Stateless MCP: the protocol update that won back Simon Willison's interest

A new revision of the Model Context Protocol landed on Tuesday — a specification with the formal name “2026-07-28,” which its author prefers to call simply MCP 2.0. According to Simon Willison, it's the most significant change to the protocol since its launch, and it's precisely what won back his interest in MCP.

A quick reminder: MCP is a standard proposed by Anthropic in November 2024 for connecting external tools to agents built on language models. In 2025 the protocol enjoyed a surge in popularity, but then it was overshadowed by another Anthropic project — Skills. It became clear that an agent with access to a terminal and curl doesn't need a separate protocol: it can already do nearly everything, and more flexibly at that.

Why the author came back to MCP

Willison points to the flip side of that flexibility. Handing an agent a full-blown shell with internet access is risky and demands a powerful model capable of steering that environment. MCP tools, by contrast, are easier to inspect and control, and even small models running right on a laptop can handle them.

One request instead of a session

The key innovation is doing away with state on the server side. Previously, calling a tool required two HTTP requests: first initializing a session and obtaining an Mcp-Session-Id, then the call itself. Now a single request suffices, with the method and tool name passed in the headers. This simplifies both the client and the server, and it's also a better fit for scalable web applications: there's no need to store session state or make sure requests from a single session land on the same machine.

Three tools in a week

Inspired by the changes, Willison put together three projects in a week. mcp-explorer is a Python CLI utility for interactively exploring MCP servers: it can list tools, show their JSON schemas and invoke them with arguments; thanks to uvx it can be run without installation. datasette-mcp is a plugin for Datasette that adds a /-/mcp endpoint with three tools: listing databases, a database schema and (read-only for now) executing SQL. Finally, llm-mcp-client is an alpha plugin that adds MCP support to his LLM tool; over time the author hopes to build the capability into the core.

Security as an argument

Willison once wrote about MCP's problems with prompt injection — it was out of those reflections that the notion of the “lethal trifecta” was later born. But the arrival of agents with arbitrary access to the shell and the network made the defense problem far harder. He now comes to a conclusion: reasoning about an agent's capabilities and potential risks is much easier when the toolset is limited to MCP rather than open command execution. It's on MCP that the author intends to rely when building sensitive applications based on language models.

Source: Simon Willison