MCP removed its handshake and session state after reaching nearly half a billion monthly SDK downloads, turning agent tools into ordinary routable web infrastructure
The 2026-07-28 specification makes every request self-describing, routable through plain load balancers and cacheable at the catalog layer. TypeScript and Python have each crossed 1bn cumulative SDK downloads, so a breaking migration away from session IDs now changes production infrastructure rather than an experimental interface.
Close to half a billion downloads a month, and the protocol just deleted its session. It's Tuesday, July twenty-eighth, and MCP has learned to behave like the web.
The new Model Context Protocol retires its required initialize exchange and session identifier. Every request carries its protocol version, client identity and capabilities, so successive calls can land on different instances behind an ordinary round-robin load balancer.
Method and tool names now appear in headers, allowing gateways and firewalls to route, meter and authorize without parsing the request body. Tool and resource lists gain deterministic order and cache hints. Multi Round-Trip Requests carry approvals by returning an input-required result and retrying the original call.
The migration breaks teams that hid application meaning in session state. Roots, Sampling, Logging and the legacy HTTP plus server-sent-events transport get at least a twelve-month offramp. The TypeScript, Python, Go and C sharp SDKs support the revision now.
Microsoft and Wiz reported that their routed Atlas scanner found ninety-point-nine percent of CyberGym vulnerabilities and more than two hundred unknown flaws. Individual models stayed around eighty-three to eighty-six percent, while a cheaper model handled roughly ninety percent of Atlas traffic. Bot-detection company Spur raised two hundred million dollars as machines became the majority of internet traffic.
Alphabet raised its capital plan to one hundred ninety-five to two hundred five billion dollars. Google's own study of fourteen-point-six-five million workplace interactions says most AI use remains collaborative and full automation is uncommon. Count completed outcomes, not protocol traffic.
To the tape. We sharpen the Microsoft watch as routing becomes measured security work and Foundry gains a standard transport. We hold the Alphabet watch while the capital guide rises faster than public utilization evidence. The tape is the desk's scorecard, not advice.
Our call: by October thirty-first, a major security vendor releases a production scanner that routes discovery and verification across models and publishes above ninety percent on a named public benchmark. Internal demos alone prove us wrong.
Close to half a billion Tier 1 SDK downloads now happen in a month, and the protocol behind them just deleted its session. MCP's 2026-07-28 specification retires the required initialize exchange and the Mcp-Session-Id header. Each request carries its protocol version, client identity and capabilities, so it can land on any instance behind a plain round-robin load balancer without shared transport state. TypeScript and Python have each crossed 1bn cumulative downloads. A design decision inside an 18-month-old protocol now reaches an installed base measured like a mainstream web library.
That sounds like plumbing because it is. The earlier stateful design made a remote tool server behave unlike the web infrastructure teams already know how to operate. Sticky sessions, held-open streams and hidden connection state complicate scaling, failover and debugging. The new core moves durable application state into explicit handles that a model can pass between tools. A crashed server becomes another request to another instance, while the state the agent needs stays visible in the conversation and logs. Ordinary autoscaling and blue-green deployment become available without inventing a parallel control plane for agents.
Routing and caching move up a level with it. Method and tool names now travel in Mcp-Method and Mcp-Name headers, letting a gateway, rate limiter or firewall authorize and meter a call without parsing the JSON body. Tool, prompt and resource lists gain deterministic order plus ttlMs and cacheScope hints. Multi Round-Trip Requests handle approvals or missing input by returning an input_required result and retrying the original call, replacing several server-initiated requests that needed an open stream. The approval remains attached to the request that caused it.
The migration is genuinely breaking for teams that stored meaning in session identifiers. Roots, Sampling and Logging are deprecated, as is the legacy HTTP plus SSE transport, although the project promises at least a 12-month offramp. Dynamic Client Registration is also headed out in favor of client metadata documents. The security work includes RFC 9207 issuer validation and binding credentials to the authorization server that minted them, closing room for an authorization-server mix-up. Implementers get a year, but new servers should stop accumulating session-dependent behavior now under real production load.
The four Tier 1 SDKs for TypeScript, Python, Go and C# already support the revision. AWS says the stateless core is available in Bedrock AgentCore, Cloudflare supports it from day zero, and Microsoft Foundry is using MCP as the route from dozens of integrations to thousands. That distribution makes this more than a neat protocol correction. The useful test is operational: remove affinity from an MCP service, send successive tool calls to different instances, and verify that approval, authorization and explicit state still survive. If they do, agent infrastructure finally fits the same load balancer runbook as every other HTTP workload.
Microsoft and Wiz route security work across models and clear 90% on CyberGym
Microsoft and Wiz reported that the Atlas multi-model system found 90.9% of vulnerabilities on CyberGym and more than 200 previously unknown flaws, while Microsoft's MDASH reached 95.95% on its test. Individual models were closer to 83% to 86%. Atlas sends roughly 90% of work through a smaller model and escalates the difficult remainder, which the companies say halves cost. That is a useful mechanism: cheap triage, specialized review and proof before a result ships. Atlas remains an internal system rather than a product, however, and benchmark recall omits the operational price of false positives, duplicate findings and fixes that cannot be reproduced.
Spur raises $200m as bots become the majority of internet traffic
Bot-detection company Spur raised $200m from Insight Partners after automated traffic reportedly exceeded human traffic in mid-2026. Founded in 2017, the company classifies the networks and infrastructure behind requests rather than treating every unusual browser event as equivalent. Agent traffic makes that distinction harder and more valuable because a legitimate purchasing agent, a scraper using a residential proxy and credential-stuffing malware can all look automated while requiring different policy. MCP's named method headers help at the application layer, but public endpoints still need network reputation, identity and intent signals. The funding round prices a shift from blocking automation to deciding which machines are allowed to act.
Google raises its capital plan again while investors ask for the utilization line
Alphabet raised its 2026 capital-spending guide to $195bn to $205bn from $180bn to $190bn, adding another $15bn at both ends after an already aggressive build plan. The spending can be rational while contracted demand and cloud growth stay strong, but the disclosure still leaves the key operating number out: how much newly energized capacity is productively used. Revenue is a lagging proxy because reservations, construction and deployment arrive on different clocks. Builders should watch cloud margin, free cash flow and leased-capacity reliance together. A higher guide with stable margins says demand is absorbing the infrastructure; another increase alongside weaker cash generation says the queue is driving the plan.
Google's 14.65m-interaction study finds AI work is still collaboration more than automation
Google analyzed 14.65 million deidentified workplace AI interactions for its ATLAS research and found that most use remains collaborative, with full automation uncommon. That result is a useful counterweight to capital plans built around agents replacing whole workflows. Assistance can still justify substantial compute if it reaches enough workers, but the unit of value is often a draft, explanation or decision supported rather than a job completed. It also changes measurement. Seat activation and message volume say little about whether the system closes work. Teams should log completed outcomes, human corrections and elapsed time at the task boundary, especially as MCP makes tool calls easier to scale.
MCP's revision and Microsoft's security results both move intelligence out of a long-lived conversation and into explicit routing. The protocol now exposes method names to gateways, carries state in tool-visible handles and lets any instance serve the next request. Atlas sends most vulnerability work to a smaller model and escalates the remainder. Spur's $200m round prices the public-network version of the same problem: machines are now the majority of traffic, so infrastructure has to identify the job and authority behind each request. The operational gain is ordinary, which is why it matters. Stateless services can use standard load balancers, named calls can be metered, and task outcomes can be measured independently of a model session. Google's 14.65m-interaction study says most workplace use is still collaborative, so teams should resist equating more protocol traffic with more completed work. Migrate one MCP service without affinity, route by method, attach an outcome and cost to each call chain, and see whether the production system survives the abstraction.
By October 31, 2026, at least one major commercial code-security vendor will generally release an auditable production scanner that routes discovery and verification across multiple models and publishes a result above 90% on a named public vulnerability benchmark.
Microsoft and Wiz have shown a routed system crossing 90% while individual models remain several points lower, and the cheaper model handles about 90% of Atlas traffic. That creates a quality gain and a cost story a security vendor can sell together. MCP's header-level routing and stateless calls reduce the infrastructure novelty. The remaining work is productization: reproducible evidence, false-positive controls and a public result customers can inspect.
If October 31 arrives with Atlas still internal and no major vendor generally offering a multi-model routed scanner with a published score above 90% on a named public benchmark, the call is wrong.
We sharpen the Microsoft watch for a second day. Atlas and MDASH turn yesterday's model-routing argument into measured security work: more than 90% vulnerability recall, over 200 newly found flaws and a design that sends most traffic to the cheaper engine. MCP's stateless release also strengthens Foundry's integration layer. The missing piece is a sellable product with public false-positive and cost data.
Microsoft can combine model routing, identity and a widely adopted tool protocol inside Foundry. The internal scores are strong, but commercial value depends on packaging the system and proving that benchmark gains survive production repositories.
We hold the Alphabet watch. The new $195bn to $205bn capital guide expands the cash-flow concern from July 24, while the ATLAS study supplies a sober demand measure: 14.65m interactions still skew toward collaboration rather than complete automation. Assistance at Google scale can fill infrastructure, but the company must show productive utilization before another guide increase turns contracted demand into a perpetual construction explanation.
The capex range rose by $15bn at both ends, while Google's own evidence says workplace AI remains mostly collaborative. Cloud growth and backlog can justify the build if margins and cash conversion hold.