Version 3

Simon Willison is building a cluster of AI-native Datasette plugins — datasette-agent (LLM chat interface with write-SQL capability [1]), datasette-apps (sandboxed HTML/JS apps backed by parameterized stored queries [3]), datasette-agent-charts [2], and datasette-tailscale [5] — while concurrently releasing sqlite-utils 4.0rc1, which adds a migrations system and nested transaction support [9]. He uses Claude Code throughout, both for implementation research and as a vibe-coding collaborator: a recent experiment had Claude Opus 4.8 autonomously port a PyTorch image model to ONNX, publish weights to Hugging Face, and build a WebGPU browser interface, with Willison reading none of the resulting code [10].

The project is a running case study of AI-augmented solo development, covering security implications (a privilege-escalation vulnerability caught by Claude before a feature release [3]), ergonomic trade-offs (write-approval prompts vs. an --unsafe bypass flag [1]), and the acknowledged cost of vibe coding: Willison noted he learned nothing about the underlying ML technologies by delegating all code generation without reviewing the output [10].

Simon Willison has been building Datasette — an open-source tool for exploring and publishing SQLite databases — since 2017. In 2026, he has layered AI capabilities into the ecosystem through a set of LLM-powered plugins, while using AI tools extensively as development and security instruments.

The plugin set comprises four components. datasette-agent is a chat interface letting an LLM interact with a Datasette instance through defined tools; version 0.3a0 added an execute_write_sql tool that prompts for user approval before any database modification, with an --unsafe flag for power users who want to bypass approvals entirely [1]. datasette-agent-charts extends the agent with chart generation capability [2]. datasette-apps provides sandboxed HTML+JavaScript applications inside iframes within Datasette; apps interact with the database only through pre-approved parameterized stored queries, and CSP configuration is restricted to users holding a dedicated apps-set-csp permission, with an optional allowed_csp_origins allow-list for non-privileged users [3][4]. datasette-tailscale arrived at 0.1a0 using Python bindings for the experimental tailscale-rs Rust library to expose a local Datasette server over a Tailnet [5].

AI tooling has played a direct role in building and securing these plugins. To investigate column provenance — mapping SQLite query result columns back to their source table.column — Willison used Claude Code running Opus 4.8, which surfaced three working approaches: one using the apsw library, one calling the SQLite C API via ctypes, and one parsing EXPLAIN output [6]. For datasette-apps, a security evaluation using Claude Fable 5 found a path where a low-privileged user could exfiltrate data from an administrator who visited a malicious app; Willison fixed the vulnerability and shipped the feature [3]. He has also applied Claude Code to infrastructure work, including configuring a Cloudflare WAF rule scoped to faceted-search URLs, noting that the Cloudflare MCP integration could not edit WAF rules directly and required a fallback to the Cloudflare API [7]. He has amplified a Hacker News argument that MCP's core value is isolating auth flows outside the agent context window rather than integrating tools or skills [8].

In parallel, Willison released sqlite-utils 4.0rc1, which ports the sqlite-migrate package's migrations system into the library and adds a db.atomic() context manager for nested SQLite transactions using savepoints; the release also drops Python 3.8 and adds Python 3.13 support [9]. He also demonstrated a vibe-coding experiment with no connection to Datasette: using Claude Opus 4.8 to autonomously convert the Moebius 0.2B PyTorch image inpainting model to ONNX, publish weights to Hugging Face, and build a complete browser WebGPU interface — without reading any of the generated code [10]. Willison found the approach viable for non-trivial ML engineering but acknowledged the trade-off directly: he learned nothing about the underlying technologies involved.