Simon Willison builds three tools around stateless MCP 2.0
Simon Willison writes that Tuesday marked the rollout of stateless MCP, the 2026-07-28 revision of the Model Context Protocol, which he calls the most significant change to the spec since it first launched. MCP was introduced by Anthropic in November 2024, saw a large spike of interest through 2025, then got partly eclipsed by Skills, another Anthropic invention, once it became clear that an agent with shell and curl access could do much of what MCP did. The technical change is that the old stateful version, which he calls legacy MCP, needed two HTTP requests: one to initialize a session and obtain an Mcp-Session-Id, and a second to actually call the tool. The new stateless version needs only one HTTP request, carrying the protocol version, method and tool name in headers alongside the JSON-RPC body; no server-side session state has to be kept or routed to a specific backend machine.
Willison says he built three MCP-related projects this week. The first, mcp-explorer, is a stateless Python CLI tool for interactively probing an MCP server, built with help from Codex; it needs no install and runs via uvx, for example uvx mcp-explorer list against a target server's /mcp endpoint. He demonstrated it against Ade Oshineye's agentic-mermaid.dev demo MCP server, listing its tools (execute, describe_sdk, render_svg, render_ascii, render_png) and then calling render_svg with arguments to get back rendered SVG output.
The second project, datasette-mcp, is a Datasette plugin that adds a /-/mcp endpoint to any Datasette instance; Willison says this is probably the fourth time he has tried building it, and the new stateless spec finally produced a version he felt good releasing. It exposes three tools: list_databases(), get_database_schema(database_name) and execute_sql(database_name, sql), with execute_sql currently read-only. He runs it on the Datasette mirror of his own blog, at datasette.simonwillison.net/-/mcp, and connected it to both ChatGPT and Claude. In a shared Claude session, he asked it to list tables in simonwillison.net and then what he had said recently about MCP; Claude ran 7 separate SQL queries to work out the answer.
The third project, llm-mcp-client, is an alpha plugin adding MCP support to his LLM command-line tool, installed with llm install llm-mcp-client. Using LLM 0.32rc2, he ran a query against his Datasette-hosted blog asking it to count the notes; the tool reasoned through the ambiguity between published notes and drafts and returned an answer of 151 notes. Willison says he is considering folding the plugin directly into LLM core and wants to try it in Datasette Agent and llm-coding-agent as well.
He also revisits MCP's security profile. Some months after MCP first launched, he had written that letting end users freely mix and match tools pushed the responsibility for avoiding data exfiltration onto the users themselves, a pattern he later folded into what he calls the Lethal Trifecta. General agents with arbitrary shell and curl access, he says, are far harder to keep secure than that. He argues MCP tools are easier to audit and control than open-ended command execution, and simple enough that smaller models running on a laptop can still drive them reasonably well; he plans to lean into MCP a lot more when building sensitive applications on top of LLMs.
Key facts
- The stateless MCP 2.0 specification, dated 2026-07-28, replaces the old two-request stateful session flow (initialize, then call) with a single stateless HTTP request.
- mcp-explorer, a CLI tool Willison built with Codex, probes any MCP server via uvx with no install; he demoed it against Ade Oshineye's agentic-mermaid.dev server.
- datasette-mcp, his fourth attempt at the plugin, exposes three tools (list_databases, get_database_schema, execute_sql, the last currently read-only); Claude ran 7 SQL queries against it to answer a question about his blog.
- llm-mcp-client, an alpha plugin for his LLM tool tested on LLM 0.32rc2, answered a note-count query against his Datasette-hosted blog with 151 notes.
- Willison argues MCP tools are easier to audit and control than shell-and-curl agent access, and plans to lean into MCP more for sensitive applications.
Why it matters
The stateless MCP 2.0 spec strips out the session-initialization handshake that made the protocol fiddly to implement on both client and server sides, and removes the need to track or route server-side session state. Willison frames this as the biggest change to MCP since its November 2024 launch, and says it reignited his own interest in the protocol after Anthropic's Skills approach had partly eclipsed it through 2025.
Who it affects
Developers building MCP clients or servers get a simpler protocol to implement. Users of Willison's own tools benefit directly: Datasette instance operators can add a queryable MCP endpoint, and users of his LLM command-line tool gain an MCP integration path. More broadly, anyone building agent tooling now has a lower-complexity reference point for stateless MCP.
How to use it
mcp-explorer needs no installation and runs through uvx, for example uvx mcp-explorer list
How solid is it
This is a firsthand account from the person who built and ran all three tools this week, with working command examples and a shared Claude session as evidence. llm-mcp-client is explicitly labeled alpha, and Willison says he is still deciding whether to fold it into LLM core rather than treating it as finished.
Risks and caveats
execute_sql in datasette-mcp is read-only for the moment, a deliberate limit rather than a full feature. llm-mcp-client remains alpha and not yet part of LLM core. The account covers only Willison's own three projects; it gives no adoption figures or other implementers of stateless MCP, and no version year for the May 21st blog post he cites as introducing the release candidate.
“MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well.”
— Simon Willison