Eversynced AI Weekly - July 27, 2026

Your Monday briefing on AI that matters for developers.

Issue #7 - July 20 - July 26, 2026.

This Week’s Big Move

MCP goes stateless tomorrow. The 2026-07-28 spec finalizes Tuesday, and it’s the largest breaking change since the protocol launched. Sessions and the handshake are gone (SEP-2575, SEP-2567), replaced by stateless requests that carry identity and capabilities in a _meta field. There’s a new mandatory server/discover method, plus new Mcp-Method and Mcp-Name headers. Roots, Sampling, Logging, Dynamic Client Registration, and the old HTTP+SSE transport all get deprecated, though they keep working. Anthropic’s David Soria Parra confirmed a 12-month minimum deprecation window on the launch livestream. Nothing breaks Tuesday morning.

The migration cost depends entirely on one thing: whether you built on an official SDK. If you did, update the dependency and you’re mostly done, since the new Python, TypeScript, Go, and C# releases are backward and forward compatible. TypeScript users get a codemod (npx @modelcontextprotocol/codemod@beta v1-to-v2 .). But if you hand-rolled the transport, estimates put the work at 6 to 12 weeks, because removing sessions touches your whole request lifecycle. Stacklok’s readiness guide also warns that interop with legacy clients isn’t guaranteed, so plan for a period where you support both shapes.

Two extensions graduate alongside the spec, and they matter more than the plumbing. Tasks becomes official, giving async long-running agent work a home in the protocol instead of in everyone’s custom polling hacks. And MCP Apps introduces sandboxed iframe UIs, so a server can ship an interface rather than a bag of tools. GitHub shipped support in MCP Server 1.7.0 five days early, which makes it the reference implementation to read before you touch your own. (The Register covers why the change happened.)

Tools & Agent Updates

GitHub MCP Server 1.7.0 - Stateless spec support, shipped ahead of the deadline. You get faster connection setup and parallel round-trip requests instead of serialized ones, plus Extensions support (MCP Apps, Enterprise Managed) already wired into VS Code. It also adds server-to-server GitHub App auth over stdio and better Projects pagination. Upgrade for the parallel requests alone.

Cursor Router - Auto mode now analyzes each request and picks the model itself, with three optimization modes: Intelligence, Balance, Cost. Admins get the controls that make it useful. Teams can enable or disable the router, restrict which modes people can pick, and allow or block specific underlying models. That turns “which model is my team burning budget on” from a guess into a policy.

Vercel Agent - Now lives in the dashboard and can investigate production issues, answer questions about your projects, and take approved actions. Read-only by default. Reachable from the dashboard, GitHub, and the CLI. Same shape everyone’s converging on: an agent with real access to your telemetry, gated behind explicit approval before it writes anything.

Project Perception - Microsoft’s new agentic security platform, running on MAI-Cyber-1-Flash, its first in-house cyber model. Agent teams reason across your data, tools, and workflows to find and patch vulnerabilities on an ongoing basis. Microsoft claims parity with leading models at half the cost, which deserves the usual skepticism until someone independent runs it. The shape is what to watch: a standing agent team pointed at your codebase, not a scanner you invoke.

Four Flagships in Seven Days

Every major lab shipped this week, and two of last issue’s open questions closed:

• Claude Opus 5 - Landed July 24, so the Honeycomb rumors we tracked in issue 6 resolved, and they resolved fast. Anthropic’s new Opus tier targets long-running agents, with gains in coding and professional work. Axios puts it near Fable on many tasks at roughly half the cost.
• Kimi K3 open weights - Moonshot shipped full weights for the 2.8T model today, exactly the date they promised, no waitlist. 1M token context, native vision, Kimi Delta Attention. Largest open-weight release anyone has shipped.
• Gemini 3.6 Flash, 3.5 Flash-Lite, 3.5 Flash Cyber - Three Flash-tier models on July 21, with 3.6 Flash as the new workhorse. Gemini 3.5 Pro is still in testing and still didn’t ship, which is now two issues running.
• KAT-Coder-V2.5 - Kuaishou’s agentic coding model, trained inside 100,000+ real executable repos instead of on single-turn code generation. Open-weight Dev variant on Hugging Face, Apache 2.0.
• DeepsecBench - Vercel’s new benchmark scoring how well models find security vulnerabilities in application code, across GPT-5.6 Sol, Opus 5, Kimi K3, and Grok 4.5. It exists because a reduced-guardrail model test reached Hugging Face’s production database, which OpenAI and Hugging Face addressed jointly.

Four frontier releases in seven days, and none of them changes how you build. A year ago a new Opus tier meant rewriting prompts and re-tuning your stack. This week it means changing a model string and re-running your evals. The cadence has outrun anyone’s ability to migrate for each launch, so the teams doing well stopped trying. DeepsecBench is the template: pick the capability you actually depend on, score every model on it, re-score when something ships.

What This Means for You

What Matters

• Check your MCP SDK version this week. That single fact decides whether tomorrow is a dependency bump or a quarter of work. If you’re on the official Python, TypeScript, Go, or C# SDK, update and move on. If you wrote your own transport, scope the sessions removal now, because 12 months sounds generous right up until it isn’t. The Scalekit walkthrough is the clearest of the explainers, told through one example integration.
• Tasks and MCP Apps change what a server can be. Async long-running work and sandboxed UIs were both things you previously bolted on yourself. If you shelved an agent feature because the protocol couldn’t express it, pull it back off the shelf.
• Kimi K3 weights landed today, exactly when Moonshot said they would. We said in issue 6 to have an eval harness ready for July 27. If you did, run it this week. Hosted endpoints will start undercutting each other within days.
• Turn on Cursor Router if you manage a team seat. Most teams pay frontier prices for requests a mid-tier model handles fine, and until now there was no lever for that beyond asking people nicely.

What’s Noise (for now)

• Project Perception benchmark claims. “Half the cost at comparable performance” is a vendor number on a vendor model, one week old. The category is interesting. The scoreboard isn’t settled.
• Kimi K3 coverage quality. The technical breakdowns circulating this week are community writeups on DEV, not a primary Moonshot paper. The weights are on Hugging Face and verifiable. Treat the benchmark tables in those posts as secondhand until the model card catches up.
• The open-weights policy fight. Anthropic published its position and the US is reportedly reconsidering restrictions on foreign open models. Nothing has changed about what you can download today. Watch it, don’t plan around it.

Our Take

The MCP change is the rare breaking change that’s clearly correct. Sessions made scaling awkward, forced sticky routing, and gave every server author a state machine they didn’t want. Stateless requests fix that, and the 12-month window means you get to migrate on your schedule instead of theirs. Do the SDK check this week and the rest can wait.

Tasks and MCP Apps are the part of this release nobody will write about, and they’re the part that changes what you can ship. Every team building agents has hand-rolled the same two things: a polling scheme for work that outlives a request, and a bolted-on UI because tools could only return text. Both now belong to the protocol. So the servers you write after Tuesday can do things the servers you wrote in June structurally could not, and the migration cost buys you that rather than just buying you compliance. Read the GitHub implementation, then go look at whatever you shelved because MCP couldn’t express it.

Quick Links

• Anthropic’s position on open-weights models - Dario Amodei says they never asked for a ban, as the US weighs restricting Chinese open weights
• Safety and alignment in an era of long-horizon models - OpenAI on what broke internally once models started running for hours instead of seconds
• Introducing OpenAI Presence - Enterprise product for deploying agents across customer and internal workflows
• POCKET: a 35B model that runs on your iPhone - On-device inference at a parameter count that seemed implausible last quarter
• Nunchaku 4-bit diffusion inference in Diffusers - Faster, lower-memory diffusion, now a one-line integration
• Self-hosting an open model for cyber defense - Keeping security workloads off third-party APIs, with the config to do it

Glossary

Stateless protocol - A design where every request carries everything the server needs to handle it, with no memory of prior requests. The upside is that any server instance can answer any request, so you scale by adding boxes instead of managing sticky sessions.

SEP (Specification Enhancement Proposal) - The MCP process for proposing protocol changes, similar to Python’s PEPs. SEP-2575 and SEP-2567 are the two that removed sessions.

server/discover - The new mandatory method that replaces the old handshake. A client calls it once to learn what a server offers, instead of negotiating capabilities during session setup.

Tasks extension - Now-official MCP support for work that outlives a single request. An agent kicks off a long job, gets a handle back, and polls or subscribes for the result rather than holding a connection open.

MCP Apps extension - Lets an MCP server ship a sandboxed iframe UI alongside its tools. Instead of returning JSON for the model to describe, a server can render an actual interface the user interacts with.

Codemod - A script that rewrites source code automatically to match a new API. The MCP one handles the mechanical parts of the v1 to v2 migration, though it won’t fix custom transport logic.