Stateless MCP Is the Simplest Path to Giving Claude Real-World Tools
The 2026-07-28 MCP specification replaces two-step stateful HTTP sessions with single self-contained requests, making it far simpler to connect Claude to live tools and databases. Simon Willison's analysis shows what this enables — from SQL-querying agents to auditable, security-bounded tool use — and why it matters for professionals handling sensitive data.
What Just Changed: MCP Gets a Major Simplification
On 28 July 2026, the Model Context Protocol received its most significant update since Anthropic first introduced it in November 2024. The new specification — formally called the 2026-07-28 Model Context Protocol specification, and widely referred to as stateless MCP — removes a layer of complexity that had quietly discouraged developers from building with the protocol.
Simon Willison’s analysis at simonwillison.net describes the shift as reigniting his personal interest in the protocol, and in the same week he built three separate projects on top of it. That kind of productive burst from an experienced developer is a useful signal that something genuinely got easier.
What MCP Actually Is, In Plain Language
Before explaining what changed, it helps to understand what MCP does at all.
Think of Claude as a very capable analyst sitting in an office. Left to itself, Claude can only work with information you paste into the conversation. MCP is the system that lets Claude reach through the wall and query a live database, run a calculation tool, or look up real-time data — without you having to copy-paste everything manually.
MCP defines a standard way for any software tool to say: “Here is what I can do, here are the inputs I need, here is how to call me.” Claude, or any other AI model, can then discover those tools automatically and use them during a conversation.
The protocol was introduced by Anthropic in November 2024 and generated considerable developer excitement through 2025. Simon Willison’s analysis notes that interest cooled somewhat when general-purpose agents with shell and internet access emerged — those agents could do many of the same things more flexibly. However, Willison argues that shell-and-curl access carries serious security risks and requires a powerful model to operate safely, while MCP tools are easier to audit and work reasonably well even with smaller, locally-run models.
The Before and After: Why “Stateless” Matters
The old approach — which Willison calls legacy MCP — required two separate HTTP requests to accomplish one task. The first request initialised a session and obtained a session ID. Only then could the second request actually call the tool, carrying that session ID along with it.
This created real problems. Servers had to remember session state, meaning they needed to track every active session ID and route follow-up requests to the correct backend machine. For anyone deploying at scale, this is engineering overhead that adds cost and complexity.
The new stateless specification collapses this into a single HTTP request. There is no session ID to manage. Every tool call is self-contained. According to Simon Willison’s analysis, this is not only cleaner from a developer perspective but also a better fit for scalable web applications, since servers no longer need to maintain state between requests.
For non-technical professionals, the practical meaning is this: it is now meaningfully simpler to build a connector between Claude and a live data source — which means more such connectors will exist, and the ones that do exist will be more reliable.
A Concrete Scenario: A Research Analyst Team in Hyderabad
Imagine a small equity research team in Hyderabad that maintains a Datasette instance — an open-source data-publishing tool — hosting several years of quarterly earnings data for listed companies across sectors.
Today, when an analyst wants to answer a question like “which mid-cap pharma companies increased R&D spend in four consecutive quarters,” someone has to write a SQL query, run it, copy the results, and paste them into a report or a conversation with Claude.
With datasette-mcp — one of the three tools Willison built this week — that Datasette instance gets a live MCP endpoint. Wire that endpoint into Claude, and the analyst can simply ask the question in plain English. Claude will run the necessary SQL queries itself, return the results, and help draft the interpretation. Willison demonstrated exactly this pattern: he connected his own blog’s Datasette mirror to Claude and asked “what has Simon said recently about MCP?” — Claude ran seven separate SQL queries to construct the answer.
The three tools datasette-mcp exposes are list_databases(), get_database_schema(database_name), and execute_sql(database_name, sql). The SQL execution is currently read-only, which is precisely the right constraint for a research team that needs to protect its data from accidental modification.
For the Hyderabad analyst team, this represents a qualitative change in how quickly research questions get answered — not because Claude got smarter, but because the plumbing connecting Claude to their data became straightforward enough to actually deploy.
What Else Willison Built This Week
Beyond datasette-mcp, Simon Willison’s analysis describes two other projects that emerged from the new specification.
The Security Argument for MCP Over Open Agents
One of the more important points in Simon Willison’s analysis is about security, not features.
General coding agents — the kind that can browse the web, run shell commands, and execute arbitrary code — are powerful but difficult to reason about from a security standpoint. Willison previously wrote about a pattern he calls the Lethal Trifecta: conditions under which an AI agent can be manipulated into leaking sensitive data. His view, updated in this post, is that MCP tools are much easier to reason about because they are bounded. You know exactly what each tool can and cannot do. An agent can only do what the tools permit.
This is a meaningful consideration for any Indian professional working in regulated industries — banking, insurance, healthcare, legal services — where data handling has compliance implications. A well-defined MCP tool that runs only read-only SQL queries against a specific database is auditable in a way that “an agent with a terminal and internet access” simply is not.
Limitations and Tradeoffs to Know
The stateless specification is genuinely new. As of late July 2026, client support — meaning the AI interfaces and agent frameworks that can consume MCP tools — is still catching up. Willison notes it took fiddling to connect his datasette-mcp endpoint to ChatGPT and Claude, though he did get there and published a TIL (Today I Learned) note documenting the steps.
The execute_sql tool in datasette-mcp is currently read-only. If your use case requires write access, that is not yet available.
The llm-mcp-client plugin is explicitly in alpha. Willison describes it as not fully baked, meaning it should be treated as experimental rather than production-ready.
MCP tools also still carry the prompt injection risks Willison flagged in an earlier post from 2024. Stateless MCP reduces infrastructure complexity, but it does not eliminate the risk that a malicious data source could attempt to manipulate an agent through its tool responses. This risk requires careful tool design, not just careful infrastructure.
There are no region restrictions specific to MCP itself — it is an open protocol specification. However, your ability to use it through Claude depends on your Claude plan and the features Anthropic has made available in your region.
What to Watch For Next
Willison mentions plans to integrate MCP into Datasette Agent and llm-coding-agent, which would bring tool-use capabilities to more of his widely-used open-source projects. The fact that he rebuilt datasette-mcp four times before — and only found a version worth releasing after the stateless specification arrived — suggests that the protocol’s complexity was a genuine barrier that is now meaningfully lower.
If you work with structured data — financials, logistics records, customer databases, research archives — and have wondered whether Claude could work directly with that data rather than with copies of it, stateless MCP is the development worth following closely. The infrastructure work just got simpler. The use cases did not change. They just became easier to build.
