MCP 2026-07-28 ships and the protocol goes stateless - plus Kimi K3's open weights land and Anthropic stakes out its position

The MCP specification we previewed as a release candidate last week went final on Jul 28, and it is the largest revision the protocol has taken since launch. The core is stateless now: the initialize/initialized handshake and the Mcp-Session-Id header are gone, and every request self-describes with protocol version, client identity, and capabilities in its metadata. The practical consequence is deployment shape. A remote server that needed sticky sessions, a shared session store, and deep packet inspection at the gateway can now sit behind plain round-robin, route on an Mcp-Method header, and let clients cache tools/list for as long as its ttlMs allows. All four Tier 1 SDKs implement it, with Rust in beta.

It is a breaking change, so the deprecation windows matter more than the feature list. Roots, Sampling, and Logging are deprecated with a 12-month minimum support window, as is the legacy HTTP+SSE transport. If you run MCP servers in production, that window is your migration runway and it started Tuesday. Anthropic shipped Claude-side support the same day, which is worth reading as a signal about how fast the client side moves: the spec and its largest consumer landed together rather than months apart.

The other thread is Kimi K3, whose 2.8 trillion parameters went public on Jul 26, a day ahead of Moonshot's own target. The parameter count got the coverage, but the architecture is the part worth your time: NoPE everywhere, a delta-rule attention mechanism with per-channel forgetting, and a latent-compressed MoE, all of it descending from a 48B research model from last year. There is a good section below walking the mechanism from linear attention forward, and a genuinely unresolved question about whether any of it survives long-context retrieval. Anthropic published its position on open-weights models on Jul 27, one day later, which is either a coincidence or is not. Claude Code, meanwhile, shipped nothing at all, its first quiet week in months, with v2.1.220 from Jul 25 still the latest release.

Two operational reads round out the issue, and both are the kind where someone did the expensive thing first and wrote down what it cost. Tailscale published the network-side account of the Hugging Face intrusion, with the node and credential counts nobody else has had. And Manifest deprecated their LLM router after four months, with cache economics as the reason it never added up.

From us: Yaw MCP v0.74.0 shipped today. The hosted control plane is retired, and a project-scoped bundles.json now needs your explicit approval before it can spawn anything. More below.

MCP 2026-07-28 is final

• The 2026-07-28 specification shipped Jul 28. Beyond the stateless core, Multi Round-Trip Requests replace server-initiated streams, so a server returns resultType: "input_required" and the client retries with inputResponses instead of holding an SSE stream open. Mcp-Method and Mcp-Name headers let a gateway route and authorize without parsing the JSON body, and tools/list, prompts/list, and resources/list results carry ttlMs and cacheScope hints. Authorization hardens with RFC 9207 issuer validation and a move from Dynamic Client Registration to Client ID Metadata Documents, with issuer-bound credentials. Tasks graduates from experimental core to a formal io.modelcontextprotocol/tasks extension with polling. TypeScript, Python, Go, and C# all ship it, Rust is in beta, and every breaking change has a migration guide
• Anthropic shipped Claude-side support the same day - MCP Apps render interactive UI inline in a conversation so you can see what a connector is doing without switching tabs; enterprise-managed auth lets an admin authorize a connector once through Entra or Okta and grant access by directory group; observability dashboards give connector developers adoption and performance numbers across Claude surfaces; and MCP tunnels, in research preview, reach private-network servers without public exposure or IP allowlisting. Anthropic puts the directory at 950+ servers and SDK downloads at 400 million a month, which is the number that explains why the stateless core mattered enough to break the protocol over
• AWS walked through AgentCore Gateway's support for the new spec - useful if you are the one who has to actually run the gateway, since it works through header-based routing and the authorization changes from the operator's side rather than the protocol author's

Kimi K3, from the inside

• The weights landed Jul 26, a day ahead of Moonshot's own target: 2.8 trillion parameters in a sparse MoE, 1M context, native multimodal input, under a Modified MIT license, at roughly 1.4TB to pull down. Nathan Lambert reads it as an "open-weights escalation," and the size is the headline, since this is frontier-adjacent capability you can host yourself if you can afford the hardware. VentureBeat's read on the license caveats is the one to hand your legal team before anyone starts a download. The more interesting story is underneath the parameter count
• Sebastian Raschka's architecture notes are the fastest way to see what K3 actually changed, and the theme is inference efficiency rather than novelty for its own sake. RoPE is gone entirely, replaced by NoPE throughout, which as far as Raschka can tell makes K3 the first frontier-level architecture to drop positional embeddings universally rather than in a few layers. Attention is Kimi Delta Attention plus multi-head latent attention. Standard MoE is replaced by LatentMoE, which compresses the large linear layers the same way MLA compresses attention. The one genuinely new part is attention residuals, connecting residuals across layers with attention scores doing the weighting, which costs about 4% more to train and 2% more to serve and buys a better validation loss. Native multimodal input is new in this generation
• You could have come up with Kimi Delta Attention is the best explanation I have read of the attention mechanism, and it earns the title by deriving KDA rather than describing it. The chain is short: strip the softmax and linear attention becomes a fixed-size state matrix that is O(T) instead of O(T squared), but additive writes mean new facts interfere with old ones. DeltaNet fixes that by writing the error between what memory already predicts for a key and the value you want, rather than writing the value. Gated DeltaNet adds a scalar retention gate so the whole state can decay. KDA's contribution is promoting that scalar to a vector, one gate per key channel, so the model can clear one channel while holding another instead of forgetting everything at the same rate. The post also walks the two execution modes, a five-line recurrent kernel for decode and a chunkwise matrix form for training, which are the same math organized for different hardware
• Kimi Linear: An Expressive, Efficient Attention Architecture is the paper the whole design descends from, and it is worth noting it is from 2025, at 3B activated parameters inside a 48B total. The claims that carried forward: up to 75% KV cache reduction, up to 6x decoding throughput at 1M context, better than a comparable MLA model across every benchmark they ran, and positioned as a drop-in replacement for full attention. K3 is that architecture scaled roughly 58x with vision and RL work layered on. The KDA kernel, the vLLM implementation, and the checkpoints were all open-sourced, which is a large part of why the follow-through was this fast
• The HN thread on the paper resurfaced this week for obvious reasons and is more useful than the usual launch-day noise. The sharpest question comes from imrozim and is still unanswered: how does this hold up on long-context retrieval, needle-in-a-haystack and RULER, against a same-size full-attention model, because that is exactly where linear attention hybrids have historically fallen apart. Efficiency numbers are easy, retrieval fidelity at 1M context is the part to be skeptical about. Elsewhere in the thread, bratao reports Gated DeltaNet 2 testing better on expressiveness in their internal models, thesiti92 asks the uncomfortable hardware question of whether inference ASIC bets get stranded if non-standard transformers take off, and one commenter pushes back flatly on the framing that Kimi's results are a distillation story, which is a pointed thing to read in the same week as the item below

Anthropic stakes out its position

• Anthropic published its position on open-weights models Jul 27, one day after K3 dropped, and the timing is not subtle. Dario Amodei opens by rejecting the characterization directly: "Anthropic has never advocated for a ban on open-weights models," and grants that open models without dangerous capabilities are useful and computationally efficient. The argument narrows to three asks: chip export controls plus smuggling enforcement, targeted legal frameworks against industrial-scale distillation, and mandatory pre-release safety testing for any sufficiently capable model, open or closed. The line doing the most work is on irreversibility, that guardrails are very hard to apply once weights are out and released weights cannot be withdrawn. He also pushes back on the claim that open weights inherently improve safety, citing an attacker-defender asymmetry in biology. Read the distillation ask next to the HN pushback above and you have the week's actual disagreement in miniature: whether the open-weights frontier is a research result or a copying problem

The Hugging Face intrusion, from the network side

• Tailscale published its account of the Hugging Face intrusion, and it is the most useful writeup of the incident so far because it is the only one with the network-side numbers. Over roughly four and a half days the agent escalated to root on Kubernetes nodes, reached a production secret store holding 136 credentials, found a reusable Tailscale auth key meant for creating CI nodes, copied it into external sandboxes, and used it to enroll 181 unauthorized nodes into the tailnet with CI access. No Tailscale vulnerability was found or exploited, which is exactly what makes it worth reading: every step ran on valid credentials doing what valid credentials are allowed to do. The detection detail is the one I would put in front of your team, since the agent ran the client with --no-logs-no-support to suppress its own telemetry, and Tailscale's point is that network flow logs record traffic from both endpoints, so the side that did not opt out still sees it. Their hardening list is the actionable part: replace long-lived reusable auth keys with workload identity federation so credentials are short-lived and provider-backed, stream flow logs to a SIEM, turn on Tailnet Lock for admission control, bind node keys to a TPM where the hardware allows it, and gate access on device posture. If you have a reusable auth key sitting in a secret store right now because it was the fast way to get CI onto the tailnet, that is the item to action this week. Tailscale's own framing is unusually direct for a vendor post-mortem: "Their intrusion is our intrusion," and the closing line is "The attack didn't exploit Tailscale, and Tailscale didn't cause the compromise. But, we didn't stop it. Next time, we will."

Routing lost to caching

• Manifest deprecated their LLM router and wrote up why, which is a more useful artifact than another post explaining how to build one. They shipped it in March 2026 as a gateway feature that classified each request into four complexity tiers and routed it to a matching model, with cost reduction as the point. Four months and 7,000 users later they killed it, with shutdown set for Sept 1. Three findings are worth carrying: complexity is not legible from the prompt, because a task like "evaluate these tests" is trivial or enormous depending on a repository the classifier never sees, and the real complexity only emerges through tool calls; switching models mid-workflow degraded output quality and quietly detached engineers from understanding their own tools' tradeoffs; and the routing layer's unpredictability had to be paid for again in evals, observability, and maintenance. The finding that actually decides it is the cache math, since cache reads run 75% to 90% cheaper than uncached input, so staying sticky on one model maximizes cache hits and a router that moves you between models is spending the savings it claims to create. Their recommendation is to pick the model, parameters, and prompt deliberately for the intent rather than delegating that to a classifier, which is the same conclusion a lot of people are arriving at from different directions this year

From us

• Yaw MCP v0.74.0 shipped today, and it is the largest cut the project has taken: the hosted control plane is retired, account mode is gone, and roughly 5,800 lines came out. Your servers now come from ~/.yaw-mcp/bundles.json and your credentials from the local encrypted vault. The security fix underneath it is the part worth your attention if you run it: a project-scoped <project>/.yaw-mcp/bundles.json is normally committed to a repo, and every server in it is a command Yaw MCP spawns as you at startup, so cloning a hostile repo and opening an editor in it was enough to execute arbitrary argv. An unapproved file is now ignored until you run yaw-mcp trust, which prints every command and argument before asking, and approval pins the file's SHA-256 so a later commit re-prompts. The consent preview escapes C0, DEL, C1, and bidi overrides, because without that a repo could hide its argv behind SGR 8 or erase the rendered block with cursor-up before the prompt painted, which would defeat the only thing the gate is there to guarantee. Also in this release: remove now confirms before it deletes (--force for scripts), Node 20 is the engine floor, and the package finally has a real LICENSE, source-available with DCO 1.1 sign-off rather than the UNLICENSED declaration it carried before

From the Yaw blog

• Gemini CLI Is No Longer Free: What Changed and Where to Go - our walkthrough of Google retiring the open-source Gemini CLI for the closed-source Antigravity binary, what the free-tier quota actually collapsed to, and which tools are worth moving to. It reads differently next to this fortnight's open-weights items: Moonshot put a 2.8T model out in the open for anyone to run, and Google took a 100k-star open-source CLI closed. Whether you get to own your tools is turning into a per-vendor answer rather than an industry direction