MCP vs Code Mode for SREs: From Individual Tool Calls to Intelligent Incident Investigation

According to the source, Model Context Protocol (MCP) and Code Mode are two separate concepts that help LLMs investigate incidents. MCP provides a standard interface for LLMs to connect to external tools and data sources, while Code Mode allows the LLM to write and execute code to orchestrate these tools.

MCP simplifies integration by offering a consistent way for LLMs to access tools like Prometheus, Loki, Kubernetes, and GitHub. It eliminates the need for custom implementations for each tool and handles authentication and API endpoints. For example, an SRE monitoring server can expose tools such as query_prometheus, query_loki, get_pod_status, and get_recent_deployments through MCP.

Code Mode, on the other hand, enables LLMs to write code that orchestrates the tools provided by MCP. Instead of the LLM making multiple individual tool calls and processing intermediate data, Code Mode generates Python code that performs the orchestration. The generated code can query Prometheus for error rates, search Loki for errors within a specific time window, retrieve relevant Kubernetes information, and generate a compact summary.

The main difference between MCP and Code Mode lies in their purposes. MCP focuses on exposing tools to LLMs, while Code Mode handles the orchestration of these tools using generated code. Code Mode acts as an architectural pattern, not a separate protocol that replaces MCP. It allows for more efficient data processing, reduced context responses, and greater flexibility in combining tools and performing custom processing.

In summary, MCP and Code Mode serve different functions in incident investigation for SREs. MCP provides a standardized interface for LLMs to access tools, while Code Mode enables LLMs to write code that orchestrates these tools, improving efficiency and flexibility in the investigation process.