# Executor

Open-source tool gateway for agents from Rhys Sullivan. Normalizes MCP, OpenAPI, GraphQL, and custom sources into one typed SDK that agents call in a sandbox — built on Cloudflare's Code Mode pattern.

**Type:** tool
**Added:** 2026-05-09
**Link:** https://executor.sh/
**Topics:** AI Coding, Dev Tools, Open Source
**Tags:** agents, sandbox

---

Set up your sources (MCP servers, OpenAPI specs, GraphQL endpoints, custom) once, and any agent — Claude, Cursor, Codex — can call them. Per-user or global credentials, team sharing, destructive-action gating, JS sandbox so secrets never reach the model. Rhys is now building it full-time as a startup.

Repo: [UsefulSoftwareCo/executor](https://github.com/UsefulSoftwareCo/executor) · Beta: [executor.sh](https://executor.sh)

["Executor: One MCP server for every tool your agent needs" (video)](https://youtu.be/uQtrnZTkBBg)

## How it works: Code Mode under the hood

Built on [Code Mode](https://blog.cloudflare.com/code-mode/), the pattern Cloudflare introduced for agent tool use. The premise: LLMs are bad at direct tool calls because their training corpus has almost no synthetic tool-call syntax — but billions of lines of TypeScript. So instead of exposing tools as callable functions the model picks between, Executor exposes them as a typed TS SDK and asks the model to write code.

The flow:

- Each connected source is normalized to `{ name, inputSchema, outputSchema }`, regardless of origin (MCP / OpenAPI / GraphQL / custom).
- Executor generates a typed SDK with JSDoc from those schemas.
- The agent writes a JS program against that SDK and ships it to Executor.
- Executor runs the program in a JS sandbox. Multi-step logic — fetch, filter, transform, call again — runs in a single execution. No round-trip through the LLM between each tool call.
- Secrets never enter the sandbox. Calls go through a proxy that injects credentials server-side, so the agent code can't read or leak them.

Net effect: thousands of tools become callable through one MCP entry without blowing up context. The model reasons in code instead of slot-filling JSON arguments.

## Why it's interesting

- **One setup, every agent.** Same sources across Claude Code, Cursor, Codex. No per-agent MCP config dance.
- **Destructive-action semantics preserved.** GET vs DELETE for OpenAPI, `destructiveHint` for MCP, mutations for GraphQL — Executor uses these to decide what auto-runs vs requires approval. Autonomy without losing the human in the loop.
- **Teams.** Sources configured once for the org; users get access without re-doing auth per agent.
- **Open source, self-hostable.** MIT, SDK published to npm, runs locally as a desktop app. Cloud version with team sync coming.

## My contribution

Did a small UI fix — [PR #774](https://github.com/RhysSullivan/executor/pull/774). OAuth callback failures were rendering a hardcoded `"Authentication failed"` because the handler swallowed the real cause with `Effect.catchCause`, making integration failures undiagnosable from the popup. Dropped the catch, added a two-tier popup (short headline + collapsible technical details), kept XSS escaping. Merged.

Hoping to contribute more — the problem space is the right one and the codebase is clean Effect-TS.

---

## Links

- Directory entry: https://andrey-markin.com/directory/executor
- All directory entries: https://andrey-markin.com/directory
- Contact: https://andrey-markin.com/#contact