Stateless MCP revives interest in the protocol: three tools from one week

On 31 July 2026 Simon Willison published a post describing how the "stateless" revision of the Model Context Protocol (MCP) has rekindled his interest in the protocol. The new specification rolled out on Tuesday, 28 July — formally the 2026-07-28 version, or MCP 2.0 — and it is the most significant change to the protocol since it first launched.

What changed

MCP is the standard Anthropic introduced in November 2024 for exposing tools to LLM-powered agents. It saw a huge spike of interest through 2025, then became somewhat eclipsed by Anthropic's Skills, since an agent harness with a terminal and curl can do most of the same work more flexibly. The older, session-based flow required two HTTP requests: an initialize call to obtain an Mcp-Session-Id, then a second request carrying that session header to actually call a tool. The stateless revision collapses this into a single POST, with headers like MCP-Protocol-Version: 2026-07-28, Mcp-Method: tools/call and Mcp-Name, and client information moved into a _meta block in the body. Willison notes this is much cleaner to implement on both the client and server side, and a better fit for scalable web applications: servers no longer need to keep session state or route a session to the same backend machine.

Three tools in one week

He built three projects on the new spec. mcp-explorer is a stateless Python CLI for interactively probing MCP servers; it runs without installation through uvx and can list, inspect and call tools. datasette-mcp is a Datasette plugin that adds a /-/mcp endpoint to any Datasette instance with three tools: list_databases(), get_database_schema() and a read-only execute_sql(). The third, llm-mcp-client, is an alpha plugin for his LLM tool: in one command, an agent ran several SQL queries against a hosted database and answered "count the notes" with 151.

Why MCP, again

Willison argues that MCP tools are easier to audit and control than an agent given an unrestricted shell and internet access, which he describes as fraught with risk and dependent on a strong model. Back in 2025 he wrote about prompt injection risks in MCP, and later about the "lethal trifecta"; with general agents now running arbitrary commands, MCP makes an agent's capabilities easier to reason about. He plans to lean on MCP a lot more when building sensitive applications.