Willison rebuilds interest in MCP after stateless spec drops

A specification change I would normally skim past is what pulled Simon Willison back to MCP this week, and reading his notes on it clarified why the timing matters. The stateless MCP spec, dated 2026-07-28, collapses what used to be a two-request dance, initialize a session and then call a tool, into a single HTTP request carrying an `MCP-Protocol-Version: 2026-07-28` header and an `Mcp-Method: tools/call` header naming the tool. Willison calls it "the most significant change to the MCP spec since it first launched."

The practical consequence is that both sides get simpler. Servers stop tracking session state, clients stop juggling session IDs, and in his framing the protocol becomes "a better fit for building scalable web applications, since now you don't need to maintain server-side state." That maps onto how MCP tends to actually get deployed, behind an HTTP endpoint, fronted by load balancers, expected to scale horizontally, where per-session state was always the awkward part.

He backs the piece with three artifacts. mcp-explorer is a stateless Python CLI for probing MCP servers, which he wrote because he "couldn't find a great CLI tool for interactively probing an MCP server" and had Codex help build one. datasette-mcp is a Datasette plugin that exposes three tools, `list_databases()`, `get_database_schema(database_name)` and `execute_sql(database_name, sql)`, so an agent can run SQL against a hosted Datasette instance. And llm-mcp-client wires MCP into his LLM CLI; the demo he uses is deliberately mundane, ask "count the notes" and get 151 notes back.

The through-line is a security argument. Willison prefers giving an agent a small, named set of tools over giving it shell plus curl, on the view that "giving an agent a shell environment with the ability to access the internet is fraught with risk" and that "MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well." He says he plans to "lean into MCP a whole lot more when I'm building sensitive applications on top of LLMs."

The honest caveat is that this is one practitioner writing up one week's changes, and it says little about how auth works under the stateless spec or about the migration path for the pile of stateful MCP servers already deployed. The forward-looking read, though, is that if easier-to-implement and easier-to-audit both hold, MCP becomes the default wrapper for any team that wants LLM access to internal data without handing over a shell.