elusznik/mcp-server-code-execution-mode

Prerequisites: Python 3.11+, Podman or Docker, uv (curl -LsSf https://astral.sh/uv/install.sh | sh), and a container image (podman pull python:3.13-slim or docker pull python:3.13-slim)
uv sync (project dependencies)
uvx --from git+https://github.com/elusznik/mcp-server-code-execution-mode mcp-server-code-execution-mode run (launch bridge)
Register in your agent's MCP settings (e.g. claude_desktop_config.json) with command 'uvx', args ['--from','git+https://github.com/elusznik/mcp-server-code-execution-mode','mcp-server-code-execution-mode','run'], env MCP_BRIDGE_RUNTIME=podman

Usage

• •The LLM calls discovered_servers() to enumerate MCP servers, then query_tool_docs(server) / search_tool_docs('keyword') to fetch tool documentation on demand (keeping the system prompt at ~200 tokens)
• •The LLM writes Python that invokes generated mcp_<alias> proxies or mcp.runtime helpers, e.g. await mcp_filesystem.read_file(path='/tmp/test.txt')
• •Load servers explicitly via the run_python servers array (e.g. servers: ["serena", "filesystem"]) so proxies become available; unloaded servers return 'Server <name> is not available'
• •Persistent memory: save_memory / load_memory / update_memory / list_memories / memory_exists (stored in /projects/memory/ inside the container, mapped to ~/MCPs/user_tools/memory/)

Key features

• ✓Single run_python tool; constant ~200-token overhead regardless of how many MCP servers/tools are configured (vs ~30K tokens traditionally)
• ✓Proxies any stdio MCP server into rootless containers: --cap-drop=ALL, read-only filesystem, --network none, no-new-privileges, runs as UID 65534, memory/PID/CPU/time limits
• ✓Two-stage discovery (discovered_servers + query_tool_docs) and fuzzy search_tool_docs across servers
• ✓Persistent sessions — variables, imports, and functions defined in one call survive into subsequent calls; persistent MCP clients stay warm
• ✓Auto-discovers MCP servers from 12+ config paths (~/MCPs/, ~/.config/mcp/servers/, .vscode/mcp.json, ~/.claude.json, ~/.cursor/mcp.json, ~/.opencode.json, Windsurf, Claude Code/Desktop, VS Code)
• ✓Compact plain-text output by default with optional TOON blocks (MCP_BRIDGE_OUTPUT_MODE=toon) and JSON fallback
• ✓JSON-based persistent memory system with atomic updates and metadata

Best for

Teams juggling many MCP servers who want to avoid context/token bloat while keeping strict container isolation for LLM-generated Python code (data science, security analysis, multi-system orchestration).

Caveats

• ⚠Requires a container runtime (Podman or Docker); Docker Desktop needs the state directory marked as shared in Settings → Resources → File Sharing
• ⚠Sandbox has no network access (--network none) and is read-only except /tmp and /workspace
• ⚠Python 3.11+ required; on Python 3.14+ upgrade to pydantic >= 2.12.0 and remove any PyPI 'typing' package to avoid _eval_type() errors
• ⚠run_python only loads the MCP servers you request via the servers array; the cwd property is part of host/server config, not the servers array
• ⚠License: GPLv3; README notes automated testing, observability, and policy controls are still in progress; Docker MCP Gateway integration requires prior docker login and secrets
• ⚠State directory volume sharing with Podman may require 'podman machine set --rootful' on older builds