Tuesday, July 28

The signal

1. MCP 2026-07-28 spec ships today: stateless core, Tasks, MCP Apps What happened: The Model Context Protocol final spec (and release candidate) landed today, dropping the initialize handshake and Mcp-Session-Id entirely, redesigning Tasks as a first-class async extension, adding MCP Apps for interactive HTML UIs rendered inline in clients over the same JSON-RPC path, and hardening auth with six security enhancements (including iss field validation per RFC 9207). Why it matters: Any existing MCP server using the session handshake needs migration; Tasks and MCP Apps unlock async work patterns and rich UI that agent frameworks will start building on immediately. Confidence: Confirmed Sources: MCP Blog (primary) · WorkOS auth analysis (independent) · AAIF migration guide (independent)

2. Kimi K3 weights live: 594GB MXFP4, vLLM day-0 KDA, llama.cpp still pending What happened: Moonshot AI dropped Kimi K3 weights on Hugging Face on July 26 (one day ahead of the July 27 target). Together AI and Modal had day-0 cloud hosting. vLLM shipped full KDA (Kimi Delta Attention) support with fused decode, MXFP4 MoE execution, and prefix caching. llama.cpp has early community groundwork but KDA kernels are not yet merged. Why it matters: The largest open-weight model ever (2.8T params, ~50B active) is now self-hostable via vLLM on a real cluster; the llama.cpp gap means edge/desktop inference is weeks out at minimum. Confidence: Confirmed Sources: Startup Fortune (independent) · vLLM day-0 blog (primary) · llama.cpp discussion (community) · natolambert open-weights escalation (independent)

Since last brief

• Claude Opus 5 launched July 24: matches Fable 5 on most benchmarks at $5/$25 per million tokens (same price as outgoing Opus 4.8); adds effort-level toggle (low/medium/high) to trade compute for cost; now default on Claude Max and strongest model on Claude Pro. Axios · Fortune
• Nvidia open-weights letter hit 50 signatories: jensenhuang’s first X post launched 25 signatories July 24; OpenAI and Google added their names by July 25. darioamodei’s Anthropic and Amazon stayed off every version – the clearest public policy divergence yet between Anthropic and the rest of the frontier pack. Forbes · CNBC · Startup Fortune on Anthropic’s silence
• AI Kill Switch Act introduced July 23: bipartisan bill (Reps. Lieu and Moran) gives DHS authority to throttle or fully shut down AI systems at companies with $500M+ in AI revenue; fines up to $20M/day for non-compliance; mandates cyber incident reporting and forensic preservation. No Senate companion yet. CNBC · Washington Times
• EU AI Act high-risk deadline pushed to December 2027: European Parliament voted to delay high-risk AI obligations; Council must publish the Digital Omnibus in Official Journal for the delay to take legal effect. GPAI/Article 50 transparency enforcement still starts August 2 as originally scheduled. Gibson Dunn · ComplianceHub

Models & research

Claude Opus 5

Claim: Matches Fable 5 performance on most benchmarks; priced at $5/$25 per million tokens (input/output); effort-level toggle (low/medium/high) trades cost for capability. Evidence: Anthropic announcement; Axios and Fortune coverage confirm pricing and positioning. No independent benchmark leaderboard entry published as of this writing. Caveat: “Matches Fable 5 on most tasks” is a company claim without a reproducible third-party eval. Benchmark coverage is selective until the community runs its own suites. Worth your time: Read. If the performance claim holds up, this halves the cost of near-frontier reasoning. Test on your actual workloads before migrating. Axios

Kimi K3 open weights

Claim: 2.8T-parameter MoE (16-of-896 experts, ~50B active), 1M context, native vision, MXFP4 native quantization, open weights on Hugging Face (594GB download). Evidence: Weights live on Hugging Face; vLLM day-0 KDA support confirmed with production performance numbers; Together AI and Modal hosting day-0. llama.cpp kernel work in community thread but not merged. Caveat: MXFP4 is non-standard. Consumer and CPU inference is not viable yet. Full independent quality eval not yet published against the self-hosted weights. Worth your time: Read. Pull from Together or Modal to evaluate; download only if you have the cluster. Watch llama.cpp#26041 for desktop inference ETA. vLLM blog · Kimi blog

Tools worth touching

MCP 2026-07-28 spec

• Does: New stateless MCP protocol – no session ID, redesigned Tasks extension for async work, MCP Apps for inline HTML UIs, hardened auth
• Why now: Spec drops today; existing servers using Mcp-Session-Id need migration before clients adopt the new version
• Try if: You maintain any MCP server or build agent orchestration on MCP primitives
• Skip if: You are a pure MCP client consuming existing servers and have no server-side code
• Links: spec RC · migration guide · auth changes

alibaba/open-code-review

• Does: LLM code review combining deterministic pipelines with LLM agents; produces line-level PR comments with built-in security rulesets; supports OpenAI and Anthropic backends
• Why now: 979 stars on GitHub trending today; drops between static analysis and pure LLM-only review
• Try if: You want automated security-aware code review on PRs without a hosted product dependency
• Skip if: You already have a mature code gate; Go-based setup has non-trivial config overhead for non-Go teams
• Links: github.com/alibaba/open-code-review

vLLM with Kimi K3 KDA support

• Does: Production-scale serving of Kimi K3 with native KDA prefix caching, fused decode kernels, and MXFP4 MoE execution
• Why now: Only viable self-hosted path to K3 right now; llama.cpp alternative is weeks out
• Try if: You run H100-class hardware and want to evaluate near-frontier open weights in a controlled environment
• Skip if: You lack the cluster footprint; consumer GPU stacks cannot run this yet
• Links: vLLM day-0 blog · self-host guide

Moves on the board

Other

• GitHub trending: bradautomates/claude-video (434 stars today) extends Claude with video frame extraction, audio transcription, and visual analysis – useful reference architecture for multimodal pipeline work. github.com/bradautomates/claude-video

Watchlist

• Kimi K3 llama.cpp KDA kernel work: preliminary discussion open at ggml-org/llama.cpp#26041; KDA not yet implemented; no merge timeline (opened 2026-07-23)
• OpenAI ExploitGym / Kill Switch Act: bipartisan bill introduced July 23 with DHS throttle/shutdown powers proposed; no Senate companion yet; AISI cross-lab cheating investigation outcome still pending (opened 2026-07-23)
• TRAINS August 1: 4 days out; Meta still absent; White House pressing directly; enforcement posture for holdouts still unspecified (opened 2026-07-25)
• EU AI Act August 2: GPAI/Article 50 enforcement goes live; high-risk delay to Dec 2027 requires Council publication of Digital Omnibus to take legal effect (opened 2026-07-26)