Version 2

Simon Willison is building a cluster of AI-native Datasette plugins: datasette-agent (an LLM assistant that can now execute write SQL with user approval [1]), datasette-apps (sandboxed HTML/JS applications backed by parameterized stored queries [3]), datasette-tailscale (Tailnet exposure via experimental Rust bindings [5]), and datasette-agent-charts (chart generation added to the agent toolset [2]). He uses Claude Code throughout development — for implementation research, infrastructure configuration, and security review — and has begun amplifying broader architectural views about LLM tooling, including the argument that MCP's core value is auth isolation rather than tool integration [8].

The project shows what AI-augmented solo development looks like in practice: LLMs serving simultaneously as implementation researchers, security evaluators, and end-user interfaces. The datasette-apps sandboxing model — CSP-locked iframes with write access restricted to pre-approved parameterized queries — is a replicable pattern for LLM-generated web artifacts that need persistent storage without exposing arbitrary SQL write paths.

Simon Willison has been building Datasette — an open-source tool for exploring and publishing SQLite databases — since 2017. In 2026, he has been layering AI capabilities into the ecosystem through a set of LLM-powered plugins, while using AI tools extensively as development and security instruments throughout.

The plugin set now comprises four components. datasette-agent is a chat interface that lets an LLM interact with a Datasette instance through defined tools; version 0.3a0 added an execute_write_sql tool that prompts for user approval before any database modification, with an --unsafe flag for power users who want to bypass approvals entirely [1]. datasette-agent-charts (at 0.1a1) extends the agent with chart generation capability [2]. datasette-apps provides a system for hosting self-contained HTML+JavaScript applications inside sandboxed iframes within Datasette; apps interact with the database only through pre-approved parameterized stored queries, and CSP configuration is restricted to users holding a dedicated apps-set-csp permission, with an optional allowed_csp_origins allow-list for non-privileged users [3][4]. datasette-tailscale arrived at 0.1a0 using Python bindings for the experimental tailscale-rs Rust library to expose a local Datasette server over a Tailnet [5].

AI tooling has played a direct role in building these plugins. To investigate column provenance — mapping SQLite query result columns back to their source table.column — Willison used Claude Code running Opus 4.8, which surfaced three working approaches: one using the apsw library, one calling the SQLite C API directly via ctypes (since Python's standard sqlite3 module does not expose sqlite3_column_table_name()), and one parsing EXPLAIN output [6]. For datasette-apps, Willison ran a security evaluation using Claude Fable 5 before the public announcement; the model found a path where a low-privileged user could create a malicious app to exfiltrate data from an administrator who visited it. Willison fixed the vulnerability — the CSP meta tag injected into each iframe is immutable once set — and shipped the feature [3]. Claude Fable 5 was subsequently banned by the US government, removing it as a future resource for this project.

Willison has also applied Claude Code to infrastructure work outside the Datasette plugins themselves, including configuring a Cloudflare WAF rule to scope CAPTCHA challenges to faceted search URLs (those containing ampersands) rather than all searches — noting that the Cloudflare MCP integration could not edit WAF rules directly and required a fallback to the Cloudflare API [7]. He has also amplified a Hacker News argument by Sean Lynch that MCP's core value over skills or CLI tools is keeping auth flows outside the agent's context window, with the implication that the idealized form of MCP might be purely an authentication gateway [8].