v0.1.0

First release. Not published to PyPI; install from source with uv sync.

• mcp-code-mode serve -- COMMAND wraps any stdio MCP server as one run_python tool: the model writes Python that calls the server's tools as async functions.
• The code runs in a locked-down Docker container: no network, nothing from the host's environment, read-only root, no capabilities, an unprivileged user, process, memory, CPU and file limits, and a deadline. mcp-code-mode build-image builds the image from the Dockerfile shipped in the package.
• A host-side bridge checks every call before the server sees it: allowlist, JSON Schema, argument and result size limits, a call budget per run and a timeout per call.
• A Python API for other hosts, and a toy server with an end-to-end test that needs no model and no API key.
• The README's threat model lists each threat, its control and its test, and what is not protected: the shared kernel (gVisor not wired in), the wrapped server running unsandboxed, and prompt injection labelled but not filtered.

Extracted from the code mode of bank-reconciliation-agent, where it ran in a pre-registered experiment; this package carries no measurements of its own.