MCP Code Mode

Set up MCP servers in CODE mode for context-efficient AI agent usage with 3 meta-tools.

CODE mode replaces individual tools with 3 meta-tools that keep the initial context small. Instead of exposing dozens of separate tools, CODE mode gives AI agents a search → read → execute workflow that loads API details on demand.

This is the recommended starting point for broad agent workspaces. Agents do not preload hundreds of schemas; they discover the right integration, inspect typed declarations only when needed, and execute multi-step workflows in one call.

Why Code Mode?

Traditional MCP servers expose every integration action as a separate tool. With 10 integrations and 50 actions, that's 50 tools competing for the AI agent's context window — most of which won't be used in any given request.

Code Mode flips this: instead of listing tools, it gives the agent a programming environment. The agent discovers what's available on demand, reads typed APIs, then writes code to accomplish its goal — often calling multiple integrations in a single execution.

The result:

A smaller initial tool surface for broad agent workspaces
Multi-step workflows in a single call (read from Sheets → process → post to Slack)
Type-safe — TypeScript declarations guide the agent to correct usage
Observable — every integration call is traced with duration and status

The Three Meta-Tools

Tool	Purpose
`weavz_search`	Discover available integrations and actions by keyword. Results include compact parameter signatures for quick one-off calls
`weavz_read_api`	Get detailed TypeScript declarations for an integration or alias, with hidden/defaulted inputs omitted
`weavz_execute`	Execute JavaScript code in a managed execution environment using `weavz.*`

The AI agent follows a natural workflow:

Search for the right integration and action
Read the typed API to understand input parameters and return types
Execute code that calls one or more actions — including multi-step compositions

Create a CODE Mode Server

Navigate to MCP Servers

Open the dashboard and go to MCP Servers in the sidebar.

Create a new server

Click Create MCP Server. Enter a name and optional description.

Select CODE mode

Choose CODE as the server mode.

Set approval wait behavior

Optionally set how long approval continuation calls should wait while a Human Gate is still pending. Leave it at 0 to return approval_pending immediately.

Save and copy the endpoint

Click Create. Copy the MCP endpoint. New servers use MCP OAuth by default, so OAuth-capable clients will ask the user to sign in through Weavz when they connect.

bash

curl -X POST https://api.weavz.io/api/v1/mcp/servers \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "AI Code Agent",
    "workspaceId": "YOUR_WORKSPACE_ID",
    "mode": "CODE",
    "settings": { "codeMode": { "approvalWaitSeconds": 30 } }
  }'

typescript

import { WeavzClient } from '@weavz/sdk'
 
const client = new WeavzClient({ apiKey: 'wvz_your_api_key' })
 
const result = await client.mcpServers.create({
  name: 'AI Code Agent',
  workspaceId: 'YOUR_WORKSPACE_ID',
  mode: 'CODE',
  settings: { codeMode: { approvalWaitSeconds: 30 } },
})
 
const serverId = result.server.id
const endpoint = result.mcpEndpoint

python

from weavz_sdk import WeavzClient
 
client = WeavzClient(api_key="wvz_your_api_key")
 
result = client.mcp_servers.create(
    name="AI Code Agent",
    workspace_id="YOUR_WORKSPACE_ID",
    mode="CODE",
    settings={"codeMode": {"approvalWaitSeconds": 30}},
)
 
server_id = result["server"]["id"]
endpoint = result["mcpEndpoint"]

typescript

const res = await fetch('https://api.weavz.io/api/v1/mcp/servers', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer wvz_your_api_key',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    name: 'AI Code Agent',
    workspaceId: 'YOUR_WORKSPACE_ID',
    mode: 'CODE',
    settings: { codeMode: { approvalWaitSeconds: 30 } },
  }),
})
 
const { server, mcpEndpoint } = await res.json()

python

import httpx
 
res = httpx.post(
    "https://api.weavz.io/api/v1/mcp/servers",
    headers={"Authorization": "Bearer wvz_your_api_key"},
    json={
        "name": "AI Code Agent",
        "workspaceId": "YOUR_WORKSPACE_ID",
        "mode": "CODE",
        "settings": {"codeMode": {"approvalWaitSeconds": 30}},
    },
)
 
data = res.json()
server_id = data["server"]["id"]
endpoint = data["mcpEndpoint"]

Response:

json

{
  "server": {
    "id": "abc123def456",
    "name": "AI Code Agent",
    "mode": "CODE",
    "settings": {
      "codeMode": {
        "approvalWaitSeconds": 30
      }
    },
    "authMode": "oauth",
    "endUserAccess": "restricted"
  },
  "mcpEndpoint": "https://api.weavz.io/mcp/srv_abc123def456"
}

Set authMode to bearer or oauth_and_bearer when you need to provision bearer-authenticated clients. API-created bearer tokens are scoped to one end user; shared static bearer tokens are only returned when the workspace can safely use service-style access.

Add Integrations

Add integrations to the workspace first. Workspace integrations sync into MCP servers automatically, and in CODE mode their actions become available under the weavz.* namespace. Use stable aliases for repeated integrations or built-ins, because those aliases become the names agents call.

Manual MCP tool registration is still available when you need a small server-specific override, but the default path for agent workspaces is workspace integrations first. Built-in workspace integrations such as files, state, HTTP, data transformation, web reading, and managed code execution are especially useful because agents can use them without external account setup.

For a dedicated walkthrough, see Using Built-In Workspace Integrations.

Open your workspace

Go to the workspace attached to the MCP server.

Add workspace integrations

Open Integrations, add the integrations the agent should use, and set aliases, connection strategy, enabled actions, and any built-in persistence or sandbox settings.

Confirm MCP sync

Open the MCP server and confirm the workspace integrations are available. Utility and built-in integrations with no external authentication can be added without a connection.

Add integrations to the workspace attached to the MCP server. CODE mode servers sync workspace integrations automatically.

bash

# Add Slack with a shared fixed connection
curl -X POST https://api.weavz.io/api/v1/workspaces/YOUR_WORKSPACE_ID/integrations \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "integrationName": "slack",
    "alias": "slack_bot",
    "connectionStrategy": "fixed",
    "connectionId": "9b2b73f7-b575-42b1-9a8f-c233dff5127d",
    "enabledActions": ["send_channel_message"]
  }'
 
# Add GitHub for per-user work
curl -X POST https://api.weavz.io/api/v1/workspaces/YOUR_WORKSPACE_ID/integrations \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "integrationName": "github",
    "alias": "github_user",
    "connectionStrategy": "per_user",
    "enabledActions": ["create_issue"]
  }'
 
# Add utility integrations without external credentials
curl -X POST https://api.weavz.io/api/v1/workspaces/YOUR_WORKSPACE_ID/integrations \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "integrationName": "datetime",
    "alias": "datetime",
    "enabledActions": ["parse_date"]
  }'
 
curl -X POST https://api.weavz.io/api/v1/workspaces/YOUR_WORKSPACE_ID/integrations \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "integrationName": "hash-encode",
    "alias": "hash",
    "enabledActions": ["hash"]
  }'

typescript

import { WeavzClient } from '@weavz/sdk'
 
const client = new WeavzClient({ apiKey: 'wvz_your_api_key' })
const workspaceId = 'YOUR_WORKSPACE_ID'
 
await client.workspaces.addIntegration(workspaceId, {
  integrationName: 'slack',
  alias: 'slack_bot',
  connectionStrategy: 'fixed',
  connectionId: '9b2b73f7-b575-42b1-9a8f-c233dff5127d',
  enabledActions: ['send_channel_message'],
})
 
await client.workspaces.addIntegration(workspaceId, {
  integrationName: 'github',
  alias: 'github_user',
  connectionStrategy: 'per_user',
  enabledActions: ['create_issue'],
})
 
// Utility integrations do not need connectionId
await client.workspaces.addIntegration(workspaceId, {
  integrationName: 'datetime',
  alias: 'datetime',
  enabledActions: ['parse_date'],
})
await client.workspaces.addIntegration(workspaceId, {
  integrationName: 'hash-encode',
  alias: 'hash',
  enabledActions: ['hash'],
})

python

from weavz_sdk import WeavzClient
 
client = WeavzClient(api_key="wvz_your_api_key")
workspace_id = "YOUR_WORKSPACE_ID"
 
client.workspaces.add_integration(
    workspace_id,
    integration_name="slack",
    integration_alias="slack_bot",
    connection_strategy="fixed",
    connection_id="9b2b73f7-b575-42b1-9a8f-c233dff5127d",
    enabled_actions=["send_channel_message"],
)
 
client.workspaces.add_integration(
    workspace_id,
    integration_name="github",
    integration_alias="github_user",
    connection_strategy="per_user",
    enabled_actions=["create_issue"],
)
 
# Utility integrations do not need connection_id
client.workspaces.add_integration(
    workspace_id,
    integration_name="datetime",
    integration_alias="datetime",
    enabled_actions=["parse_date"],
)
client.workspaces.add_integration(
    workspace_id,
    integration_name="hash-encode",
    integration_alias="hash",
    enabled_actions=["hash"],
)

typescript

const headers = {
  'Authorization': 'Bearer wvz_your_api_key',
  'Content-Type': 'application/json',
}
 
const workspaceId = 'YOUR_WORKSPACE_ID'
 
await fetch(`https://api.weavz.io/api/v1/workspaces/${workspaceId}/integrations`, {
  method: 'POST',
  headers,
  body: JSON.stringify({
    integrationName: 'slack',
    alias: 'slack_bot',
    connectionStrategy: 'fixed',
    connectionId: '9b2b73f7-b575-42b1-9a8f-c233dff5127d',
    enabledActions: ['send_channel_message'],
  }),
})
 
await fetch(`https://api.weavz.io/api/v1/workspaces/${workspaceId}/integrations`, {
  method: 'POST',
  headers,
  body: JSON.stringify({
    integrationName: 'github',
    alias: 'github_user',
    connectionStrategy: 'per_user',
    enabledActions: ['create_issue'],
  }),
})
 
await fetch(`https://api.weavz.io/api/v1/workspaces/${workspaceId}/integrations`, {
  method: 'POST',
  headers,
  body: JSON.stringify({
    integrationName: 'datetime',
    alias: 'datetime',
    enabledActions: ['parse_date'],
  }),
})
 
await fetch(`https://api.weavz.io/api/v1/workspaces/${workspaceId}/integrations`, {
  method: 'POST',
  headers,
  body: JSON.stringify({
    integrationName: 'hash-encode',
    alias: 'hash',
    enabledActions: ['hash'],
  }),
})

python

import httpx
 
headers = {"Authorization": "Bearer wvz_your_api_key"}
workspace_id = "YOUR_WORKSPACE_ID"
 
httpx.post(
    f"https://api.weavz.io/api/v1/workspaces/{workspace_id}/integrations",
    headers=headers,
    json={
        "integrationName": "slack",
        "alias": "slack_bot",
        "connectionStrategy": "fixed",
        "connectionId": "9b2b73f7-b575-42b1-9a8f-c233dff5127d",
        "enabledActions": ["send_channel_message"],
    },
)
 
httpx.post(
    f"https://api.weavz.io/api/v1/workspaces/{workspace_id}/integrations",
    headers=headers,
    json={
        "integrationName": "github",
        "alias": "github_user",
        "connectionStrategy": "per_user",
        "enabledActions": ["create_issue"],
    },
)
 
httpx.post(
    f"https://api.weavz.io/api/v1/workspaces/{workspace_id}/integrations",
    headers=headers,
    json={
        "integrationName": "datetime",
        "alias": "datetime",
        "enabledActions": ["parse_date"],
    },
)
 
httpx.post(
    f"https://api.weavz.io/api/v1/workspaces/{workspace_id}/integrations",
    headers=headers,
    json={
        "integrationName": "hash-encode",
        "alias": "hash",
        "enabledActions": ["hash"],
    },
)

Manual MCP tool registration is still available through POST /api/v1/mcp/servers/:id/tools when one server needs an override that should not affect the workspace. Use workspace integrations for the normal path so API calls, SDK calls, Playground, and MCP all share the same aliases, connection strategy, enabled actions, partials, and built-in settings.

Connect an AI Client

Connect to a CODE mode server the same way as TOOLS mode. OAuth-capable clients can connect with just the MCP endpoint; the AI client will see 3 tools instead of dozens.

In Claude, add a custom connector and paste the MCP endpoint:

text

https://api.weavz.io/mcp/srv_abc123def456

Add to your Cursor MCP settings (.cursor/mcp.json):

json

{
  "mcpServers": {
    "weavz": {
      "type": "http",
      "url": "https://api.weavz.io/mcp/srv_abc123def456"
    }
  }
}

Add to .vscode/mcp.json:

json

{
  "servers": {
    "weavz": {
      "type": "http",
      "url": "https://api.weavz.io/mcp/srv_abc123def456"
    }
  }
}

bash

claude mcp add --transport http weavz https://api.weavz.io/mcp/srv_abc123def456

If your MCP client cannot run OAuth, create or update the server with authMode: "bearer" or authMode: "oauth_and_bearer" and pass the returned mcp_ token:

json

{
  "mcpServers": {
    "weavz": {
      "type": "http",
      "url": "https://api.weavz.io/mcp/srv_abc123def456",
      "headers": {
        "Authorization": "Bearer mcp_your_static_token"
      }
    }
  }
}

For provisioned clients, create a bearer-enabled server and issue one token per end user:

bash

curl -X POST https://api.weavz.io/api/v1/mcp/servers/abc123def456/access-tokens \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"endUserId": "user_123", "scopes": ["mcp:tools", "mcp:code"]}'

Use the returned bearerToken as the Authorization: Bearer mcp_... header. For CODE mode, omit mcp:code only if the token should not be allowed to call weavz_execute.

How Code Mode Works

Once connected, the AI agent uses the 3 meta-tools in sequence:

weavz_search

Search for available integrations and actions by keyword. Search results include compact callable signatures, so simple calls often do not need a separate API read:

text

Agent calls: weavz_search({ query: "hash" })
 
Returns:
## Hash & Encode (hash)
Integration: `hash-encode` | Alias: `hash`
 
- `hash({ text: string, algorithm?: "sha256" | "sha1", encoding?: "hex" | "base64" })` — Generate a cryptographic hash of text.

Use weavz_read_api when the action has nested input, dynamic options, or when you need precise return types and field descriptions.

weavz_read_api

Read the TypeScript declarations for an integration's actions:

text

Agent calls: weavz_read_api({ integration: "hash" })
 
Returns:
  declare namespace weavz {
    namespace hash {
      function generate_uuid(input: {
        count?: number;
      }): Promise<
        { success: true; uuid: string } |
        { success: true; uuids: string[]; count: number } |
        { success: false; error: string }
      >;
    }
  }

Declarations include concrete return types when an action has a declared return contract. Broad third-party API passthrough actions may intentionally return unknown.

weavz_execute

Execute JavaScript code in a managed execution environment. All registered integrations are available under the weavz namespace:

javascript

// Single action
const result = await weavz.slack.send_channel_message({
  channel: '#general',
  text: 'Hello from AI!',
})
 
// Connectionless utility action
const parsed = await weavz.datetime.parse_date({
  dateString: '2026-05-18',
})
 
// Multi-action composition
const channels = await weavz.slack.list_channels({})
const issues = await weavz.github.list_issues({ repo: 'my-org/my-repo' })
 
// Chain results between services
const sheet = await weavz.google_sheets.read_sheet({
  spreadsheetId: 'abc123',
  range: 'A1:B10',
})
for (const row of sheet.values) {
  await weavz.slack.send_channel_message({
    channel: '#updates',
    text: `Row: ${row.join(', ')}`,
  })
}

Some actions have dropdown fields (e.g. selecting a Slack channel by ID). Use weavz.$options to discover valid values inside weavz_execute:

javascript

// Get available Slack channels
const channels = await weavz.$options('slack', 'send_channel_message', 'channel')
// Returns: [{ label: '#general', value: 'C01ABCDEF' }, ...]
 
// Optional: pass alias when the same action exists under multiple aliases
const botChannels = await weavz.$options('slack', 'send_channel_message', 'channel', {}, 'slack_bot')
 
// Use the value in an action
await weavz.slack.send_channel_message({
  channel: channels[0].value,
  text: 'Hello!',
})

weavz.$options() takes the original integration name (with hyphens), not the underscore version used in the namespace. For example, use weavz.$options('google-sheets', ...) even though the namespace is weavz.google_sheets.

If an action is registered under multiple aliases on one server, pass the alias as the 5th argument: weavz.$options(integration, action, property, context?, alias).

Validation errors

Code Mode validates action inputs before execution. If the code passes an unknown key, omits a required key, or uses an invalid enum value, weavz_execute returns an actionable error in the tool result:

text

Invalid input for datetime.parse_date: unknown key "date"; missing required key "dateString". Expected: dateString, timezone.

text

Invalid input for hash.hash: invalid value "SHA-256" for "algorithm". Allowed: "sha256", "sha1".

Fix the input and retry the weavz_execute call. In MCP clients, these errors are returned as tool errors rather than generic server failures.

Real-World Example: Weekly Report Bot

An AI agent uses Code Mode to generate a weekly report from multiple sources:

javascript

// 1. Fetch open issues from GitHub
const issues = await weavz.github.list_issues({
  repo: 'acme/backend',
  state: 'open',
})
 
// 2. Get latest metrics from Google Sheets
const metrics = await weavz.google_sheets.read_sheet({
  spreadsheetId: 'abc123',
  range: 'Metrics!A1:D10',
})
 
// 3. Build a summary
const summary = [
  `Weekly Report — ${new Date().toLocaleDateString()}`,
  `\nOpen Issues: ${issues.length}`,
  `Critical: ${issues.filter(i => i.labels.includes('critical')).length}`,
  `\nKey Metrics:`,
  ...metrics.values.map(row => `  ${row[0]}: ${row[1]}`),
].join('\n')
 
// 4. Post to Slack
await weavz.slack.send_channel_message({
  channel: '#engineering',
  text: summary,
})
 
return { issueCount: issues.length, posted: true }

This runs as a single weavz_execute call — the agent wrote one script that orchestrates 3 integrations. In TOOLS mode, this would require at minimum 3 separate tool calls with the agent manually threading data between them.

Execution Tracing

Every weavz_execute call returns a readable result with console output and a trace of every integration action called:

## Result
```json
{
  "issueCount": 12,
  "posted": true
}
```
 
## Console Output
```
Fetched 12 issues
Read 10 metric rows
```
 
## Actions Executed
- github/list_issues: OK [340ms]
- google_sheets/read_sheet: OK [180ms]
- slack/send_channel_message: OK [95ms]
 
_Duration: 650ms_

This gives full observability into what happened — useful for debugging, auditing, and understanding agent behavior.

Context Usage

The context savings compared to TOOLS mode depend on the MCP client, model, enabled integrations, action schema size, and prompt context. These examples show why CODE mode is useful for broad workspaces:

Scenario	TOOLS Mode	CODE Mode	Savings
10 integrations, 50 actions	Large schema load	3 meta-tools first	High
5 integrations, 20 actions	Medium schema load	3 meta-tools first	High
3 integrations, 10 actions	Smaller schema load	3 meta-tools first	Moderate

CODE mode keeps the initial tool surface to the 3 meta-tools and loads API details only when the agent asks for them.

weavz_search and weavz_read_api are metadata reads. weavz_execute consumes Code Mode execution usage when the run starts. Each successful weavz.* integration action inside that run counts as one action execution; helper probes such as weavz.$schema, weavz.$validate, and weavz.$options do not count as actions.

When to Use CODE vs TOOLS Mode

Factor	TOOLS Mode	CODE Mode
Number of actions	Few (< 10)	Many (10+)
Context window usage	Higher	Small initial surface
Multi-step workflows	One action per call	Multiple actions per call
Setup complexity	Simpler	Requires code execution
AI agent capability	Any MCP client	Needs code-capable agent

Choosing by scenario

Building a chatbot with a few integrations → TOOLS (simple, focused)
Building an AI assistant that handles 20+ services → CODE (context efficiency)
Multi-step data pipelines (fetch → transform → send) → CODE (compose in one call)
AI agent chaining results between APIs → CODE (natural data flow)
Simple single-action tools (search, lookup) → TOOLS (lower overhead)

Use CODE mode when you have many integrations, token efficiency matters, or workflows require chaining multiple actions together.

Use TOOLS mode when you have a small, focused set of tools and simplicity is preferred. See the TOOLS mode guide.

End-User MCP Servers

For per-user integrations, use MCP OAuth when the client can complete sign-in. For provisioned clients that cannot run OAuth, create a bearer-enabled server and issue one mcp_ bearer token per end user. Both paths keep the server attached to the workspace and resolve weavz.* calls to a specific end user's connections.

bash

curl -X POST https://api.weavz.io/api/v1/mcp/servers \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "User Code Agent",
    "workspaceId": "550e8400-e29b-41d4-a716-446655440000",
    "mode": "CODE",
    "authMode": "oauth_and_bearer",
    "endUserAccess": "restricted"
  }'
 
curl -X POST https://api.weavz.io/api/v1/mcp/servers/{serverId}/access-tokens \
  -H "Authorization: Bearer wvz_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"endUserId": "user_123", "scopes": ["mcp:tools", "mcp:code"]}'

typescript

const { server, mcpEndpoint } = await client.mcpServers.create({
  name: 'User Code Agent',
  workspaceId: '550e8400-e29b-41d4-a716-446655440000',
  mode: 'CODE',
  authMode: 'oauth_and_bearer',
  endUserAccess: 'restricted',
})
 
const { bearerToken } = await client.mcpServers.createBearerToken(server.id, {
  endUserId: 'user_123',
  scopes: ['mcp:tools', 'mcp:code'],
})

python

result = client.mcp_servers.create(
    name="User Code Agent",
    workspace_id="550e8400-e29b-41d4-a716-446655440000",
    mode="CODE",
    auth_mode="oauth_and_bearer",
    end_user_access="restricted",
)
 
token = client.mcp_servers.create_bearer_token(
    result["server"]["id"],
    end_user_id="user_123",
    scopes=["mcp:tools", "mcp:code"],
)

typescript

const res = await fetch('https://api.weavz.io/api/v1/mcp/servers', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer wvz_your_api_key',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    name: 'User Code Agent',
    workspaceId: '550e8400-e29b-41d4-a716-446655440000',
    mode: 'CODE',
    authMode: 'oauth_and_bearer',
    endUserAccess: 'restricted',
  }),
})
const data = await res.json()
 
const tokenRes = await fetch(`https://api.weavz.io/api/v1/mcp/servers/${data.server.id}/access-tokens`, {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer wvz_your_api_key',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({ endUserId: 'user_123', scopes: ['mcp:tools', 'mcp:code'] }),
})
const token = await tokenRes.json()

python

import httpx
res = httpx.post(
    "https://api.weavz.io/api/v1/mcp/servers",
    headers={"Authorization": "Bearer wvz_your_api_key"},
    json={
        "name": "User Code Agent",
        "workspaceId": "550e8400-e29b-41d4-a716-446655440000",
        "mode": "CODE",
        "authMode": "oauth_and_bearer",
        "endUserAccess": "restricted",
    },
)
data = res.json()
 
token_res = httpx.post(
    f"https://api.weavz.io/api/v1/mcp/servers/{data['server']['id']}/access-tokens",
    headers={"Authorization": "Bearer wvz_your_api_key"},
    json={"endUserId": "user_123", "scopes": ["mcp:tools", "mcp:code"]},
)
token = token_res.json()

When a weavz_execute call fails because the end user hasn't connected the required integration, the error includes a setup URL. Share this URL with the end user — they open it, connect their account, and the agent can retry.

If a Human Gates policy matches a Code Mode run, the MCP result includes an authenticated approval URL and an approvalId instead of executing the code. Approve it from the Weavz review view or the approvals API, then call weavz_execute with only the approval ID:

json

{ "approvalId": "apr_..." }

Do not resend the original code. Weavz resumes the stored batch once, applies the approval across the action sequence inside that exact run, and returns the cached result if the agent asks again. If the MCP server tools changed after the review, the continuation is rejected so the reviewer can approve the current tool surface.

For Code Mode servers, settings.codeMode.approvalWaitSeconds can keep an approvalId continuation call open briefly while the Human Gate is still pending. This is useful when an agent calls back before the reviewer has clicked approve. If the wait expires, Weavz returns approval_pending and the agent should call weavz_execute with the same approvalId again after approval. See Human Gates.