Your MCP servers have a deadline

Hey there 👋

Happy long weekend. If you’re reading this with one eye on the grill, I’ll keep it to a single idea.

I went back through everything that shipped this week, and every story was secretly the same story. Not “look what the agents can do now” — that question is settled. The new question, the one the money and the tooling and the protocol are all racing to answer, is who controls the agents, and who is accountable when they act.

The plumbing is hardening its locks. The funding is buying human supervision. The fleet tools are naming your CLI agents as things to police. And the model vendors are handing admins a spend cap. Oversight stopped being the footnote. This week it became the product. Let’s walk it.

The Big Thing

MCP goes stateless — six breaking changes land July 28

If your agents talk to tools through MCP, block an hour this weekend to read one spec. The 2026-07-28 release candidate is the biggest revision the protocol has had, and it is a breaking one.

The headline change: MCP is going stateless at the protocol layer. The RC removes the Mcp-Session-Id header, the initialize handshake, and the sticky-routing requirement in one sweep (SEP-2567). Protocol version, client identity, and capabilities now ride in a _meta object on every request, so any server instance can answer any call. tasks/list is gone because it cannot be scoped safely without sessions, and anyone who built against the 2025-11-25 experimental Tasks API has to migrate.

Alongside that, six SEPs harden authorization to match how OAuth 2.0 and OpenID Connect actually get deployed. The one to circle: clients must now validate the iss parameter on authorization responses per RFC 9207 (SEP-2468) — a cheap fix for a mix-up attack that is more likely in MCP’s one-client-many-servers world. Tasks and MCP Apps move into a new reverse-DNS Extensions framework instead of living in the core.

The third-thought read: file this under “annoying migration” and you miss the gift. Stateless is what lets MCP grow up. No sessions means no sticky sessions — your MCP servers can finally sit behind a plain load balancer and scale horizontally like any other stateless web service. The teams quietly duct-taping session affinity to survive real traffic just got handed the right architecture. You pay for it once, in migration work, and then it is the boring, scalable default.

Why this is a long-weekend job and not a Monday fire drill: the RC was locked May 21 and the final publishes July 28. Nothing you fix against the RC will move under you. So the move this weekend is not to rewrite — it is to audit. Pull your production MCP servers, grep for session assumptions, list anything reading Mcp-Session-Id or leaning on the handshake, and check whether your auth validates iss yet. Turn the scramble into a planned sprint.

Ship it? The stateless model — adopt it; it is the direction of travel and it makes your servers scalable. The migration — start the audit now, finish before the 28th. If you shipped anything against the experimental Tasks API, that is your highest-priority line item. The RC announcement · the auth changes explained.

Sources: Model Context Protocol blog, WorkOS, Stacktree — spec details are the MCP project’s own.

Tour de Headlines

🏭 Chamath’s software factory raised $135M to supervise the agents, not replace you. 8090 Labs closed a $135M Series A led by Salesforce Ventures, with Craft Ventures and a roster of operator angels — and Chamath Palihapitiya stepped in as full-time CEO. The pitch is not “agents write your enterprise software.” It is a governed, multiplayer software factory where coordinated agent teams do the work and humans supervise the loop. The third-thought: this is a bet that agent oversight is a fundable category on its own, not a feature bolted onto a coding tool. When a marquee investor takes the CEO seat on “humans in the loop,” that is the market telling you where the value moved. SiliconANGLE.

🧑‍💻 HP turned on OpenAI agents across the company — and led with the guardrails. HP and OpenAI announced Frontier, one of the first genuinely at-scale enterprise agent rollouts. The proof points travel: one engineer shipped 122 pull requests across 43 projects; a security team closed in a day what used to take a month. But read past the demo numbers — HP framed the whole thing as a governed operating model: shared context, scoped permissions, agents working inside existing controls rather than a free-for-all. That is the part your board wants to see: a named, on-the-record deployment you can point to. CIO Dive.

🛡️ Your CLI coding agents just became the thing security has to inventory. Jamf launched AI Governance, an OS-level control plane for Mac fleets that discovers and applies policy to AI tools — with day-one support for Claude Code, Claude Desktop, and OpenAI Codex by name. The reframe worth sitting with: the CLI agents you told engineering to adopt are now the shadow-IT problem security has to find and govern. Jamf’s own survey (vendor-commissioned, so weight it accordingly) claims orgs with deeply integrated AI are 40% more likely to report an incident. Whatever the exact number, the pattern is real — adoption ran ahead of control, and the control layer is now shipping at the OS. ITBrief.

Tool of the Day

📐 Dawnguard

A shared workspace that checks your system design is secure before you build it — then keeps checking that production still matches the plan.

Most security tooling shows up after the code does. Dawnguard — now GA — moves it left: you design the architecture in a shared workspace, it validates the design against security requirements before anything ships, generates the infrastructure-as-code, then continuously watches for drift between the approved design and the live environment. Secure-by-design, in their framing — but the useful bit for us is the loop: design → validate → generate → detect drift.

If you are standing up agent infrastructure fast — new MCP servers, new service accounts, new scoped permissions every week — this is the discipline that keeps the architecture honest as it sprawls. A pilot-first, low-commitment way to answer “does what we are running still match what we approved?” — which, given everything else in this issue, is the question of the week.

Read the Dawnguard launch →

Worth a Click

• Anthropic gave Claude Enterprise admins a spend cap and cost alerts. New controls (July 3): per-group spend caps at every level, model-level entitlements so routine work does not default to the priciest model, spend-threshold alerts at 75% and 90%, cost-by-user and cost-by-group analytics, and an Admin API to script it all. FinOps for agents, from the model vendor. Read the Claude Enterprise update.
• Microsoft nailed down what agents cost in a Microsoft shop. As of July 1, the permanent “Business with Copilot” SKUs hit GA and Agent 365 now requires E5 — the dry-but-decision-relevant plumbing that fixes what it costs to roll agents across a Microsoft estate. Worth ten minutes before you budget H2. See the July partner announcements.
• A clean template for compliance-first vertical agents. Candidly expanded its Intelligence Center with six configurable financial-guidance agents, shipped over MCP/API and pitched as “deterministic” infrastructure for regulated advice. The fintech specifics matter less than the build pattern: composable, deterministic, delivered as MCP — a shape that travels well past benefits and payroll. Read the Candidly announcement.

The agent of the week is not an agent — it is the leash. Line it up: MCP hardening its auth, 8090 raising nine figures on human supervision, Jamf inventorying your CLI agents, Anthropic capping the spend. The question flipped from can it do the work to who is holding the leash. Your long-weekend move is not to deploy another one. It is to find the agent already running in production without an owner — and give it one.

See you tomorrow,
— The Agent Stack