Claim◆Article

Giving an agent a shell environment with internet access is fraught with risk and requires a strong driving model, whereas MCP tools are easier to audit and control and are simple enough that smaller laptop models can drive them, and the stateless spec greatly cuts client and server implementation complexity.

The reason Simon is coming back to MCP: arbitrary shell-and-internet access is risky and demands a strong model, while MCP tools are easier to audit, control, and drive from smaller laptop models — and the stateless spec slashed implementation complexity, which he proved by building three implementations in a week. ✦ AI generated

Simon Willison · Simon Willison's Weblog · 2026-07-31 · original ↗

Share card ↓Export .md Export .txt

I'm coming back around to MCP now. Giving an agent a shell environment with the ability to access the internet is fraught with risk, and requires a strong model that is capable of effectively driving such an environment. MCP tools are easier to audit and control, and simple enough that smaller models that run on a laptop can still drive them reasonably well. The new stateless MCP specification also greatly decreases the complexity of implementing both clients and servers for the protocol. I built three of those this week!

Read full article ↗excerpt · fair-use quotation

✳ MCP

Around this claim

Mechanism · 1

Legacy stateful MCP required two HTTP requests — an initialize handshake to obtain a Mcp-Session-Id followed by the actual tool call — while stateless MCP collapses this to a single request, which is much cleaner to implement from both client and server sides and a better fit for scalable web applications that need no server-side session state.Simon Willison · Simon Willison's Weblog · conf 80%

In practice · 2

datasette-mcp adds a /-/mcp endpoint to any Datasette instance exposing three tools — list_databases(), get_database_schema(), and read-only execute_sql() — giving agents the ability to run SQL queries against a hosted Datasette instance, and it is a fourth attempt that finally felt releasable thanks to the stateless spec.Simon Willison · Simon Willison's Weblog · conf 65%I couldn't find a great CLI tool for interactively probing an MCP server, so I had Codex help build mcp-explorer — a stateless Python CLI that needs no installation and runs via uvx against any MCP endpoint.Simon Willison · Simon Willison's Weblog · conf 60%

This moment responds to

supports → The 2026-07-28 stateless MCP specification (MCP 2.0) is the most significant change to the Model Context Protocol since it first launched, and it has reignited my interest in a protocol that had been eclipsed by Skills and by agent harnesses with terminal and curl access.Simon Willison · Simon Willison's Weblog rebuts → MCP and traditional tool calls are 'stupid' — the future is models writing code freely in a minimal container, not choosing from 50 predefined tools in a system prompt.Eiso Kant · Latent Space supports → Even though MCP has its own prompt injection security problems, arbitrary shell and curl access in an open network environment is much harder to keep secure, and MCP makes it easier to reason about agent capabilities and failure modes — which is why I plan to lean into MCP when building sensitive LLM applications.Simon Willison · Simon Willison's Weblog