloudflare's blog post from September 26, 2025, describes the sandbox for Code Mode as follows:

There are no containers. We have something much better: isolates.

One of the authors of Pi wrote an article on October 6, 2026, describing Pi's Codemode as follows:

In case of Pi it's running in QuickJS within a WASM runtime with intentional limitations: no network, no file system, no timers, limited RAM.

These four approaches differ in where the program runs, what it does not have, the state that remains afterward, data retention, the tools that can be called, and where approval is placed. This article correlates these aspects with individual lines from the documentation. Where the sources disagree, and where no statement was found after searching, it shows both statements with the verification date. This article is not a user guide, nor does it recommend which approach to use. This article has not run any of these four approaches; all descriptions are based solely on cross-referencing the documentation.

Related articles on this site:

1. Introduction — Scope, Verification Date, and Versions
2. The Vocabulary of Boundaries and the Table Columns
3. Anthropic's Programmatic Tool Calling — Python in the Code Execution Container
4. OpenAI's Programmatic Tool Calling — JavaScript in a Fresh V8 Runtime for Each Program
5. Code Mode on the Agent Harness Side — Cloudflare and Pi
6. The Four Runtimes Side by Side
7. Where Approval and Boundaries Go — What Each Provider Writes
8. Where the Sources Disagree and Where No Statement Was Found
9. Frequently Asked Questions about Where the Orchestration Program Runs
10. Summary
11. References

1. Introduction — Scope, Verification Date, and Versions

This chapter defines the scope of this article, including the date and version of the information verified, as well as the source materials consulted. Furthermore, it will first clarify any instances where the same term may refer to different entities.

1.1 What This Article Covers and What It Does Not

This article covers the following four methods:

Anthropic's Programmatic Tool Calling: A method where, through the Claude API's Messages API, Claude writes Python code in the container of the code execution tool and then calls user-provided tools within that code (Section 3).
OpenAI's Programmatic Tool Calling: A method where, using OpenAI's Responses API and Agents API, the model writes JavaScript programs and then calls tools from those programs (Section 4).
Cloudflare's Code Mode: A method using the @cloudflare/codemode package within Cloudflare Agents, where the model-generated code is executed within a Dynamic Worker and tools are called through a connector (Section 5.1).
Pi's Codemode: A method where tools are called from JavaScript code generated by the model, inside Pi, an agent harness (Section 5.2).

This article analyzes these four methods, correlating details from the source materials regarding where the programs run, the languages supported, what each does not have, the state that remains, data retention, available tools, and where approval is placed (Sections 6 and 7). Where the sources disagree and where no statement was found are summarized in Section 8. While OpenAI's Codex CLI also includes a code mode setting, this article only notes that two sources describe its status differently (Section 5.3). No statement of where the programs in Codex CLI's code mode run was found in the sources reviewed for this article.

This article does not cover the following.

Selecting the isolation unit for agents. The previously published Agent Sandboxing and Blast-Radius Isolation on AWS covers this.
What components are included in the runtime environment for managed agents (including Claude Managed Agents, OpenAI's Agents API, and others). The previously published Managed Agent Runtimes covers this.
Designing harnesses and environments. The previously published Claude Code Harness and Environment Engineering covers this.
Mapping API parameters. The previously published LLM API Parameter Compatibility Reference covers this.
Outbound communication from the Claude Managed Agents sandbox. Network Egress in Claude Managed Agents, a companion article published alongside this one, covers this.
What MCP servers accept. What the MCP TypeScript and Python SDKs Ask of Server Authors, a companion article published alongside this one, covers this.
Detailed instructions for using the four methods, along with comprehensive code examples from the SDK.
Other implementations, such as Google's Gemini. This article does not investigate other implementations.
Pricing, speed, and token counts. While individual vendor documentation may mention fewer round trips or fewer tokens, this article does not include those figures.
Comparing the strengths and weaknesses of the four methods. This article does not recommend which method to use.
Procedures for routing write operations through code, potentially triggered by instructions embedded in the tool's output. This article only documents what the sources state regarding where to place approval.

1.2 Verification Date, Versions, and Sources Read

This article's information was verified on October 14, 2026, using the following materials:

Anthropic's Claude documentation: Pages on Programmatic tool calling, Code execution tool, API and data retention, Claude in Amazon Bedrock (Opus 4.7 and later), Claude on Google Cloud, Claude in Microsoft Foundry, Claude Platform on AWS, List Models in the Models API, Claude Platform release notes, and various pages on Tool use.
OpenAI documentation: Pages on Programmatic Tool Calling, Changelog, Data controls in the OpenAI platform, and the Codex Configuration Reference.
OpenAI's Codex repository: GitHub release pages (version 0.162.0 and the list of releases).
Cloudflare sources: Blog post "Code Mode: the better way to use MCP" from September 26, 2025, the Cloudflare Agents documentation page on Code Mode, the "How Code Mode works" page, the "Code Mode API reference" page, and the "Pricing" page for Cloudflare Dynamic Workers.
Pi sources: Article "What is Codemode" by Armin Ronacher, one of Pi's authors, published on October 6, 2026, and announcement "Pi 1.0" by Earendil, published on October 1, 2026.

The Cloudflare documentation pages have different update dates. On this article's verification date, the "Code Mode" page had a Last updated date of June 24, 2026, the "How Code Mode works" page was updated on October 12, 2026, the "Code Mode API reference" page was updated on July 22, 2026, and the "Pricing" page for Dynamic Workers was updated on June 11, 2026.

The article about Pi is not documentation, but rather a description written by one of its authors. Whenever this article cites it, this article says that it is a piece written by one of the authors of Pi. Cloudflare's blog is also not product documentation. Whenever this article cites Cloudflare's blog, it says that it is a blog post and gives the date.

On this article's verification date, Codex release 0.162.1 and pre-releases of 0.163.0 (alpha) had followed version 0.162.0. This article refers specifically to the release notes for version 0.162.0, and does not state that 0.162.0 is the most recent version.

1.3 Words with the Same Spelling That Refer to Different Things

In this article, there are instances where the same or similar words refer to different things. To avoid any misunderstandings, this article distinguishes them first.

Programmatic tool calling and Programmatic Tool Calling: Anthropic's page is titled "Programmatic tool calling," while OpenAI's page is titled "Programmatic Tool Calling." When referring to both together, this article writes orchestrating tool calls in code. When referring to one specifically, it writes "Anthropic's PTC" or "OpenAI's PTC." "PTC" is the abbreviation used in this article for "Programmatic Tool Calling."
Code Mode, Codemode, code mode: Cloudflare uses "Code Mode," one of Pi's authors uses "Codemode," and Codex uses "code mode." This article keeps the original spelling used by the provider. One of the authors of Pi writes that Cloudflare coined the name Codemode.
Containers, runtimes, isolates, sandboxes (5 kinds distinguished in this article): (1) Anthropic's code execution container. Anthropic's page uses the term "container." (2) OpenAI's V8 runtime. OpenAI's page uses the term "runtime." (3) Cloudflare's isolate. Cloudflare's blog states that Workers are built on V8 isolates. (4) Pi's sandbox. One of the authors of Pi writes that Codemode runs in its own sandbox inside the harness. (5) The sandbox for Claude Managed Agents sessions. This is distinct from (1) and is covered in Network Egress in Claude Managed Agents, a companion article published alongside this one. Unlike the code execution container in (1), the Managed Agents environment can open and close outbound connections through the networking settings.
MCP (3 kinds distinguished in this article): (1) Anthropic's MCP connector tools. These are the tools of an MCP server connected through the Messages API's mcp_servers, and they cannot be called from Anthropic's PTC. (2) OpenAI's mcp tool. This is one of the tool types available through the Responses API and can be called from OpenAI's PTC. (3) The MCP server wrapped by Cloudflare's connector. Each time this article writes MCP, it says which MCP it means.
Versions (2 kinds distinguished in this article): (1) Versions of the code execution tool. For example, code_execution_20260120. The date-like number in the tool type name is the version name and should not be interpreted as a date. (2) Model versions. This article refers to model versions by their model names.
Approval: When this article uses the term "approval," it refers to the act of a person or user application granting permission before a tool is executed. This article does not call a decision made by the model itself approval.

2. The Vocabulary of Boundaries and the Table Columns

This chapter defines the terminology and columns used in the tables of this article. Five of the columns use the same names and have the same meanings across three articles published together.

2.1 Columns Shared by the Three Articles

The following five columns indicate where a rule takes effect as a boundary, and what is returned when that boundary is crossed.

Enforced Where: The location where the rule is enforced. In other words, who is responsible for enforcing it.
Default: Whether the rule is on or off by default, or the default value.
When It Is Crossed: What is returned when the rule is crossed.
Your Setting: The item that the user can configure. If the source does not list a setting, this article writes None stated.
Stated In: The source document for the information in this row, indicated by the page title and section name.

2.2 Columns Specific to This Article

This article adds the following columns to facilitate the comparison of four different approaches:

Runtime: The approach that the row is about. It is one of the following: Anthropic PTC, OpenAI PTC, Cloudflare Code Mode, or Pi Codemode.
Rule: The rule that the row covers.
Runs In: The environment where the program executes.
Language: The programming language used by the program.
Has No: What the source says that place does not have.
State Kept: The state that persists after the program completes or before the next invocation.
Retention and ZDR: Information regarding data retention and the handling of Zero Data Retention (ZDR).
Tools It Can Call: The tools that the program can call.
Cannot Be Called From the Program: Tools that the source says the program cannot call.

2.3 Values

The Enforced Where column has the following ten values:

The code execution container (Anthropic): Effective within Anthropic's code execution container.
The Claude API (request validation): Effective when the Claude API is validating requests.
Not an API-level block (guidance to Claude): Does not block at the API level, but effective as guidance to Claude.
A fresh V8 runtime (OpenAI): Effective within OpenAI's fresh V8 runtime.
The harness (Cloudflare Dynamic Worker isolate): Effective in the harness of Cloudflare's Dynamic Worker isolate.
The harness (Pi, QuickJS in WASM): Effective in the harness of Pi, specifically in the QuickJS runtime running in WASM.
The OpenAI-managed agent harness (Agents API): Effective in the harness for OpenAI-managed agents, used by the Agents API.
The durable runtime (Cloudflare): Effective within Cloudflare's Code Mode durable runtime.
Your application: Effective in the user's application.
The source does not say.: The source does not state where the rule applies.

The When It Is Crossed column has the following eight values:

400 invalid_request_error: The Claude API returns an HTTP 400 status and an invalid_request_error.
400 Bad Request (Foundry hosted on Azure): The Microsoft Foundry deployment, hosted on Azure, returns an HTTP 400 status.
TimeoutError inside the code: A TimeoutError occurs inside Claude's code.
Non-zero return_code with a detection_timeout message: The execution of the code results in a non-zero return_code and a detection_timeout message.
Request rejected (status not stated): The API rejects the request, but the source does not state the status code.
Program pauses until you approve: The program pauses and waits for user approval.
Blocked (fetch() and connect()): Calls to fetch() and connect() are blocked.
The source does not say.: The source does not state what is returned.

For Default, this article gives the default value from the source. If the source does not give a default, this article writes The source does not say. If the idea of a default does not apply to the rule, it writes Not applicable. In the When It Is Crossed column as well, if the rule in a row does not stop anything, this article writes Not applicable.

2.4 When the Source Does Not Say, and When the Sources Disagree

Each table cell holds only what the source says, or a summary of it. Where the source does not state something, this article writes The source does not say. Before writing it, this article searches the full text of the source document, the pages it links to, and related pages from the same provider, using the words that name the subject of the row. For Anthropic, these related pages are release notes, ZDR pages, Models API pages, platform pages, and Tool use pages. For OpenAI, they are the Changelog and Data controls pages. For Cloudflare, they are the three Code Mode pages, the Dynamic Workers page, and the blog.

If the source describes a general rule but does not specifically refer to the subject of that row, this article does not write The source does not say. Instead, it writes the general rule and notes that the subject of the row is not named.

When the sources disagree, this article lists both statements, each with its source, and does not side with either. This article always writes a disagreement as the sources disagree. The disagreements in this article are summarized in Section 8.1. Statements that were searched for but not found are listed in Section 8.2, along with the search locations and keywords used. Not finding a statement does not mean that the behavior does not exist.

This article writes dates in four distinct ways: announcement and release note dates are given by the date heading on the provider's page. Documentation pages are given by page title and this article's verification date (October 14, 2026). For Cloudflare documentation pages, the page's Last updated date is also given. GitHub releases are given by their publication time in UTC.

3. Anthropic's Programmatic Tool Calling — Python in the Code Execution Container

This chapter outlines where Anthropic's PTC runs, its underlying assumptions, how much state it keeps, what it cannot be used with, and which models and platforms it supports.

3.1 Prerequisites — Tool Versions and `allowed_callers`

Anthropic's PTC is built on top of a code execution tool. The "Programmatic tool calling" page outlines the following prerequisites.

Programmatic tool calling requires the code execution tool with the `code_execution_20260120` or later tool version.

The current versions of the code execution tool are three: code_execution_20250825, code_execution_20260120, and code_execution_20260521. The "Code execution tool" page states that code_execution_20260120 includes the persistence of the REPL state and PTC functionality. The same page indicates that code_execution_20260521 uses the same execution environment as code_execution_20260120, with the difference being that the tool description informs Claude about the 90-second limit per Python cell in PTC. An older version, code_execution_20250522, which only supports Python, is described as a legacy version on the "Code execution tool" page. This article does not use this version as an example.

Users specify the allowed_callers in the definition of the tool they want to call from the code. The following example is based on the example on the "Programmatic tool calling" page, with the input schema shortened.

{
  "name": "query_database",
  "description": "Execute a SQL query against the database",
  "input_schema": {
    "type": "object",
    "properties": {
      "sql": { "type": "string" }
    },
    "required": ["sql"]
  },
  "allowed_callers": ["code_execution_20260120"]
}

Within the tools section of the same request, the code execution tool is included as {"type": "code_execution_20260120", "name": "code_execution"}. The value of allowed_callers can be one of three options:

["direct"]: Claude is guided to call this tool directly. This is the default behavior when allowed_callers is omitted.
["code_execution_20260120"]: Claude is guided to call this tool only from within the code execution environment.
["direct", "code_execution_20260120"]: Claude is allowed to call this tool either directly or from within the code execution environment.

The "Programmatic tool calling" page states that either "code_execution_20260120" or "code_execution_20260521" can be used in allowed_callers without any difference in behavior. Regardless of which version the request declares, the response blocks tag the caller as code_execution_20260120.

3.2 Flow of a Single Tool Call

The "Programmatic tool calling" page describes the flow of a single tool call in five stages.

Claude generates Python code that calls the tool as a function.
Claude executes this code within a sandboxed container.
When the tool's function is called in the code, the code execution pauses, and the API returns a tool_use block.
When the user provides the tool's result, the code execution continues. Intermediate results are not included in Claude's context.
Once the code execution is complete, Claude receives the final output and continues its work.

Figure 1 illustrates this flow, separating the events that occur in the container and those that occur on the user's side. Figure 1 separates the fourth stage into two parts: the user executing the tool and returning the results, and the code resuming.

In this flow, the user's client executes the tool. The code in the container calls the tool's function and waits for the result. The tool_use block returned by the API includes a caller field. The type of the caller is code_execution_20260120, and the tool_id corresponds to the id of the server_tool_use block associated with the code execution that initiated the call.

Requests from the user providing the tool's result must adhere to three rules. First, the user's message carrying the result can contain only tool_result blocks. No text can be added. Second, the user must pass the container ID from the paused response. While waiting for the result, the container ID cannot be omitted, and the API will reject requests without a container ID. Third, the user must send the same tools array that was originally sent.

Within the container, the tool appears as an asynchronous Python function. The "Programmatic tool calling" page states that Claude's code can call the tool concurrently using asyncio.gather. Each function accepts a single dictionary as an argument and returns the text from the user-provided tool_result as a string.

3.3 Container Lifetime and the State That Remains

Anthropic's PTC uses the same containers as code execution. The "Programmatic tool calling" page describes container lifetime as follows:

Idle containers are currently reclaimed after about 5 minutes, and no container can be reused more than 30 days after it was created.

The same page describes calls that are awaiting results as follows:

While Claude's code is waiting for a programmatic tool result, the pending call times out after about 4 minutes and raises a `TimeoutError` inside the code.

The error example on the same page shows a TimeoutError message indicating no response after 270s. The text states the timeout is about 4 minutes, while the example message specifies 270 seconds.

Unless reusing existing containers, a new container is created for each request. If the user passes the container ID from the previous response in the next request, the same container is reused. The "Code execution tool" page describes the remaining state when a container is reused as follows:

With `code_execution_20260120` or later and programmatic tool calling, the Python interpreter state persists as well.

In other words, when reusing a container for a request, in addition to files, the state of the Python interpreter (such as variable bindings) is also preserved.

Regarding the idle period of about 5 minutes, two pages use different phrasing. The "Programmatic tool calling" page states that an idle container is reclaimed after about 5 minutes. The "Code execution tool" page states:

After about 5 minutes of inactivity a container is checkpointed, and sending a request with its ID inside the 30-day window restores it.

This article presents both phrasings and does not favor one over the other (Section 8.1, item 1). The "Code execution tool" page also notes that the expires_at value of the container in the response is a shorter value that does not report the 30-day limit.

Regarding the resources and environment of the code execution container, the "Code execution tool" page states:

The Python version is 3.11.
The memory is 5 GiB.
The disk space, used as a workspace, is 5 GiB.
There is 1 CPU.
In PTC, each REPL cell has a 90-second wall-clock limit. Cells exceeding this limit will return a non-zero return_code and a message indicating the detection_timeout state.
Internet access is disabled.

Regarding networking, the "Code execution tool" page states:

The container has no internet access, so Claude can't download packages at runtime: only the pre-installed libraries are available

The "Alternative implementations" section, near the end of the "Programmatic tool calling" page, describes how users can manage their own sandboxes, providing an example with no network egress. The text in this section refers to sandboxes created and managed by the user; it does not describe Anthropic's container specifications. The basis for the network statement about Anthropic's container is the sentence from the "Code execution tool" page above.

3.4 Anthropic: Do Not Rely on `allowed_callers` as a Security Boundary

The "Programmatic tool calling" page describes how strong allowed_callers is as follows:

`allowed_callers` controls how the tool is presented to Claude and is validated against `tool_choice`, but it is not a hard API-level block on direct invocation. Claude is strongly guided to respect it, but your client should still be prepared to handle a direct `tool_use` for any tool it defines. Do not rely on `allowed_callers` as a security boundary.

Specifically, even a tool configured with only "code_execution_20260120" in its allowed_callers list will not prevent the API from accepting direct calls to that tool. Instead, allowed_callers determines how the tool is presented to Claude, and is validated in conjunction with tool_choice. Anthropic's documentation advises that clients should ensure they can handle direct tool_use for any tool they define.

The API validates allowed_callers in combination with tool_choice. If tool_choice specifies a tool that does not include "direct" in its allowed_callers list, the API will return an HTTP 400 error, indicating an invalid_request_error.

3.5 Tools That Cannot Be Used Together, and Tools That Cannot Be Called

The "Programmatic tool calling" page lists three things that cannot be used in conjunction with PTC.

Tools configured with strict: true (Structured outputs).
Forcing programmatic calling of a specific tool through tool_choice.
disable_parallel_tool_use: true.

Section 8 of the previously published LLM API Parameter Compatibility Reference details how strict: true and disable_parallel_tool_use are handled as API parameters.

The same page also lists two tools that cannot be called from code.

Tools provided by the MCP connector.
The "computer use" and "browser use" toolsets (computer_toolset_20260801 and browser_toolset_20260801). These two toolsets only accept "direct" as a value for the allowed_callers parameter.

Tools with input schemas that contain recursive $ref (circular references) also cannot be configured for calling from code. If you attempt to specify code execution as a value for the allowed_callers parameter for such a tool, the request will fail with a 400 invalid_request_error containing the message Circular $ref detected. The same schema is accepted for direct tool calling.

Regarding the results of tools called from code, the same page notes that the results are returned as strings, potentially containing code snippets or commands that can be executed. It also cautions users to be aware of the risk of code injection when dealing with tools that return data from external sources, as the output may be interpreted or executed as code.

3.6 Supported Models and Platforms

The metadata (frontmatter) at the top of the "Programmatic tool calling" page gives PTC's status as ga and its ZDR as not-eligible. The same metadata lists the following supported platforms:

Claude API: ga
Claude Platform on AWS: ga
Microsoft Foundry: ga. However, it requires a Hosted on Anthropic deployment.

The Microsoft Foundry page lists code execution and PTC as features that are not supported with deployments hosted on Azure.

Requests that use these features against a deployment hosted on Azure return a `400 Bad Request` error by design.

This metadata does not list Amazon Bedrock or Google Cloud as supported platforms. Both the "Claude in Amazon Bedrock (Opus 4.7 and later)" page and the "Claude on Google Cloud" page include the following line in their list of unsupported features:

Agent infrastructure (Agent Skills, MCP connector, programmatic tool calling)

The "Claude in Amazon Bedrock (Opus 4.7 and later)" page also lists server-side tools, including code execution, in its list of unsupported features. Similarly, the "Claude on Google Cloud" page lists server-side tools, including code execution, in its list of unsupported features.

The supported models are listed in the supportedModels section of the metadata on the "Programmatic tool calling" page. On this article's verification date, the list includes: Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5, Claude Mythos 5, Claude Opus 5.5, Claude Opus 5, Claude Opus 4.8, Claude Opus 4.7, Claude Opus 4.6, Claude Opus 4.5, Claude Sonnet 5.5, Claude Sonnet 5, Claude Sonnet 4.6, Claude Sonnet 4.5, and Claude Haiku 5.5. Claude Haiku 4.5 accepts the code_execution_20260120 and later tool versions, but does not support PTC. This list is subject to change as new models are added.

You can also verify whether a model supports programmatic tool calling using the Models API. The "List Models" page in the Models API describes capabilities.code_execution as indicating whether code running in the code execution tool can call the request's other tools. Whether the model supports the code execution tool itself is shown by capabilities.server_tools.code_execution. The "Code execution tool" page specifies that when checking for code execution tool support, you should not use the top-level capabilities.code_execution field. These two fields do not disagree; they serve different purposes (Section 8.1, item 5).

Anthropic's PTC dates, by the date headings of the Claude Platform release notes, are as follows:

November 24, 2025: PTC was released in public beta.
February 17, 2026: PTC became available without beta headers.
June 11, 2026: The code execution tool was updated to support code_execution_20260521.
June 18, 2026: The SDKs for seven languages added support for code_execution_20260120. The same entry calls this version the minimum version for PTC.

4. OpenAI's Programmatic Tool Calling — JavaScript in a Fresh V8 Runtime for Each Program

This chapter shows where OpenAI's PTC runs, what it does not have, which tools it can call, how OpenAI writes about choosing between PTC and direct calls, and how it handles ZDR.

4.1 The Runtime and What It Does Not Have

OpenAI's "Programmatic Tool Calling" page describes the runtime as follows:

OpenAI runs each generated program in a fresh, isolated V8 runtime. The runtime supports JavaScript with top-level `await`, but it does not provide Node.js, package installation, direct network access, a general-purpose filesystem, subprocess execution, a console, or persistent JavaScript state between program executions.

The same section states that a program can only interact with external systems through tools enabled in the request, and that it can emit output using text(...) or image(...).

In other words, programs within OpenAI's PTC operate within a new runtime for each generated program, and do not retain JavaScript state across program executions. This is a key difference from Anthropic's PTC, where reusing containers can leave Python state behind.

OpenAI's PTC page clarifies that OpenAI executes the generated JavaScript, while the user's application executes the returned function calls, but does not execute the generated JavaScript itself. The response output includes a program item containing the generated JavaScript, a function_call item for each function call made by the program, and a program_output item containing the program's final result. The program item includes an opaque fingerprint used to resume or replay the program. The user then returns the function's result as function_call_output, copying caller from the function_call without changing it. OpenAI's page states that the service uses this value to correctly resume the program.

No statement of a limit on the program's execution time or memory was found on OpenAI's PTC page (Section 8.2).

4.2 `programmatic_tool_calling` and `allowed_callers`, Target Tools

In the Responses API, users can add the programmatic_tool_calling hosted tool to their requests and specify allowed_callers for the tools they want to call from programs. An example on the OpenAI page is structured as follows:

[
  {
    "type": "function",
    "name": "get_inventory",
    "description": "Return an object with sku (string) and available_units (number).",
    "parameters": {
      "type": "object",
      "properties": {
        "sku": { "type": "string" }
      },
      "required": ["sku"],
      "additionalProperties": false
    },
    "allowed_callers": ["programmatic"]
  },
  {
    "type": "programmatic_tool_calling"
  }
]

The example on the OpenAI page also includes an output_schema for this function. For brevity, this article omits the output_schema.

allowed_callers has three values. The OpenAI page describes each as follows:

Omitted or ["direct"]: The model can call the tool directly.
["programmatic"]: See the sentence below.
["direct", "programmatic"]: The model can call the tool directly or from a program.

The sentence for the ["programmatic"] row is:

Only code in a `program` item can call the tool.

Regarding ["programmatic"], the OpenAI page states that only code in a program item can call the tool. No statement of where or how this rule is enforced, or of what is returned when it is crossed, was found on OpenAI's page (Section 8.2). This article does not say whether Anthropic's allowed_callers or OpenAI's is stronger (Section 8.1, item 2).

The following types of tools can be assigned allowed_callers: ["programmatic"]:

function and custom
mcp
apply_patch
Local and hosted shell
code_interpreter

Regarding MCP tools, the OpenAI page states that the tool's require_approval setting may cause the program to pause until the user approves the call. For tools hosted by OpenAI, the documentation advises users to read the descriptions of data retention and security for those tools before enabling them in a program.

Tool search runs as a top-level tool in the Responses API and does not operate from within the generated JavaScript. Functions, custom tools, and MCP tools configured with defer_loading: true are initially inaccessible from the program. After the model loads the relevant tool, the program can call that tool if the allowed_callers field includes programmatic.

4.3 How OpenAI's Page Recommends Choosing Between Them

OpenAI's PTC page provides a table outlining the distinction between using PTC and directly calling tools. Within that table, the row about writes and approval reads:

Use direct tool calling by default to preserve a clear authorization boundary.

The left-hand column in this row is labeled Writes or approval-sensitive actions. The "Design tools for programs" section of the same page states:

Require application-level approval before high-impact actions, regardless of the caller.

In essence, OpenAI's page recommends using direct tool calls by default when actions involve writing or require approval. Furthermore, it advises that regardless of the calling source, applications should request approval before performing actions with significant impact. This article cites these two statements as recommendations from OpenAI's page.

4.4 Agents API — Enabled by Default, and Where the Tools Run Does Not Change

In the OpenAI Agents API, PTC (Programmatic Tool Calling) is enabled by default. OpenAI's PTC documentation states:

In the Agents API, Programmatic Tool Calling runs in the OpenAI-managed agent harness and is enabled by default.

The same section describes how the harness provides the agent with the exec tool, allowing it to utilize existing tools in the generated JavaScript environment. To disable PTC, include the following entry in agent.tools:

{
  "type": "programmatic_tool_calling",
  "enabled": false
}

Even if this entry is omitted, or if the enabled field is omitted, PTC remains enabled. Including only the type, such as {"type": "programmatic_tool_calling"}, also keeps PTC enabled.

The documentation further explains the location where tools are executed, stating:

Orchestrating a tool in JavaScript doesn't change where the tool runs.

The same paragraph clarifies that shell calls execute commands within a sandbox, and the JavaScript runtime itself does not initiate system processes. Executor MCPs still use the sandbox, while function tools call the user's application server. Section 5 of the previously published Managed Agent Runtimes details what the Agents API runtime provides and what the user provides. OpenAI's Changelog, in the Sep 10 entry of September 2026, indicates that the Agents API was publicly released as a beta.

4.5 ZDR Conditions

OpenAI's PTC page describes ZDR for Responses API requests as follows:

For Responses API requests, Programmatic Tool Calling supports Zero Data Retention (ZDR) workflows without requiring a persistent code-execution container. ZDR must be enabled for the organization or project; setting `store: false` enables stateless continuation but does not enable ZDR by itself.

The same paragraph states that the entire request, including the model, tools, and third-party services, determines whether a request is eligible for ZDR and how it is retained. In other words, the statement that OpenAI's PTC can be used in a ZDR setup carries three conditions. First, the statement covers Responses API requests. Second, ZDR must be enabled at the organizational or project level. Third, simply setting store: false is not sufficient to trigger ZDR.

The PTC page does not explicitly mention ZDR for the Agents API. However, Section 8.4 of the previously published Managed Agent Runtimes states that the OpenAI Agents API is not currently eligible for ZDR. Furthermore, the "Data controls in the OpenAI platform" page does not contain the term "Programmatic Tool Calling" (Section 8.2).

The date for OpenAI's PTC is the Jul 9 entry of July 2026 in OpenAI's Changelog. This entry states that the GPT-5.6 model family added Programmatic Tool Calling. Regarding which models support PTC, the PTC page advises users to verify the model's page before enabling PTC. This article does not build a list of the models OpenAI supports for PTC.

5. Code Mode on the Agent Harness Side — Cloudflare and Pi

This chapter presents two approaches for running the program that orchestrates tool calls, not on the model provider's side, but in the agent harness itself. Finally, it shows that two sources describe the status of Codex CLI's code mode differently.

5.1 Cloudflare's Code Mode — Dynamic Worker's V8 Isolate

The @cloudflare/codemode package of Cloudflare's Agents implements Cloudflare's Code Mode. Cloudflare's documentation page on Code Mode (Last updated June 24, 2026) describes its status as follows:

Code Mode is experimental and may introduce breaking changes.

The "How Code Mode works" page (Last updated October 12, 2026) expresses the same point in slightly different wording:

Code Mode is experimental and may have breaking changes.

A Cloudflare blog post from September 26, 2025, describes the Code Mode sandbox as follows:

The sandbox is totally isolated from the Internet.

The same blog post states that the sandbox is a V8 isolate, in the sentence quoted at the start of this article and in the following sentence:

The Cloudflare Workers platform has always been based on V8 isolates

The "How Code Mode works" page divides Code Mode into three components.

The executor runs code but stores no state. Connectors provide capabilities but do not manage replay. The runtime records execution and controls approvals, replay, rollback, and reuse.

Regarding these three components, the same page states:

Executor: This component runs a single block of code generated by the model, without maintaining any execution history. The DynamicWorkerExecutor creates an isolated Worker for each execution pass using the Dynamic Worker Loader. A resumed execution runs the code again in another pass, so durable state cannot live in the sandbox.
Connector: This component connects services on the harness side to the sandbox. A connector can wrap an MCP server, an OpenAPI document, an AI SDK toolset, or custom code. The generated code does not receive the connector credentials or client objects. Connector calls cross the sandbox boundary through Workers RPC. The runtime intercepts each call before the connector executes it.
Runtime: This component connects the executor and connector, storing execution records, connector call logs, pending approvals, and snippets in isolated SQLite storage. This state persists even after the request is complete or the Durable Object hibernates. This article refers to this runtime as the "durable runtime."

Regarding the language of the code the model writes, the "How Code Mode works" page states that the tool description given to the model tells it to write a JavaScript async arrow function. The sandbox has a standard JavaScript global environment but does not expose Node.js APIs, host credentials, process, require, or unrestricted network access.

Concerning networking, the "How Code Mode works" page further states:

External fetch() and connect() calls are blocked by default. DynamicWorkerExecutor configures globalOutbound: null unless you provide another value.

Users can provide a Fetcher to route outbound requests through a controlled service.

The logs of durable runtime executions accumulate over time. The "How Code Mode works" page explains that when a new execution begins, older, finished executions are pruned, and the default value for maxExecutions is 50. Executions that are currently running or paused will not be automatically pruned.

Regarding Dynamic Workers, the "Pricing" page in the Cloudflare Dynamic Workers documentation states:

Dynamic Workers are currently only available on the Workers Paid plan.

This article cites this sentence as a condition on which plan can use Dynamic Workers. It does not cover any amounts.

5.2 Pi's Codemode — QuickJS in WASM Inside the Harness

Pi is an agent harness. Earendil's announcement Pi 1.0, dated October 1, 2026, states that Codemode was added in Pi 1.0. An article by one of Pi's authors, dated October 6, 2026, describes where Codemode runs as follows:

Codemode runs in the harness, in its own sandbox. In case of Pi it's running in QuickJS within a WASM runtime with intentional limitations: no network, no file system, no timers, limited RAM.

The same article states that Codemode uses JavaScript within Pi. It also indicates that the only way for Codemode to interact outside its sandbox is by calling additional tools.

Regarding the conditions under which Codemode becomes active in Pi, the same article states:

Note that Codemode is by default only enabled in Pi when MCP is enabled, but you can turn it on with "defaultTools": ["+codemode"] in the settings.

Concerning its state, the article explains that Codemode can store state information in the session transcript. A single Codemode invocation writes data, and subsequent invocations in the same session can read that data. The article further clarifies that this process occurs on the host side of the harness, not in the sandbox.

The same article differentiates between the harness (referred to as "brain") and the environment where tools are executed (referred to as "hands"), stating that Codemode orchestrates operations on the harness side, not on the execution environment side. This distinction is presented as the explanation of one of the authors. This article does not incorporate this distinction as an axis in its tables. This article does not tie this distinction to the harness and environment distinction in the previously published Claude Code Harness and Environment Engineering.

5.3 Codex CLI's Code Mode — Two Sources Describe Its Status Differently

The OpenAI Codex CLI also has a code mode setting. Two sources describe the status of code mode differently.

The release notes for version 0.162.0 of Codex on GitHub (published on 2026-10-08T18:55:59Z) list opt-in ranked tool search in Code Mode under the "New Features" section.
The Codex "Configuration Reference" page describes the features.code_mode.enabled setting as follows:

Enable code mode feature configuration. This feature is under development and off by default.

This article presents both descriptions without favoring either (Section 8.1, item 4). No statement of where Codex CLI's code mode program runs was found in the sources reviewed for this article (Section 8.2). This article does not include Codex CLI in the tables of Section 6 or in Figure 2.

6. The Four Runtimes Side by Side

This chapter lays out the descriptions from Sections 3 through 5 using the columns of Section 2. The supporting statements are given in Sections 3 through 5.

Figure 2 lists where the programs for the four different methods run, what they do not have, and what they leave behind.

6.1 Where Each Runs and What It Does Not Have

The following table lists where each of the four approaches runs, in which languages, what they do not have, and what remains.

Runtime	Runs In	Language	Has No	State Kept
Anthropic PTC	Anthropic's code execution container	Python 3.11	Access to the internet	Files and the state of the Python interpreter, across requests that reuse the container.
OpenAI PTC	OpenAI's fresh V8 runtime for each program	JavaScript	Node.js, package installation, direct network access, general-purpose file system, sub-processes, console, persistent JavaScript state.	No persistent JavaScript state. Paused programs are resumed or replayed using `fingerprint` and `caller`.
Cloudflare Code Mode	Dynamic Worker's V8 isolate (created for each execution pass)	JavaScript	Outbound `fetch()` and `connect()` by default. Node.js APIs, host credentials, `process`, `require`.	The executor maintains no state. The durable runtime keeps execution records, connector call logs, pending approvals, and snippets in SQLite.
Pi Codemode	QuickJS in WASM inside Pi's harness	JavaScript	Network, file system, timers. RAM is limited.	Values placed in the session transcript (on the harness host side).

The following table gives the sources for the table above.

Runtime	Stated In
Anthropic PTC	Anthropic's Programmatic tool calling page (the "How programmatic tool calling works" and "Container lifecycle" sections) and the Code execution tool page (the "Runtime environment," "Networking and security," and "Container reuse" sections).
OpenAI PTC	OpenAI's Programmatic Tool Calling page, specifically the sections "Understand the runtime environment" and "Understand program response items."
Cloudflare Code Mode	Cloudflare's How Code Mode works page (the Executor and Durable runtime sections), and the blog post from September 26, 2025.
Pi Codemode	An article by one of the authors of Pi, published on October 6, 2026, titled "What is Codemode."

6.2 Boundaries and What Is Returned When They Are Crossed — Anthropic PTC

The following table lays out the rules for Anthropic's PTC, using the columns of Section 2.1.

Rule	Enforced Where	Default	When It Is Crossed	Your Setting	Stated In
Network access from code	`The code execution container (Anthropic)`	Internet access is disabled	`The source does not say.` It is stated that packages cannot be obtained at runtime.	`None stated`	Code execution tool page
Claude directly calls a tool whose `allowed_callers` lists only code execution	`Not an API-level block (guidance to Claude)`	Defaults to `["direct"]`	The user's client can receive a direct `tool_use`.	`allowed_callers`	The `allowed_callers` field on the Programmatic tool calling page
Specifying tools in `tool_choice` that do not have `"direct"` in `allowed_callers`	`The Claude API (request validation)`	`Not applicable`	`400 invalid_request_error`	`allowed_callers`, `tool_choice`	Common errors on the Programmatic tool calling page
A call waiting for its result	`The code execution container (Anthropic)`	About 4 minutes	`TimeoutError inside the code`	`None stated`	Container lifecycle on the Programmatic tool calling page
Wall-clock time of a REPL cell	`The code execution container (Anthropic)`	90 seconds	`Non-zero return_code with a detection_timeout message`	`None stated`	Tool versions and Resource limits on the Code execution tool page
Idle container	`The code execution container (Anthropic)`	About 5 minutes	`the sources disagree` (one page says the container is reclaimed; the other says it is checkpointed and restored if a request with its ID arrives within 30 days)	Pass the container ID	Programmatic tool calling page, Code execution tool page
Container reuse expiration	`The code execution container (Anthropic)`	30 days from creation	Containers cannot be reused after the expiration date.	Omit the `container` parameter to get a new container.	Container reuse on the Code execution tool page
Failing to provide a container ID when waiting for results from a call	`The Claude API (request validation)`	`Not applicable`	`Request rejected (status not stated)`	Container ID	Step 3 on the Programmatic tool calling page
Including blocks other than `tool_result` in the message carrying the result	`The source does not say.`	`Not applicable`	`The source does not say.` The documentation states that this is not allowed.	`None stated`	Message formatting restrictions on the Programmatic tool calling page
Configuring tools to be called from code with a recursive `$ref` schema	`The Claude API (request validation)`	`Not applicable`	`400 invalid_request_error` (`Circular $ref detected`)	`allowed_callers`	Input schema limitations on the Programmatic tool calling page
Used with Microsoft Foundry deployments hosted on Azure	`The source does not say.`	`Not applicable`	`400 Bad Request (Foundry hosted on Azure)`	Deployment type (Hosted on Anthropic)	Claude in Microsoft Foundry page

6.3 Boundaries and What Is Returned When They Are Crossed — OpenAI PTC, Cloudflare Code Mode, and Pi Codemode

The following table lists the rules for OpenAI, Cloudflare, and Pi, using the columns of Section 2.1.

Runtime	Rule	Enforced Where	Default	When It Is Crossed	Your Setting	Stated In
OpenAI PTC	Network access from the program	`A fresh V8 runtime (OpenAI)`	No direct network access	`The source does not say.`	`None stated`	Understand the runtime environment (Programmatic Tool Calling)
OpenAI PTC	Tools with `allowed_callers` set to `["programmatic"]`	`The source does not say.`	`["direct"]` (if omitted)	`The source does not say.`	`allowed_callers`	Configure Programmatic Tool Calling (Programmatic Tool Calling)
OpenAI PTC	A program calls an MCP tool that has `require_approval`	`The source does not say.`	`The source does not say.`	`Program pauses until you approve`	`require_approval`	Supported tools (Programmatic Tool Calling)
OpenAI PTC	Using PTC with the Agents API	`The OpenAI-managed agent harness (Agents API)`	Enabled	`Not applicable`	Turn it off with `{"type": "programmatic_tool_calling", "enabled": false}`	Agents API (Programmatic Tool Calling)
Cloudflare Code Mode	Outbound `fetch()` and `connect()`	`The harness (Cloudflare Dynamic Worker isolate)`	`globalOutbound: null`	`Blocked (fetch() and connect())`	Pass a `Fetcher` to route outbound requests	Executor (How Code Mode works)
Cloudflare Code Mode	Generated code calls methods on connectors that require approval	`The durable runtime (Cloudflare)`	Depends on whether the connector method requires approval	`Program pauses until you approve` (the runtime records the operation as pending and aborts the pass)	Approve, reject, or rollback	Approvals through abort and replay (How Code Mode works)
Cloudflare Code Mode	Size of values to be stored for replay	`The durable runtime (Cloudflare)`	1,000,000 characters after serialization	Execution fails	`None stated`	Durable value and result limits (How Code Mode works)
Pi Codemode	Network, file, and timer access from the sandbox	`The harness (Pi, QuickJS in WASM)`	Not available (one of Pi's authors calls these intentional limitations)	`The source does not say.`	`None stated`	Article by one of the Pi authors
Pi Codemode	Enabling Codemode	`The harness (Pi, QuickJS in WASM)`	Only enabled when MCP is enabled	`Not applicable`	`"defaultTools": ["+codemode"]`	Article by one of the Pi authors

6.4 Data Retention and ZDR

The following table outlines how data is retained and how ZDR is handled for the four approaches.

Runtime	Retention and ZDR	Stated In
Anthropic PTC	Not subject to ZDR (both the ZDR and HIPAA readiness fields are marked `No`). Built on top of a code execution container, and data is retained for up to 30 days. Even in ZDR organizations, the API does not block the request. Using it is a choice to step outside the ZDR arrangement for that data.	Feature eligibility table on the API and data retention page, Data retention section of the Programmatic tool calling page.
Anthropic Code Execution	Not subject to ZDR. Data in the container, including execution artifacts, uploaded files, and outputs, is retained for up to 30 days.	API and data retention page, Data retention section of the Code execution tool page.
OpenAI PTC (Responses API)	Supports ZDR workflows without requiring persistent code execution containers. However, ZDR must be enabled at the organization or project level; simply setting `store: false` does not trigger ZDR. Whether it is subject to ZDR and the retention period are determined by the entirety of the request.	The Understand the runtime environment section of the Programmatic Tool Calling page.
OpenAI PTC (Agents API)	Not documented on the OpenAI PTC page. Section 8.4 of the previously published Managed Agent Runtimes states that the Agents API is not currently eligible for ZDR.	Programmatic Tool Calling page, and the previously published Managed Agent Runtimes.
Cloudflare Code Mode	No statement on ZDR was found. The durable runtime stores execution records in SQLite in the Agent's Durable Object facet, retaining finished executions up to `maxExecutions` (default: 50).	Durable runtime and Retention and stale executions sections on the How Code Mode works page.
Pi Codemode	No description of data retention was found. Values placed by Codemode are included in the session transcript.	Article by one of the authors of Pi.

Anthropic's "API and data retention" page specifies the meaning of the No value in the table, differentiating between ZDR and HIPAA readiness.

Under HIPAA readiness, the API blocks requests that include a "No" feature and returns a `400` error, unless the feature's Details column says otherwise. Under ZDR, the API does not block these features; using one is a choice to step outside your ZDR arrangement for that specific data, and the feature's own documented retention policy applies.

Specifically, requests involving Anthropic's PTC are not blocked in ZDR organizations, but are blocked with an HTTP 400 error in HIPAA readiness organizations. This article does not state that Anthropic's PTC is a feature that cannot be used in ZDR organizations.

No statement on data retention for Cloudflare and Pi was found in the sources reviewed (Section 8.2). Cloudflare's Code Mode program runs on Dynamic Workers, which operate on Cloudflare's infrastructure. This article does not state that Cloudflare and Pi utilize a data retention model where the provider does not retain data.

6.5 Callable Tools

The following table lists the tools that can be called from each of the four approaches, as well as those that cannot.

Runtime	Tools It Can Call	Cannot Be Called From the Program	Stated In
Anthropic PTC	Tools defined by the user, provided they include a code execution version in the `allowed_callers` list.	MCP connector tools. The `computer_toolset_20260801` and `browser_toolset_20260801` toolsets (`"direct"` only). Tools with a recursive `$ref` schema.	Programmatic tool calling page - Tool restrictions and Input schema limitations
OpenAI PTC	`function`, `custom`, `mcp`, `apply_patch`, local and hosted `shell`, and `code_interpreter`, provided they include `programmatic` in the `allowed_callers` list.	Tool search does not run inside the program. Tools with `defer_loading: true` cannot be used until they are loaded.	Programmatic Tool Calling page - Supported tools and Combine with tool search
Cloudflare Code Mode	Connectors. Connectors can wrap MCP servers, OpenAPI documents, AI SDK toolsets, and custom code.	Generated code does not receive connector credentials or client objects.	How Code Mode works page - Connectors
Pi Codemode	Harness tools. Pi 1.0 added MCP support through Codemode.	`The source does not say.`	Article by one of Pi's authors, Pi 1.0 announcement

The handling of MCP varies depending on the runtime. Tools that cannot be called from Anthropic PTC are MCP connector tools. Tools that can be called from OpenAI PTC are tools of the mcp type in the Responses API. The two MCPs may not refer to the same thing (Section 8.1, item 3).

7. Where Approval and Boundaries Go — What Each Provider Writes

This chapter presents statements from each company regarding where to place approval and boundaries when orchestrating tool calls in code. This article does not offer design recommendations.

OpenAI: OpenAI's PTC documentation, as described in Section 4.3, recommends using direct tool calls by default for operations that require writing or approval. It also advises application-level approval, regardless of the caller, before high-impact actions. For MCP tools, the require_approval setting can halt the program until approval is granted.

Anthropic: Anthropic's documentation on Programmatic tool calling, as detailed in Section 3.4, advises against relying on allowed_callers as a security boundary. According to the same documentation, as outlined in Section 3.2, tool calls from code are returned to the user as a tool_use block, and it is the user's client that executes the tool. The same documentation, as described in Section 3.5, cautions against the risk of code injection when tools return data from external sources. No recommendation to use direct tool calls for operations that require approval was found on Anthropic's PTC page or the "Tool use" pages (Section 8.2). The "When to use programmatic calling" section of the Programmatic tool calling page lists Tools that require immediate user feedback between calls as a weak fit, without mentioning approval. The "Permission policies" page for Claude Managed Agents, which is a separate product outside the scope of this article's discussion of Anthropic's PTC, describes a mechanism for approving tool calls.

Cloudflare: The "How Code Mode works" page states that a connector method can require user approval. When generated code reaches such a method, the durable runtime records the operation as pending approval and aborts that pass. Upon approval, a new pass begins with the same source code and execution ID. Previously applied calls return their recorded results, and the approved operation is then executed. The same page further states:

Rejecting an action ends the execution, but it does not undo earlier actions. Rollback is a separate operation.

Rollback walks the applied connector calls in reverse order and invokes the revert implementation of each method that has one. The page clarifies that rollback is compensation, not database transaction isolation.

Pi: No statement on approval for Codemode was found in the article by one of Pi's authors or in the Pi 1.0 announcement (Section 8.2).

Across the four approaches, the descriptions of where to place approval are as follows: OpenAI writes about approval on the user's application side and about require_approval for MCP tools. Anthropic writes that allowed_callers should not be relied on as a security boundary and clarifies that the user's client is responsible for executing the tool. Cloudflare describes approval, rejection, and rollback in the durable runtime. No statement on approval was found for Pi.

8. Where the Sources Disagree and Where No Statement Was Found

This chapter compiles the disagreements between sources and the statements not found, as mentioned in Sections 1 through 7 of this article. This article does not claim that either document contains errors. All verification dates are October 14, 2026.

8.1 Where the Sources Disagree

The following table lists where the sources disagree, as well as places that look like a disagreement but describe different purposes.

#	Topic	One Source Says	Another Source Says	Section
1	Anthropic's idle container (about 5 minutes)	The Programmatic tool calling page says an idle container is reclaimed after about 5 minutes.	The Code execution tool page says a container is checkpointed after about 5 minutes and restored if a request with its ID is sent within 30 days.	Section 3.3
2	Strength of `allowed_callers`	Anthropic's documentation states that it is not a hard API-level block on direct invocation and should not be relied on as a security boundary.	OpenAI's documentation states that with `["programmatic"]`, only code in a `program` item can call the tool. It does not say where or how other calls are blocked.	Sections 3.4 and 4.2
3	MCP Tools	Anthropic's documentation states that tools provided by an MCP connector cannot be called from PTC.	OpenAI's documentation includes tools of type `mcp` as potential targets for PTC.	Section 6.5
4	Status of Codex CLI's Code Mode	The release notes for version 0.162.0 list a feature added to Code Mode.	The Configuration Reference page states that code mode is under development and off by default.	Section 5.3
5	Two Items in the Models API (not discrepancies)	`capabilities.code_execution` indicates whether code in the code execution tool can call the request's other tools.	`capabilities.server_tools.code_execution` indicates whether the model supports the code execution tool itself.	Section 3.6
6	Cloudflare's Use of "Experimental"	The Code Mode page states `may introduce breaking changes`.	The How Code Mode works page states `may have breaking changes`.	Section 5.1

Regarding item 2, OpenAI's documentation also asks for application-level approval before high-impact actions, regardless of the caller (Section 4.3). This article does not attempt to determine which of the two allowed_callers is stronger.

Item 5 is not a disagreement between sources. The two items have similar names, but the "List Models" page for the Models API and the "Code execution tool" page describe the difference in purpose.

8.2 Where No Statement Was Found

The following table lists the statements that were searched for and not found on October 14, 2026, along with the locations and terms used in the search. Not finding a statement does not mean that the behavior does not exist.

What Was Looked For	Where and How It Was Looked For	Result
A statement in which Anthropic recommends direct tool calls for operations that require approval.	Searched the Programmatic tool calling page, the Code execution tool page, and various pages related to "Tool use" (Overview, How tool use works, Handle tool calls, Define tools, Tool combinations, Server tools, Tool reference, Parallel tool use, Tool search tool), as well as Anthropic's engineering articles, specifically "Advanced tool use," using the terms `approv`, `human-in`, `confirm`, `sensitive`, `destructive`, `irreversible`, `side effect`, `high-impact`, and `authoriz`.	No statement was found. The "When to use programmatic calling" section of the Programmatic tool calling page lists `Tools that require immediate user feedback between calls` as a weak fit, without mentioning approval. The Permission policies page of Claude Managed Agents describes an approval mechanism, but it is for a different product (Section 7).
Where OpenAI's `["programmatic"]` rule is enforced and what is returned when it is crossed.	Searched the OpenAI Programmatic Tool Calling page using the terms `allowed_callers`, `programmatic`, and `error`.	No statement was found (Section 4.2).
OpenAI's time and memory limits for Programmatic Tool Calling (PTC).	Searched the OpenAI Programmatic Tool Calling page using the terms `timeout`, `time limit`, `wall-clock`, `seconds`, `minutes`, and `memory`.	No statement was found (Section 4.1).
The description of PTC on OpenAI's Data controls page.	Searched the Data controls in the OpenAI platform page using the terms `programmatic` and `program`.	No statement was found. The ZDR (Zero Data Retention) conditions are described on the Programmatic Tool Calling page (Section 4.5).
A list of models supported by OpenAI's PTC.	Read the OpenAI Programmatic Tool Calling page and the Changelog.	The PTC page tells readers to check the model page before enabling PTC. The Changelog mentions that the GPT-5.6 series added PTC support on July 9, 2026. This article does not create a list (Section 4.5).
Where Codex CLI's "code mode" programs are executed.	Searched the Codex Configuration Reference page using the terms `v8`, `quickjs`, `isolate`, and `sandbox`, and read the release notes for version 0.162.0.	No statement was found (Section 5.3).
Cloudflare's documentation regarding QuickJS.	Searched Cloudflare's "Code Mode" pages and blog using the term `QuickJS`.	No statement was found. Cloudflare's blog says that the sandbox runs on V8 isolates (Section 5.1).
Cloudflare's "Code Mode" and its ZDR (Zero Data Retention) and data retention policies.	Searched Cloudflare's "Code Mode" pages and blog using the terms `zero data retention`, `ZDR`, `retention`, and `retain`.	No statement on ZDR was found. The How Code Mode works page does have a section on pruning execution records ("Retention and stale executions") (Section 6.4).
Pi's "Codemode" approval process and data retention policies.	Searched the article by one of Pi's authors and the announcement for Pi 1.0 using the terms `approv`, `confirm`, `permission`, `retention`, `retain`, and `ZDR`.	No statement was found (Sections 6.4 and 7).
Deprecation of PTC and Code Mode, and their integration into successors.	Read Anthropic's Claude Platform release notes page and the Models Deprecation page, OpenAI's Deprecations page, and two of Cloudflare's "Code Mode" pages.	No statement was found.

8.3 What Changes When the Sources Are Updated

The information in this article may change as the source materials are updated. Review the following pages again when you read this article.

The metadata of Anthropic's "Programmatic tool calling" page, specifically the supported models and platforms (Section 3.6).
The versions of Anthropic's code execution tools (Section 3.1; new versions may be released after code_execution_20260521). The "Code execution tool" page says that older tool versions are not guaranteed to stay compatible with newer models.
The numbers for Anthropic's container lifetime (Section 3.3; the sentence about the 5 minutes says currently).
The types of tools supported by OpenAI's PTC, and the status of the Agents API (Sections 4.2 and 4.4).
Cloudflare's Code Mode pages (Section 5.1; Code Mode is experimental, and the pages have different Last updated dates).
The versions of Pi and Codex (Sections 5.2 and 5.3).

9. Frequently Asked Questions about Where the Orchestration Program Runs

This chapter answers frequently asked questions related to the content presented in this article. The basis for each answer is indicated in parentheses, referencing specific sections.

Q1. In Anthropic's PTC, can the code Claude writes reach the internet?

Not according to the sources. The "Code execution tool" page states that the container does not have internet access, and that packages cannot be downloaded at runtime. PTC uses the same containers as the code execution tool. Tool calls that the code makes are returned to the user as tool_use blocks, and the user's client then runs the tools (Sections 3.2 and 3.3).

Q2. If `allowed_callers` lists only a code execution version, will Claude stop calling the tool directly?

The API does not guarantee this. Anthropic's "Programmatic tool calling" page states that allowed_callers is not a hard API-level block on direct invocation, and advises against relying on it as a security boundary. While Claude is strongly guided to adhere to the allowed_callers list, users should ensure that their clients are capable of handling direct tool_use calls for any tool they define (Section 3.4).

Q3. Can Anthropic's PTC be used in a ZDR organization?

The API does not block the request. However, Anthropic's PTC is not covered by ZDR, and data is retained for a maximum of 30 days. The "API and data retention" page states that using features not covered by ZDR is a choice to step outside the ZDR arrangement for that data. In HIPAA readiness organizations, the API rejects requests that contain non-eligible features with an HTTP 400 error (Section 6.4).

Q4. Does OpenAI's PTC support ZDR?

It supports ZDR conditionally. OpenAI's Programmatic Tool Calling documentation states that it can handle ZDR workflows regarding Responses API requests without requiring persistent code execution containers. However, ZDR must be enabled at the organization or project level; simply setting store: false is not sufficient to activate ZDR. Whether a request is eligible for ZDR is determined by the entirety of the request, including the model, tools, and any third-party services involved. ZDR for the Agents API is not described on the PTC page (Section 4.5).

Q5. Does Cloudflare's Code Mode run on QuickJS?

Not according to the sources. Cloudflare's blog states that the Code Mode sandbox uses a V8 isolate, and the "How Code Mode works" page indicates that the DynamicWorkerExecutor creates an isolated Worker for each execution pass. Running QuickJS within a WASM environment is a feature of Pi's Codemode (Sections 5.1 and 5.2). The Code Mode API reference also defines an Executor interface for custom executors and a browser entry point whose executor defaults to IframeSandboxExecutor. This article covers DynamicWorkerExecutor.

Q6. Can PTC call MCP tools?

The capability varies depending on the method. You cannot call MCP connector tools from Anthropic's PTC. However, you can call tools of type mcp via OpenAI's PTC, using the Responses API. Note that the require_approval setting may pause the program pending approval. Cloudflare's Code Mode connectors can wrap MCP servers. Pi 1.0 added MCP support through Codemode (Section 6.5).

Q7. Where do the tools that the orchestration program calls run?

For all four approaches, the sources describe the program and the running of the tools separately. In Anthropic's PTC, the API returns tool_use, and the user's client executes the tool. The Agents API section of the OpenAI PTC documentation states that even when tools are orchestrated using JavaScript, the location where the tools are executed remains unchanged. In Cloudflare's Code Mode, connector calls cross the sandbox boundary via Workers' RPC, with the durable runtime acting as an intermediary. An article by one of the authors of Pi states that Codemode orchestrates operations on the harness side, rather than in the environment where the tools are executed (Sections 3.2, 4.4, 5.1, and 5.2).

10. Summary

The four approaches run the program in different places: Anthropic's PTC utilizes Python in the code execution container. OpenAI's PTC uses JavaScript in a fresh V8 runtime for each program. Cloudflare's Code Mode, with DynamicWorkerExecutor, uses JavaScript within a Dynamic Worker's V8 isolate. Pi's Codemode uses JavaScript on QuickJS in WASM inside the harness.
The state that remains differs: Anthropic's PTC retains files and the state of the Python interpreter, across requests that reuse the container. OpenAI's PTC does not maintain JavaScript state across executions. Cloudflare's Code Mode features an executor that does not hold state, while the durable runtime stores execution records and pending approvals in SQLite. Pi's Codemode allows values to be stored in the session transcript.
What each one does not have differs: Anthropic's containers do not have access to the internet. OpenAI's runtime does not include Node.js, direct network connections, a general file system, or subprocesses. Cloudflare blocks outbound fetch() and connect() by default. Pi does not have network capabilities, a file system, or timers.
Data retention and ZDR differ: Anthropic's PTC is not eligible for ZDR, and data is retained for a maximum of 30 days. However, even in ZDR organizations, the API does not block it. OpenAI's PTC, specifically the Responses API, supports ZDR workflows on the condition that ZDR is enabled for the organization or project. No statement on ZDR for Cloudflare or Pi was found.
allowed_callers is described differently: Anthropic writes that allowed_callers should not be relied on as a security boundary. OpenAI, on the other hand, writes that with ["programmatic"], only code in a program item can call the tool. This article does not attempt to determine which is stronger.
The descriptions of where approval goes differ: OpenAI recommends direct calls by default for writes, and application-level approval before high-impact actions. Cloudflare describes approval, rejection, and rollback in the durable runtime. No recommendation on approval was found on Anthropic's PTC page, its Tool use pages, or in the Pi sources.
The sources disagree: The sources describe Anthropic's idle containers, the strength of allowed_callers, which MCP tools are covered, and the status of Codex CLI's code mode differently. No statement was found on where Codex CLI's code mode runs, on the time limits of OpenAI's PTC, or on data retention for Cloudflare and Pi, among others.

11. References

References:
Tech Blog with curated related content

Written by Hidekazu Konishi