Five verified moves this week, and a team of one can act on each before the next one lands. The MCP deadline that's been on the calendar for months finally arrives Monday. A frontier model got a million-token window with no price tag attached. A near-frontier model you can run on your own hardware went fully open. The EU's chatbot-disclosure rule starts biting in six days. And the venture money kept concentrating at the top. Every item below is dated and sourced; each carries the one line that changes what you do next.
1. MCP goes stateless for real on Monday — audit your session code now#
The final 2026-07-28 Model Context Protocol specification publishes Monday, July 28 — the biggest revision since the protocol launched. It removes the initialize handshake and the Mcp-Session-Id header at the protocol layer, so any request can be served by any server instance. It also bundles an official Extensions framework, a six-part auth-hardening package (OAuth/OIDC issuer validation per RFC 9207), and — new — a formal deprecation policy that puts Roots, Sampling, and Logging on 12-month removal clocks (Model Context Protocol; The Register).
What it means: The deploy win is real — you can drop sticky sessions and the shared session store and run a remote MCP server behind a plain load balancer, which cuts infra cost and complexity. But it's a breaking change under the hood. Before you bump SDKs, audit anything that leans on session IDs or the newly-deprecated features. We walked through flipping a server stateless with old-vs-new code and what the stateless core actually breaks — this is the week to do it.
2. Claude Opus 5 ships with a 1M window at the old price — re-run your evals#
Anthropic shipped Claude Opus 5 around July 24. The headline for anyone building agents: a 1M-token context window as standard — no beta header and, as reported, no long-context price premium — at the same $5 per million input / $25 per million output as Opus 4.8, with a May 2026 knowledge cutoff and extended thinking on by default (MarkTechPost). It's already the default Opus in Claude Code.
What it means: Same price for a stronger agentic model, plus a free jump to a million tokens of context, is a straight upgrade on paper — the kind that rarely needs a migration budget. The discipline is the same as always: cheaper-or-equal per token is not the same as cheaper per result, so re-benchmark on cost per completed task for your actual workload before you flip a default, which is exactly why one benchmark number can lie to you.
3. Kimi K3's 2.8T weights go open — the self-host option just got serious#
Moonshot AI published full open weights and code for Kimi K3 on July 27 — a mixture-of-experts model reported at ~2.8 trillion parameters that activates roughly 16 of 896 experts per token, with native vision and a 1M-token context, under a modified-MIT-style license (with an attribution clause for very large deployments) (TechTimes). It first shipped in products and via API on July 16; this is the weights drop.
What it means: A near-frontier model you can self-host and fine-tune removes per-token API fees and keeps your data in your environment — the two constraints that actually push teams off closed APIs at scale. The caveat coverage flagged: undisclosed hallucination-rate details, so validate on your own tasks before production. If cost or data control is your binding constraint, this is the week to benchmark K3 against your closed default — which is exactly the call we break down in Claude Opus 5 vs Kimi K3: which model to put behind your coding agent.
4. The EU AI Act's disclosure rule starts biting August 2 — six days out#
The EU AI Act's Article 50 transparency obligations become enforceable August 2: a chatbot must disclose it's AI in the first exchange, emotion-recognition systems must notify users, and AI-generated or manipulated media must be labeled — with penalties reaching €15M or 3% of global annual turnover (Technology.org). It's extraterritorial: a US startup whose product reaches EU users is in scope.
What it means: This is the same shape as China's persona law that took companion agents offline — "tell the user it's an AI" is becoming a global default, not a regional quirk. The cheap, correct move is to add a plain AI-status disclosure and synthetic-media labeling now, before a market forces it on its timeline instead of yours.
5. AI took most of Q2's venture money — and it's tilting physical#
AI captured more than 70% of global Q2 2026 venture funding, and the week's biggest round went to Atoms, the physical-AI startup founded by Travis Kalanick, at a reported ~$1.7B led by Andreessen Horowitz (Crunchbase News). Smaller physical-AI and infra rounds landed alongside it.
What it means: The capital is concentrating at the top of the stack and increasingly in robotics and physical AI, with the large majority going to US firms. The read for a bootstrapped team is unchanged: you won't out-fund the incumbents, so the demand signal matters more than the round size. Pick a specific vertical or workflow wedge a well-funded generalist won't chase — the same logic that survives every funding wave.
Also this week: Claude Code kept up its near-daily cadence — beyond making Opus 5 the default, recent July releases added manual skill invocation (/verify, /code-review), independent filesystem-isolation control, and nested-subagent improvements (Releasebot). If you live in the terminal, the new review-and-verify commands are worth wiring into your loop this week.
