MCP 2.0 drops session state; Willison ships three tools on it
Simon Willison writes about the July 28, 2026 rollout of the new Model Context Protocol specification, which he calls Stateless MCP or MCP 2.0 (the formal name is the 2026-07-28 spec). The update switches MCP servers and clients from a two-request, session-based design to a single-request, stateless one. Under the old design, a client first had to POST an 'initialize' call to obtain an Mcp-Session-Id token, then POST a second request carrying that ID to actually call a tool. The new design folds both steps into a single HTTP POST that carries the protocol version, method name, and tool name in headers alongside the JSON-RPC body, so servers no longer need to track session state or route repeat requests to the same backend machine.
Willison calls this the most significant change to the MCP spec since it launched, and says it revived his interest in the protocol after MCP had been eclipsed through 2025 by Skills, another Anthropic invention, once it became apparent that an agent harness with access to a terminal and curl could do most of what MCP did, more flexibly. He argues MCP's structured tool calls are easier to audit and control than open shell access, and simple enough that smaller models running on a laptop can still drive them reasonably well. He says he plans to lean on MCP a lot more when building sensitive applications on top of LLMs, noting that end users mixing and matching tools has previously exposed them to prompt injection and data exfiltration risks, the concern behind what he elsewhere calls the Lethal Trifecta.
To exercise the new spec, Willison says he built three tools in one week. The first, mcp-explorer, is a stateless Python command line tool for listing, inspecting, and calling tools on any MCP server; it runs via uvx with no separate install step. He demonstrates it against Ade Oshineye's agentic-mermaid.dev demo server, listing tools including execute, describe_sdk, render_svg, render_ascii, and render_png, then calling render_svg to turn a Mermaid diagram into SVG.
The second, datasette-mcp, is a plugin for his Datasette database tool that adds a /-/mcp endpoint exposing three tools: list_databases(), get_database_schema(database_name), and execute_sql(database_name, sql), with execute_sql() read-only for the moment. Willison says this is roughly his fourth attempt at building the plugin, and the stateless spec finally produced a version he felt was ready to release. He runs it against a Datasette mirror of his own blog; in a shared demo session, wiring the endpoint into Claude and asking what he had said recently about MCP led Claude to run 7 separate SQL queries to answer.
The third, llm-mcp-client, is a new alpha plugin adding MCP support to his command-line LLM tool, installed with 'llm install llm-mcp-client'. It lets a prompt reference an MCP server directly. In a demo run against his Datasette-hosted blog, using LLM 0.32rc2 and the command 'llm -T MCP("https://datasette.simonwillison.net/-/mcp\") "count the notes"', the tool returned 'There are 151 notes.' Willison says he is considering folding the plugin into LLM's core, and wants to bring MCP support into his Datasette Agent and llm-coding-agent projects as well.
Key facts
- The stateless MCP 2.0 specification (the 2026-07-28 Model Context Protocol revision) rolled out on July 28, 2026, replacing two-request, session-based tool calls with a single HTTP POST.
- Simon Willison built three tools around the new spec in one week: mcp-explorer, a CLI for probing any MCP server; datasette-mcp, which adds an /-/mcp endpoint to his Datasette tool; and llm-mcp-client, an alpha MCP plugin for his LLM command-line tool.
- In a demo, a Claude session wired to datasette-mcp ran 7 separate SQL queries to answer a question about Willison's own blog posts on MCP.
- A demo of llm-mcp-client, run with LLM 0.32rc2 against his Datasette-hosted blog, returned 'There are 151 notes' for a simple count query.
- Willison calls the stateless rollout the most significant change to MCP since it launched, and says MCP's structured tool calls are easier to audit than open shell and curl access, especially for smaller, laptop-scale models.
Why it matters
The stateless MCP 2.0 spec removes a whole class of implementation complexity from both MCP clients and servers: no more issuing and tracking an Mcp-Session-Id, and no more need to route a session's repeat requests to the same backend machine, which Willison notes is a better fit for scalable web applications. He calls it the most significant change to the protocol since Anthropic introduced MCP in November 2024, and says it is what pulled his own attention back to MCP after the protocol had been eclipsed through 2025 by Anthropic's Skills, once agent harnesses with terminal and curl access showed they could do much of what MCP did, more flexibly.
Who it affects
Developers building MCP clients or servers, who now implement a single-request protocol instead of a two-request session handshake; users of Willison's own tools, including Datasette instance operators who can now expose SQL access to an agent via a plugin, and users of his LLM command-line tool who gain a way to point a prompt at any MCP server; and, more broadly, anyone integrating tool access into agent frameworks like Claude or ChatGPT.
How to use it
mcp-explorer needs no separate install: run it with uvx, for example 'uvx mcp-explorer list
How solid is it
This is a first-person account from Willison describing his own week of work across three separate projects, with concrete commands, sample outputs, and a linked shared Claude session as evidence. The source gives no adoption, download, or usage figures for any of the three tools beyond the single demo sessions described, and datasette-mcp is by Willison's account roughly his fourth attempt at the plugin, with earlier tries evidently not reaching a released state.
Risks and caveats
execute_sql() in datasette-mcp is read-only 'for the moment,' and the source does not say whether that restriction is permanent. llm-mcp-client is explicitly an alpha plugin, and Willison says only that he is 'considering' bringing it into LLM's core, with no timeline given. He also references, without repeating in detail here, his earlier writing on MCP's prompt injection risks when end users mix and match tools themselves, the pattern behind the Lethal Trifecta; his current argument is that MCP is easier to reason about than open shell access, not that those risks are eliminated.
“MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well.”
— Simon Willison