Executor

Set up your sources (MCP servers, OpenAPI specs, GraphQL endpoints, custom) once, and any agent — Claude, Cursor, Codex — can call them. Per-user or global credentials, team sharing, destructive-action gating, JS sandbox so secrets never reach the model. Rhys is now building it full-time as a startup.

Repo: RhysSullivan/executor · Beta: executor.sh

How it works: Code Mode under the hood

Built on Code Mode, the pattern Cloudflare introduced for agent tool use. The premise: LLMs are bad at direct tool calls because their training corpus has almost no synthetic tool-call syntax — but billions of lines of TypeScript. So instead of exposing tools as callable functions the model picks between, Executor exposes them as a typed TS SDK and asks the model to write code.

The flow:

• Each connected source is normalized to { name, inputSchema, outputSchema }, regardless of origin (MCP / OpenAPI / GraphQL / custom).
• Executor generates a typed SDK with JSDoc from those schemas.
• The agent writes a JS program against that SDK and ships it to Executor.
• Executor runs the program in a JS sandbox. Multi-step logic — fetch, filter, transform, call again — runs in a single execution. No round-trip through the LLM between each tool call.
• Secrets never enter the sandbox. Calls go through a proxy that injects credentials server-side, so the agent code can't read or leak them.

Net effect: thousands of tools become callable through one MCP entry without blowing up context. The model reasons in code instead of slot-filling JSON arguments.

Why it's interesting

• One setup, every agent. Same sources across Claude Code, Cursor, Codex. No per-agent MCP config dance.
• Destructive-action semantics preserved. GET vs DELETE for OpenAPI, destructiveHint for MCP, mutations for GraphQL — Executor uses these to decide what auto-runs vs requires approval. Autonomy without losing the human in the loop.
• Teams. Sources configured once for the org; users get access without re-doing auth per agent.
• Open source, self-hostable. MIT, SDK published to npm, runs locally as a desktop app. Cloud version with team sync coming.

My contribution

Did a small UI fix — PR #774. OAuth callback failures were rendering a hardcoded "Authentication failed" because the handler swallowed the real cause with Effect.catchCause, making integration failures undiagnosable from the popup. Dropped the catch, added a two-tier popup (short headline + collapsible technical details), kept XSS escaping. Merged.

Hoping to contribute more — the problem space is the right one and the codebase is clean Effect-TS.