When the new MCP spec release went live a few days ago, I wrote here about the stateless core and the enterprise building blocks. Now Simon Willison has weighed in — and his angle is a completely different one: that of a developer who just starts building. July 28th was, in his words, “Stateless MCP day,” and the update has reignited his personal interest in the protocol.
Why stateless changes things
Willison boils the technical core down to a simple picture. Before, an MCP call needed two HTTP requests: one to initialize a session and get an Mcp-Session-Id, and a second for the actual tool call. Now a single request does it. No more session state, no more worrying about routing the same session back to the same backend machine. For scalable web apps that’s simply the better architecture — and for anyone building servers, a lot less work.
Three tools in a week
The most convincing part is what Willison actually did with the new spec. He built three tools right away:
mcp-explorer is a stateless CLI tool for interactively probing MCP servers. Thanks to uvx you don’t even need to install it — one command lists a server’s tools, another inspects their JSON schema, a third calls them with arguments. Exactly the kind of tool that helps you really learn a specification.
datasette-mcp adds a /-/mcp endpoint to any Datasette instance. Three tools: list databases, read schema, run SQL (read-only for now). Willison has tried to build this plugin four times before — only with the stateless spec does it finally feel good enough to release. In a shared Claude session, he watched the model run seven SQL queries in a row to answer a question about his own blog.
llm-mcp-client is his alpha attempt to finally give his LLM tool an official MCP integration.
The real point: security
What I find most interesting is his shift in stance. A year ago Willison was flagging MCP’s prompt-injection problems. Now he says: handing an agent a shell with curl and internet access is far harder to secure — see the “lethal trifecta.” MCP tools are easier to audit and control, and simple enough that even smaller models running on your own laptop can drive them. His conclusion: for sensitive applications, he plans to lean into MCP much more.
My take
It’s one thing when Anthropic announces a spec release. It’s another when someone like Willison shows up a week later with three finished tools, proving the barrier to entry has genuinely dropped. That’s exactly the moment when a protocol change turns into an ecosystem. And his security argument lands: the most powerful agent isn’t automatically the best one — sometimes the tightly scoped, auditable toolbox is the smarter call.
Sources: