AI Coding News: July 28, 2026 — Model Context Protocol Ships Its Final 2026-07-28 Spec
Today's biggest story in AI-assisted development isn't a new model or a CLI release — it's plumbing. The Model Context Protocol, the open standard that lets Claude Code, Cursor, GitHub Copilot, Codex CLI, and Gemini CLI all talk to the same universe of tools and connectors, finalized its largest specification revision since launch. Alongside it, OpenCode (now Anomaly) shipped three point releases in two days with fixes aimed squarely at MCP server compatibility. Here's what changed and why every AI coding tool you use is about to feel it.
MCP's 2026-07-28 Spec: Stateless Core, Extensions, and MCP Apps
The Model Context Protocol project finalized its 2026-07-28 specification today, locking in changes first proposed as a release candidate back in May. The headline change is that MCP drops its stateful initialize handshake and the Mcp-Session-Id header in favor of a fully stateless core: client metadata now rides along in _meta fields on every request, so a remote MCP server that used to need sticky routing and a shared session store can run behind a plain round-robin load balancer instead.
Three other pieces graduate or ship in this release. An Extensions framework moves capabilities like Roots, Sampling, and Logging out of the protocol core and into independently versioned, reverse-DNS-namespaced extensions with their own repos and maintainers. MCP Apps lets a server ship a server-rendered HTML interface that hosts display in a sandboxed iframe, with UI templates declared up front so a host can prefetch, cache, and security-review them before anything executes — and any action a user takes in that UI routes back through the same audit path as a normal tool call. And the Tasks feature for long-running operations is redesigned around the stateless model: a server answers tools/call with a task handle, and the client drives progress with tasks/get, tasks/update, and tasks/cancel.
On the security side, six SEPs harden OAuth/OpenID Connect alignment: mandatory iss parameter validation per RFC 9207, explicit application_type declarations at registration, and issuer binding for credentials — all aimed at closing token-confusion attacks across multi-server MCP setups. A new formal deprecation policy also takes effect, with features moving through Active, Deprecated, and Removed states and a minimum twelve-month window before anything deprecated is actually pulled. Tier-1 SDKs (including the official TypeScript and Python SDKs used by most coding agents) have a ten-week window to catch up, so expect Claude Code, Cursor, and every other MCP client to start rolling out compatibility updates through the rest of Q3.
OpenCode/Anomaly Ships v1.18.6–v1.18.8 With MCP and OAuth Fixes
OpenCode — recently rebranded to Anomaly — pushed three releases in two days. v1.18.6 and v1.18.7 (July 27) fixed a branch-specific repository cache bug, restored provider-list refresh after OAuth completion, removed an extra titlebar inset in macOS fullscreen, stopped stale command palette entries from reappearing, and added scrolling to a long project-selector dropdown. Today's v1.18.8 release is the one worth watching alongside the MCP news: it specifically improves compatibility with newer MCP servers and OAuth flows, adds reconnection after an expired SDK session, and refines the desktop app with a project-selector shortcut, better tab navigation, and more reliable provider-connection state refresh. See the full history on the Anomaly releases page.
GitHub Copilot: Enterprise Admin Controls Tighten Up
GitHub's changelog was quieter on the developer-facing side today, but it shipped a cluster of enterprise admin updates: a dedicated policy for managing Copilot app access, enterprise managed settings extended to the Copilot app and Copilot's cloud agent, and improved OpenTelemetry configuration and model management for Copilot in JetBrains. None of this changes daily usage for an individual developer, but it matters if your org is rolling Copilot out at scale and needs to control which client apps and models teams can reach.
Quiet on the Model Front
Claude Code has stayed at 2.1.220 since July 25, Codex CLI is still on 0.145.0 from July 21, and Cursor hasn't shipped past its July 22 Router rollout. That's expected after a run of major releases (Opus 5 as default, Codex Remote GA, Cursor's model router) — and with MCP's spec now locked, the next moves from all three are likely to be compatibility updates for the new stateless transport rather than net-new features.
Why This Matters
If you build or run MCP servers for Claude Code, Cursor, or any other agent, today's spec finalization is the thing to plan around, not the daily model shuffle. The stateless core removes real infrastructure cost (no more session-affinity load balancers), but the migration off the experimental Tasks API and the OAuth hardening are breaking changes that need a deliberate upgrade — you have roughly a quarter before Tier-1 SDKs fully catch up. Practical next step: audit any custom MCP servers you run for session-ID dependence and experimental Tasks usage, and if you use OpenCode/Anomaly, update to v1.18.8 now since it's already tracking the new MCP server behavior.
Sources & Further Reading
Comments
Share your thoughts and join the conversation
Leave a Comment
Keep reading.
Daily Dev Stack Release Audit — July 28, 2026: Redis, MongoDB, and Nuxt Rush Out Critical Security Patches
Daily Dev Stack Release Audit — July 27, 2026: Node.js, Redis, and Next.js Rush Out Critical Security Patches
