Code Mode

With code mode, the agent gets a run_code tool. Instead of calling tools one at a time, the model writes a short Python program that calls them as functions, loops, filters, and computes, and gets back the program’s result and what it printed. One model turn can do what would otherwise take many.

pip install "omnicoreagent[codemode]"

agent = OmniCoreAgent(
    name="analyst",
    system_instruction="Answer questions about orders.",
    model_config={"provider": "openai", "model": "gpt-5.4-mini"},
    local_tools=tools,
    agent_config={
        "code_mode": {
            "enabled": True,
            "tools": ["get_order", "list_orders"],  # omit to allow every eligible tool
            "max_duration_seconds": 30,
            "max_tool_calls": 50,
        },
    },
)

A program the model might write:

late = []
for order in list_orders(status="shipped"):
    detail = get_order(order_id=order["id"])
    if detail["days_in_transit"] > 7:
        late.append(detail["id"])
print(len(late), "late orders")
late

How it stays safe

Programs run in Monty, Pydantic’s interpreter for a Python subset, in a separate worker process. A program has no filesystem, network, or environment access; an attempt raises an error inside the program.
Every tool call a program makes goes through the same path as a direct tool call: governance authorizes it (a denied call raises an error the program can catch), the run’s record notes it before it starts, and it is recorded in the trace.
A program is stopped at its time limit, memory limit (max_memory_bytes), or tool-call limit, and its output is capped (max_output_bytes).
Under governance, running a program is its own capability (code.run); the development profiles allow it, and strict-production needs a rule.

In the trace

Each tool call a program made is listed under its run_code call in the trajectory (code_calls), with its own policy decision and outcome, and each has an ID of the form <run_code call ID>.<n>.

Approval inside a program

If a tool call inside a program needs approval, the program itself pauses: it is stored on the run’s record, signed, and the run waits like any other (Durable Runs). After the decision, the program continues from that call — nothing it already did runs again:

result = await agent.run("refund the late orders", session_id="s1")
# result["status"] == "awaiting_approval"; the approval names the call inside the program
await agent.resolve_approval(run_id, approval_id, decision="approve", approver="alice")
result = await agent.resume(run_id)

A denied call is raised inside the program with the approver’s note, so the program can catch it and carry on. Set code_mode["snapshot_key"] (or OMNICOREAGENT_CODE_SNAPSHOT_KEY) so a paused program can continue in another process, such as after a restart; a stored program that does not verify against the key is refused and never runs. Without a key, a random one is used per process, so a paused program only continues where it paused. A program too large to store (max_snapshot_bytes) is told so instead of pausing.

Get Started

Core Concepts

How-To Guides

Changelog

Code Mode

Code Mode

How it stays safe

In the trace

Approval inside a program

​Code Mode

​How it stays safe

​In the trace

​Approval inside a program

Code Mode

How it stays safe

In the trace

Approval inside a program