Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp)

Tuesday was, as Simon Willison puts it, Stateless MCP day. The rollout of the 2026-07-28 Model Context Protocol spec is the biggest change to MCP since Anthropic introduced it in November 2024, and it's dragged Willison back into a protocol he'd more or less written off in favor of Anthropic's Skills approach.

The technical change is almost boring to describe but huge in practice. Old MCP, what Willison now calls "legacy MCP," needed two HTTP requests: one to initialize a session and grab an Mcp-Session-Id, then a second to actually call the tool. That meant servers had to track session state and route repeat requests to the same backend machine, which is exactly the kind of plumbing that makes scalable web apps miserable to build. The new spec collapses this into one request, with protocol version and method info sitting in headers instead of a session handshake. No state to maintain, no session routing headaches. It's a small diff on paper that removes a real chunk of implementation complexity for anyone writing an MCP client or server.

Willison didn't just read the spec, he built against it three times in a week. First came mcp-explorer, a stateless Python CLI (installable via uvx, no setup required) for poking at any MCP server: listing its tools, inspecting a tool's JSON schema, or calling it directly with arguments. He demoed it against Ade Oshineye's agentic-mermaid.dev server, pulling back rendered SVG diagrams from the command line. Second is datasette-mcp, a Datasette plugin exposing a /-/mcp endpoint with three tools - list_databases, get_database_schema, and a read-only execute_sql. Willison says he's tried building this plugin four times before; the new spec is what finally made a version he wanted to ship. He's running it live on the Datasette mirror of his own blog, and has it hooked into both ChatGPT and Claude, where it can answer questions like "what has Simon said recently about MCP" by firing off seven SQL queries on its own. Third is llm-mcp-client, an early plugin bringing MCP support into his LLM command-line tool, which he's already using to run natural-language queries against that same Datasette instance.

The more interesting thread running through all this is Willison's return to arguing that MCP is simply a safer way to build agents than giving them a shell and curl access. Back in early 2025 he flagged MCP's own prompt-injection problems, the pattern where mixing and matching tools quietly shifts data-exfiltration risk onto end users, an idea that later crystallized into what he calls the Lethal Trifecta. But general-purpose agents with unrestricted shell access turned out to be worse: harder to audit, harder to reason about, and dependent on a strong model to avoid catastrophe. MCP's narrower, declared toolset is easier to control, and simple enough that even small models running on a laptop can drive it competently. That's the case he's making for leaning back into MCP for anything sensitive.