MCP 2.0 goes stateless, Datasette runs browser JS, LLM 0.32 opens a chat port

Sources

Stateless MCP has recaptured my interest (and inspired mcp-explorer and datasette-mcp) simonwillison.net

Tuesday was Stateless MCP day - the rollout of MCP 2.0, or the 2026-07-28 Model Context Protocol specification to use the more formal but less memorable name. This is the most significant change to the MCP spec since it first launched, and has also served to reignite my personal interest in the protocol. For background: MCP is the Model Context Protocol, which describes a standard way to expose new tools to LLM-powered agent frameworks. It was introduced by Anthropic back in November 2024 , had…

llm-mcp-client 0.1a0 simonwillison.net

Release: llm-mcp-client 0.1a0 See this blog entry . Tags: llm , model-context-protocol

datasette-agent 0.4a0 simonwillison.net

Release: datasette-agent 0.4a0 New await context.browser_task() mechanism allowing agent tools to run code directly in the user’s browser. #33 This is an exciting new capability: it makes it easy for Datasette Agent plugins to provide tools that execute custom JavaScript in the user’s browser . I used this to add a debug loop to Datasette Apps in datasette-apps 0.2a0 . Tags: datasette , llm-tool-use , datasette-agent

datasette-apps 0.2a0 simonwillison.net

Release: datasette-apps 0.2a0 Changes that improve Datasette Apps when created and edited using Datasette Agent : New app_debug() tool allowing agent to open an app (invisibly) and test it using JavaScript. #33 New app_list() tool for listing apps the user has permission to edit, so the agent can edit them. #36 The app_debug() tool is pretty neat: it works by displaying the app in a opacity: 0 iframe with pointer-events: none (so it can’t be seen or interacted with) and then executing agent-pro…

llm 0.32rc1 simonwillison.net

Release: llm 0.32rc1 This RC for LLM 0.32 finishes the work that started in LLM 0.32a0 - it adds a new schema design that does a much better job of capturing the details of the prompts and responses returned by the latest model families. The most important change is the use of content-addressable hash IDs for stored messages. This allows de-duplication in the database, and means that LLM can now represent trees of messages for forked conversations. Since it involves a significant schema change…

llm 0.32rc2 simonwillison.net

Release: llm 0.32rc2 Hot on the heels of RC1 , this fixes a dependency issue and also adds two neat new features: The default model for users who have not set their own default is now GPT-5.6 Luna . It was previously GPT-4o mini . Luna is a much better and more recent model, albeit slightly more expensive - $0.20 per million input tokens and $1.20 per million output tokens, compared to $0.15/$0.60 for 4o mini. You can switch back to 4o mini using llm models default gpt-4o-mini , or switch to GP…

llm-chat-completions-server 0.1a0 simonwillison.net

Release: llm-chat-completions-server 0.1a0 A key goal of the new content-addressable logs in LLM 0.32rc1 was being able to support OpenAI Chat Completion style requests where each incoming message extends the previous conversation, like this: curl http://localhost:8002/v1/chat/completions \ -H ‘Content-Type: application/json’ \ -d ’{ “model”: “qwen3.5-4b”, “messages”: [ {“role”: “user”, “content”: “Capital of France?”}, {“role”: “assistant”, “content”: “Paris.”}, {“role”: “user”, “content”: “Ge…

smevals - a small eval suite for evaluating models, prompts, and harnesses simonwillison.net

smevals, built with Jesse Vincent’s Prime Radiant lab, runs YAML-defined tasks across model configs and grades them via checks, from string matches to LLM judges. A single uvx command runs an eval against multiple models like gpt-5.5 and claude-opus-4.6, then serves a static HTML report.

Ontologies Are So Back: Why AI Agents Are Reviving the Semantic Web latent.space

Semantic-web ontologies are being revived by AI engineers to keep probabilistic agents inside deterministic boundaries. The pitch: schemas and typed relationships give LLM-driven systems a structured world model to reason against, reducing hallucinated actions when agents traverse enterprise data or execute tool calls.

GPU Management: Why Idle GPUs Are the New Grounded Aircraft huggingface.co

A Hugging Face post reframes GPU utilization as an airline-style yield problem, arguing idle accelerators burn capital the way parked planes do. The piece pushes scheduling, pooling, and workload-mix strategies as the operational discipline AI teams need to justify multi-million-dollar cluster spend.

Slack Emoji Maker simonwillison.net

The browser tool crops and exports images to Slack’s required 128x128 transparent-background PNG format. Willison had Fable build it in a single pull request against those specs, another entry in his growing collection of small single-purpose utilities generated by coding agents.

References

AWS Machine Learning Blog (AgentCore Gateway) aws.amazon.com

AgentCore Gateway supports the MCP 2026-07-28 spec … removing Redis-based session dependencies and allowing any request to be handled by any server instance behind standard round-robin load balancers.

Microsoft Tech Community (Azure App Service) techcommunity.microsoft.com

MCP just went stateless — previously handshakes forced sticky routing, often causing 404 errors if a request landed on an unfamiliar pod; the new spec turns MCP servers into ordinary HTTP services.

Akamai Security Research akamai.com

Research indicated that 30% to 82% of public MCP servers contained exploitable flaws, with many exposed to the internet without any authentication … the new spec shifts the burden of maintaining security boundaries entirely to the developer.

daily.dev — ‘MCP 2.0 is mostly deletion’ daily.dev

Highly requested features like native file-upload were deferred; critics call the codebase ‘vibecoded’ and fragmented across too many repositories to allow efficient auditing.

Medium — ‘MCP is dead? MCP vs Skills revisited’ (Alonisser) medium.com

A single GitHub MCP server might inject 30,000+ tokens of schema definitions into every prompt, consuming up to 60% of the context window … CLI + Skills can cost $3.20 per 10k operations vs $55.20 for heavy MCP.

XenoSpectrum — MRTR / input_required deep dive xenospectrum.com

When a server requires user input it returns an InputRequiredResult with an opaque requestState blob; the client gathers answers and re-issues the original request, echoing the requestState so continuity travels with the data rather than server memory.

lv424.online (AI/TECH Signal Vault commentary) lv424.online

A useful primitive… but it creates a new attack surface by establishing a direct pipeline from the agent to the user’s browser.

mgks.dev — ‘datasette-apps: The Future of Building Database-Powered Interfaces’ mgks.dev

collapses the traditional workflow of writing SQL and manual visualization into a single conversation, treating database interaction as a tool the AI can reliably invoke

Cloud Security Alliance — AI Coding Agent Sandbox Escapes research note labs.cloudsecurityalliance.org

agents often stay ‘inside the box’ but write malicious configurations… that are later executed by trusted, unsandboxed host processes

SysAid — ‘Agentic AI Browsers: Risk Rules’ sysaid.com

Indirect Prompt Injection… the ‘XSS of the AI era’ — an attacker can plant plain-language instructions on a webpage that the agent interprets as a command

Palo Alto Unit 42 — Real-Time Malicious JavaScript Through LLMs unit42.paloaltonetworks.com

polymorphic malicious JavaScript… synthesized at runtime and delivered from trusted LLM domains, it can bypass static analysis, network filters, and traditional signature-based detection

MLOps Community — ‘Finding the Holy Grail of AI Agent UIs’ home.mlops.community

The ‘iframe sandbox pattern’ remains the industry standard for executing and rendering untrusted, agent-generated HTML/JS… provides a strict DOM-level boundary that prevents tool poisoning and secret exfiltration

Vellum blog — ‘GPT-5.6 Sol, Terra, Luna explained’ vellum.ai

Luna’s new pricing — $0.20 input / $1.20 output per million tokens — makes it ‘intelligence too cheap to meter,’ with the gap between Sol and Luna now as high as 25x.

Artificial Analysis — ‘GPT-5.6 has landed’ artificialanalysis.ai

Sol scored 59 on the Intelligence Index v4.1, trailing Claude Fable 5 while costing roughly one-third as much; Luna’s MRCR long-context recall collapsed to 41.3% versus 89%+ for Sol/Terra.

boxai.com.cn — LLM 0.32 schema writeup ai.boxai.com.cn

The 0.32rc1 release implements a side-by-side migration: new content-addressable tables coexist with legacy tables, and llm logs performs a dual-read to merge old and new history seamlessly.

Simon Willison Substack — ‘Stateless MCP has recaptured my interest’ simonw.substack.com

In stateless chat-completion workflows every turn resends the entire history — content-addressing lets the local store keep only unique parts, which is exactly what the new server plugin needs to avoid exponential log growth.

aihot.tech aggregation aihot.tech

The companion llm-chat-completions-server binds to localhost:9001 with no authentication by default; the codebase was reportedly authored end-to-end by GPT-5.6 Sol, and no independent security audit exists for the 0.1a0 alpha.

simonwillison.net/tags/llm — release notes index simonwillison.net

0.32rc2 patches rc1 and swaps the default model from GPT-4o mini to GPT-5.6 Luna; users wanting the old cost profile must run llm models default manually.