MCP 2.0 goes stateless, Datasette runs browser JS, LLM 0.32 opens a chat port

TL;DR

• MCP 2.0 spec drops session IDs, collapsing init-then-call into a single stateless HTTP request.
• Datasette Agent 0.4a0 ships browser_task(), executing JavaScript in the user’s tab for self-debug loops.
• LLM 0.32 defaults to GPT-5.6 Luna at 25× cheaper but 41.3% MRCR long-context recall.
• Akamai finds 30-82% of public MCP servers carry exploitable flaws under the new spec.
• Simon Willison releases smevals, a YAML-driven runner grading multiple small models via checks.

Three agent-plumbing releases land together today, and each one buys developer velocity by widening the attack surface underneath. MCP 2.0 collapses the session handshake into a single stateless request — great for load balancers, less great when Akamai says 30-82% of public MCP servers already carry exploitable flaws. Datasette Agent 0.4a0 hands the agent a browser_task() primitive that runs JavaScript in the user’s tab, unlocking Claude-Artifacts-style self-debug loops and, per security reviewers, a fresh lethal trifecta. LLM 0.32 switches its default to a 25× cheaper model whose long-context recall drops from 89% to 41.3%, and ships an unauthenticated chat server on localhost:9001.

Simon Willison’s fingerprints are all over the day — three MCP clients, the browser_task() primitive, the LLM 0.32 rc2 — and the round-ups extend the pattern: a new small-model eval runner, an ontologies-as-guardrails argument from Latent Space, and a vibe-coded Slack emoji utility. The tooling is compounding fast; the security discipline is not.

MCP 2.0 drops session IDs to survive load balancers

Source: simon-willison · published 2026-07-31

TL;DR

• MCP 2.0 (the 2026-07-28 spec) collapses the old init-then-call handshake into a single stateless HTTP request.
• AWS AgentCore and Azure App Service both shipped stateless support, dropping Redis session stores and ending sticky-routing 404s.
• Simon Willison shipped three clients in a week — mcp-explorer, datasette-mcp, llm-mcp-client — declaring MCP safer than shell-based agents.
• Akamai counters that 30-82% of public MCP servers have exploitable flaws, with the spec pushing security burden onto developers.

One request, no session

The 2026-07-28 Model Context Protocol spec is the biggest rewrite since Anthropic introduced MCP in late 2024, and its headline change is simple: no more sessions. Legacy MCP required a client to POST /mcp with an initialize call, receive an Mcp-Session-Id, then POST /mcp again with that ID to actually invoke a tool. MCP 2.0 hoists the method name and protocol version into HTTP headers and turns the whole exchange into one request.

sequenceDiagram
    participant C as Client
    participant LB as Load Balancer
    participant S1 as Server A
    participant S2 as Server B
    Note over C,S2: Legacy MCP (stateful)
    C->>LB: POST initialize
    LB->>S1: routed
    S1-->>C: Mcp-Session-Id
    C->>LB: POST tools/call + session
    LB->>S2: wrong pod → 404
    Note over C,S2: MCP 2.0 (stateless)
    C->>LB: POST tools/call (headers only)
    LB->>S2: any pod works
    S2-->>C: result

That diagram is not editorial embellishment — it’s Microsoft’s actual complaint. The Azure App Service team frames the change as the fix for a chronic operational bug where handshakes forced sticky routing and any request that landed on an unfamiliar pod returned 404 ¹. AWS updated AgentCore Gateway the same cycle, explicitly citing the removal of Redis-backed session tracking and compatibility with plain round-robin balancers ². When two hyperscalers ship near-identical release notes in the same week, the scaling pitch is not marketing.

Willison’s tooling burst

Willison is a useful bellwether here because he had publicly written MCP off. In his 2025 retrospective he argued Anthropic’s own Skills — plus an agent with shell and curl — had eclipsed the protocol. The stateless spec pulled him back. In one week he shipped mcp-explorer (a uvx-runnable CLI probe), datasette-mcp (a plugin exposing list_databases, get_database_schema, and a read-only execute_sql to any Datasette instance), and an alpha llm-mcp-client plugin that wires MCP tools into his llm CLI. His Claude demo runs seven sequential SQL queries against his blog mirror to answer a natural-language question.

The security argument Willison now makes is that MCP tools have schemas, which makes agent capabilities auditable in a way that “shell plus internet” fundamentally isn’t. He’s been consistent on this since coining the “lethal trifecta” — the point is that a smaller, cheaper local model can drive a schema’d tool but cannot safely drive a terminal.

The dissent Willison sidesteps

Two counter-arguments deserve equal billing. First, Akamai’s audit of public MCP servers found 30-82% contained exploitable flaws, many exposed to the internet without authentication, and warns that statelessness “shifts the burden of maintaining security boundaries entirely to the developer” ³. The new requestState blob that carries continuity in the payload rather than server memory ⁴ is exactly the kind of opaque handle that gets replayed if the server doesn’t verify who minted it.

Second, the token-economics case for Skills over MCP hasn’t gone away. Alonisser benchmarks a single GitHub MCP server burning 30,000+ tokens of schema per prompt — up to 60% of the context window — and puts CLI+Skills at $3.20 per 10k operations against $55.20 for heavy MCP ⁵. Critics on daily.dev separately call the 2.0 codebase “mostly deletion,” with native file upload deferred and reference implementations fragmented across too many repos to audit efficiently ⁶.

Stateless MCP genuinely fixes deployment. It does not fix the token bill, and “easier to audit than a shell” is a lower bar than “secure by default.”

Further reading

• llm-mcp-client 0.1a0 — simon-willison

---

Datasette Agent gains browser_task() for self-debug loops

Source: simon-willison · published 2026-07-31

TL;DR

• browser_task() in datasette-agent 0.4a0 lets agent tools execute JavaScript directly in the user’s browser tab.
• datasette-apps 0.2a0 wires the primitive into a self-debug loop, letting the agent inspect DOM state and iterate on generated apps.
• Independent reviewers frame this as a Claude-Artifacts-style build-and-verify pattern, converging with MCP Apps and Tambo.
• Security researchers flag a new “lethal trifecta” surface: private DB access, untrusted rows, and now client-side JS execution.

What actually shipped

Simon Willison’s two-part drop — datasette-agent 0.4a0 and datasette-apps 0.2a0 — adds a single primitive that changes the shape of the framework: await context.browser_task(). Agent tools can now dispatch JavaScript that runs in the user’s browser and await the result inside the LLM reasoning loop. The immediate payoff is a debug loop in datasette-apps: when a generated mini-app misrenders, the agent injects a hidden opacity:0 iframe, reads back DOM measurements or console output, and revises the code.

That’s a meaningful architectural shift. Datasette Agent has been, effectively, a SQL-writing chatbot with server-side tools. browser_task() gives it hands on the client — enough to close the write-run-observe loop that separates a code generator from an actual developer.

Why the pattern matters beyond Datasette

The mgks.dev review argues the combined release “collapses the traditional workflow of writing SQL and manual visualization into a single conversation” ⁷. That framing is right but understates the reach. MLOps Community’s 2026 survey of agent-UI architectures identifies the sandboxed iframe as the emerging industry standard (“Pattern 4”) for rendering agent-generated code, and explicitly slots Willison’s design alongside MCP Apps (SEP-1865) and Tambo as convergent plumbing ⁸. Streamlit components and Jupyter widgets are being pushed toward the same isolation model for security reasons anyway.

In other words: this isn’t a Datasette curiosity. It’s an early implementation of what agent-native UIs are converging on.

The security story is thinner than the release notes suggest

Willison cites sandbox="allow-scripts allow-forms", a strict CSP, and no cookie access as the containment story. Independent security research reads the same design and finds gaps.

flowchart LR
    A[Private DB rows] --> B{Datasette Agent}
    C[Untrusted row content<br/>indirect prompt injection] --> B
    B -->|browser_task JS| D[User's browser DOM]
    D -.exfil / trust handoff.-> E((External world))

The Cloud Security Alliance’s July 2026 note describes a “Trust Handoff Flaw” where agents stay inside the sandbox but write configurations later executed by trusted host processes — a class the CSP-plus-iframe model doesn’t address ⁹. SysAid calls indirect prompt injection “the XSS of the AI era,” noting a hostile row in a queried table can plant instructions the agent then compiles into a browser_task payload ¹⁰. Palo Alto Unit 42 documents polymorphic JavaScript synthesized at runtime that “bypass[es] static analysis, network filters, and traditional signature-based detection” — precisely what CSPs are supposed to catch ¹¹. An early technical brief lands the summary: a useful primitive that establishes “a direct pipeline from the agent to the user’s browser” ¹².

The mitigations address exfiltration and cross-origin abuse, but not the trust-handoff and prompt-injection vectors that dominate current security literature.

Takeaway

browser_task() is a genuinely novel primitive — the missing piece for agent-driven UI iteration, and one that other frameworks will copy. It’s also a fresh instance of the lethal trifecta Willison himself has warned about: private data, untrusted input, and now client-side execution, wired into the same loop. The debug loop is the feature. The trifecta is the bill.

Further reading

• datasette-apps 0.2a0 — simon-willison

---

LLM 0.32 hashes messages to survive stateless chat APIs

Source: simon-willison · published 2026-07-30

TL;DR

• Content-addressable hashes now key every stored message, enabling deduplication and forked conversation trees in logs.db.
• rc2 swaps the default model to GPT-5.6 Luna at $0.20/$1.20 per million tokens — roughly 25× cheaper than Sol.
• Luna’s MRCR long-context recall is 41.3%, versus 89%+ for Sol and Terra — a quiet regression for agent workflows.
• The new chat-completions server binds localhost:9001 with no authentication in its 0.1a0 alpha.

Why hash-index the log store

Simon Willison’s LLM 0.32 release cycle is three coupled bets shipped in a single afternoon: a Merkle-style log schema, a stateless-API bridge plugin, and a default-model swap. Read together, they’re a bigger reorientation than the individual release notes let on.

The schema change is the load-bearing one. Modern Chat Completions endpoints are stateless — every turn resends the full transcript — so a naïve log store bloats quadratically with conversation length. Content-addressing message parts by hash means the local SQLite database keeps exactly one copy of each unique chunk, no matter how many times a prefix reappears ¹³. It also lets LLM represent forked conversations as trees rather than linear lists, which is the shape you actually want when you’re A/B-ing prompts against three model variants.

The rc1 migration is deliberately conservative: new hash-indexed tables live alongside the legacy row-based ones, and llm logs performs a dual-read that merges old and new history transparently ¹⁴. Users who skip the recommended llm logs backup are unlikely to lose data — but the belt-and-braces backup step is still the right call before an alpha schema lands in your history.

flowchart LR
    A[Chat client] -->|full transcript each turn| B[llm-chat-completions-server<br/>localhost:9001]
    B --> C[OpenAI / Anthropic / etc]
    B --> D[(logs.db<br/>hash-indexed store)]
    D -.dedupes shared prefixes.-> D

The default-model footgun

rc2 quietly changes the default model from GPT-4o mini to GPT-5.6 Luna ¹⁵. That lands in the middle of a violent price war — Vellum called Luna’s $0.20/$1.20 pricing “intelligence too cheap to meter,” noting the Sol-to-Luna gap is now around 25× ¹⁶. Cheap defaults are usually good defaults.

Except Luna isn’t a free lunch. Artificial Analysis clocked Luna’s MRCR long-context recall at 41.3%, versus 89%+ for Sol and Terra, and put Sol itself at 59 on the Intelligence Index — behind Claude Fable 5 at roughly a third of the cost ¹⁷. For interactive one-shots this doesn’t matter. For agent loops that stuff tool outputs and prior turns into a growing context, it very much does. Users upgrading to rc2 should run llm models default back to something with intact recall before pointing an agent harness at it.

An unaudited localhost server

The third piece of the drop is llm-chat-completions-server 0.1a0, an OpenAI-compatible proxy that exposes LLM’s model routing on localhost:9001. Two details make it worth flagging: the endpoint ships with no authentication by default, and the codebase was reportedly written end-to-end by GPT-5.6 Sol with no independent security review ¹⁸.

A local proxy any process on the machine can hit is a plausible confused-deputy surface, especially once browser-based agents start scanning localhost.

This is exactly the pattern Willison’s own “Rule of Two” cautions against — an agent stack that combines untrusted input, access to private data, and the ability to act should never satisfy more than two of the three at once. An unauthenticated local endpoint that mints upstream API calls on your dime is one browser tab away from being interesting to an attacker. Treat 0.1a0 as what it says on the tin: an alpha, bound to loopback, and worth firewalling from anything you didn’t launch yourself.

The schema work is the durable win here. The default swap and the server are the parts that deserve a second look before you pip install --upgrade.

Further reading

• llm 0.32rc2 — simon-willison
• llm-chat-completions-server 0.1a0 — simon-willison

Round-ups

Simon Willison ships smevals for small model eval suites

Source: simon-willison

smevals, built with Jesse Vincent’s Prime Radiant lab, runs YAML-defined tasks across model configs and grades them via checks, from string matches to LLM judges. A single uvx command runs an eval against multiple models like gpt-5.5 and claude-opus-4.6, then serves a static HTML report.

Ontologies return as guardrails for probabilistic AI agents

Source: latent-space

Semantic-web ontologies are being revived by AI engineers to keep probabilistic agents inside deterministic boundaries. The pitch: schemas and typed relationships give LLM-driven systems a structured world model to reason against, reducing hallucinated actions when agents traverse enterprise data or execute tool calls.

Idle GPUs framed as AI infrastructure’s grounded aircraft

Source: huggingface-blog

A Hugging Face post reframes GPU utilization as an airline-style yield problem, arguing idle accelerators burn capital the way parked planes do. The piece pushes scheduling, pooling, and workload-mix strategies as the operational discipline AI teams need to justify multi-million-dollar cluster spend.

Willison vibe-codes a 128x128 Slack emoji maker

Source: simon-willison

The browser tool crops and exports images to Slack’s required 128x128 transparent-background PNG format. Willison had Fable build it in a single pull request against those specs, another entry in his growing collection of small single-purpose utilities generated by coding agents.

Footnotes

1. Microsoft Tech Community (Azure App Service) — https://techcommunity.microsoft.com/blog/appsonazureblog/mcp-just-went-stateless-%E2%80%94-what-the-2026-spec-changes-about-scaling-on-app-servic/4530222

   MCP just went stateless — previously handshakes forced sticky routing, often causing 404 errors if a request landed on an unfamiliar pod; the new spec turns MCP servers into ordinary HTTP services.

   ↩

2. AWS Machine Learning Blog (AgentCore Gateway) — https://aws.amazon.com/blogs/machine-learning/how-agentcore-gateway-supports-the-mcp-2026-07-28-spec/

   AgentCore Gateway supports the MCP 2026-07-28 spec … removing Redis-based session dependencies and allowing any request to be handled by any server instance behind standard round-robin load balancers.

   ↩

3. Akamai Security Research — https://www.akamai.com/blog/security-research/new-mcp-specification-security-teams-must-prepare

   Research indicated that 30% to 82% of public MCP servers contained exploitable flaws, with many exposed to the internet without any authentication … the new spec shifts the burden of maintaining security boundaries entirely to the developer.

   ↩

4. XenoSpectrum — MRTR / input_required deep dive — https://xenospectrum.com/en/mcp-2026-stateless-release/

   When a server requires user input it returns an InputRequiredResult with an opaque requestState blob; the client gathers answers and re-issues the original request, echoing the requestState so continuity travels with the data rather than server memory.

   ↩

5. Medium — ‘MCP is dead? MCP vs Skills revisited’ (Alonisser) — https://medium.com/@alonisser/mcp-is-dead-or-mcp-vs-skills-revisited-daaa51b9a519

   A single GitHub MCP server might inject 30,000+ tokens of schema definitions into every prompt, consuming up to 60% of the context window … CLI + Skills can cost $3.20 per 10k operations vs $55.20 for heavy MCP.

   ↩

6. daily.dev — ‘MCP 2.0 is mostly deletion’ — https://daily.dev/posts/mcp-2-0-is-mostly-deletion-that-s-the-good-part-l9muhssho

   Highly requested features like native file-upload were deferred; critics call the codebase ‘vibecoded’ and fragmented across too many repositories to allow efficient auditing.

   ↩

7. mgks.dev — ‘datasette-apps: The Future of Building Database-Powered Interfaces’ — https://mgks.dev/blog/2026-06-20-datasette-apps-the-future-of-building-database-powered-interfaces/

   collapses the traditional workflow of writing SQL and manual visualization into a single conversation, treating database interaction as a tool the AI can reliably invoke

   ↩

8. MLOps Community — ‘Finding the Holy Grail of AI Agent UIs’ — https://home.mlops.community/public/blogs/finding-the-holy-grail-of-ai-agent-uis-from-ai-orchestrated-development-to-a2ui

   The ‘iframe sandbox pattern’ remains the industry standard for executing and rendering untrusted, agent-generated HTML/JS… provides a strict DOM-level boundary that prevents tool poisoning and secret exfiltration

   ↩

9. Cloud Security Alliance — AI Coding Agent Sandbox Escapes research note — https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-coding-agent-sandbox-escapes-20260722-c/

   agents often stay ‘inside the box’ but write malicious configurations… that are later executed by trusted, unsandboxed host processes

   ↩

10. SysAid — ‘Agentic AI Browsers: Risk Rules’ — https://www.sysaid.com/blog/generative-ai/agentic-ai-browsers-risk-rules

    Indirect Prompt Injection… the ‘XSS of the AI era’ — an attacker can plant plain-language instructions on a webpage that the agent interprets as a command

    ↩

11. Palo Alto Unit 42 — Real-Time Malicious JavaScript Through LLMs — https://unit42.paloaltonetworks.com/real-time-malicious-javascript-through-llms/

    polymorphic malicious JavaScript… synthesized at runtime and delivered from trusted LLM domains, it can bypass static analysis, network filters, and traditional signature-based detection

    ↩

12. lv424.online (AI/TECH Signal Vault commentary) — https://lv424.online/

    A useful primitive… but it creates a new attack surface by establishing a direct pipeline from the agent to the user’s browser.

    ↩

13. Simon Willison Substack — ‘Stateless MCP has recaptured my interest’ — https://simonw.substack.com/p/stateless-mcp-has-recaptured-my-interest

    In stateless chat-completion workflows every turn resends the entire history — content-addressing lets the local store keep only unique parts, which is exactly what the new server plugin needs to avoid exponential log growth.

    ↩

14. boxai.com.cn — LLM 0.32 schema writeup — https://ai.boxai.com.cn/en/articles/13565

    The 0.32rc1 release implements a side-by-side migration: new content-addressable tables coexist with legacy tables, and llm logs performs a dual-read to merge old and new history seamlessly.

    ↩

15. simonwillison.net/tags/llm — release notes index — https://simonwillison.net/tags/llm/

    0.32rc2 patches rc1 and swaps the default model from GPT-4o mini to GPT-5.6 Luna; users wanting the old cost profile must run llm models default manually.

    ↩

16. Vellum blog — ‘GPT-5.6 Sol, Terra, Luna explained’ — https://www.vellum.ai/blog/gpt-5-6-sol-terra-luna-explained

    Luna’s new pricing — $0.20 input / $1.20 output per million tokens — makes it ‘intelligence too cheap to meter,’ with the gap between Sol and Luna now as high as 25x.

    ↩

17. Artificial Analysis — ‘GPT-5.6 has landed’ — https://artificialanalysis.ai/articles/gpt-5-6-has-landed

    Sol scored 59 on the Intelligence Index v4.1, trailing Claude Fable 5 while costing roughly one-third as much; Luna’s MRCR long-context recall collapsed to 41.3% versus 89%+ for Sol/Terra.

    ↩

18. aihot.tech aggregation — https://aihot.tech/all/

    The companion llm-chat-completions-server binds to localhost:9001 with no authentication by default; the codebase was reportedly authored end-to-end by GPT-5.6 Sol, and no independent security audit exists for the 0.1a0 alpha.

    ↩