Welcome to the daily AI news brief for vibe coders. It is Wednesday, July 29, 2026, and the protocol layer just had its biggest day in over a year. The Model Context Protocol shipped its 2026-07-28 spec with a stateless core, Anthropic began rolling out support across Claude, major cloud platforms backed it at launch, and OpenAI open-sourced a security scanner you can drop into any repo. If you build on Shopify, Claude, GPT, Gemini, or Firebase, today is about how you host your tools and keep them safe.
TL;DR
- MCP shipped the 2026-07-28 spec with a stateless request/response core.
- Stateless MCP servers now run on serverless and edge, no session storage.
- Claude support is rolling out; its directory lists over 950 MCP servers.
- AWS, Cloudflare, Google Cloud, and Netlify backed the spec at launch.
- OpenAI open-sourced an Apache-2.0 Codex Security CLI for repo scans and CI.
- Nvidia formed an open AI security alliance after the Hugging Face breach.
MCP ships the 2026-07-28 spec with a stateless core
What shipped. The Model Context Protocol released its fifth spec version, 2026-07-28, and the headline is a stateless core: MCP moves from a bidirectional protocol to a request/response model. It retires the initialize handshake and the session-ID header, so any request can land on any server instance behind a plain load balancer. It also adds Multi Round-Trip Requests for mid-call input, header-based routing, cacheable list results, and hardened authorization, with updated TypeScript, Python, Go, and C# SDKs (Model Context Protocol).
Why it matters for vibe coders. Session state was the hardest part of self-hosting an MCP server. Removing it means your tools run on the serverless and edge infrastructure you already use, scale horizontally, and survive reconnects without shared storage. Cheaper, simpler, more reliable.
What to do today. Pin one MCP server or client to the new SDK on a branch. Read the migration notes, and if you leaned on session IDs, plan the swap to explicit tool-minted handles.
Anthropic brings MCP 2026-07-28 to Claude
What shipped. Anthropic says the new spec is live and support is rolling out across Claude products. Its connectors directory now lists over 950 MCP servers used by millions of people. The company also highlighted MCP Apps for inline interactive UI, enterprise-managed auth that provisions connectors org-wide through an identity provider, an observability dashboard for connector developers, and MCP tunnels in research preview for private-network servers (Claude).
Why it matters for vibe coders. If you publish a connector, a bigger directory plus an observability dashboard means real distribution and real debugging. Tunnels let you wire an internal tool into Claude without exposing a public endpoint, which is exactly what a solo builder needs for private data.
What to do today. If you maintain a connector, open the observability view and check adoption and errors. Then prototype one MCP App so users can act on your tool inline.
MCP 2026-07-28 lands day-zero across major platforms
What shipped. Platform support arrived with the spec, not months later. AWS added the stateless core to Amazon Bedrock AgentCore and contributed the Tasks extension for long-running agents. Cloudflare’s Agents SDK supports the spec from day zero in Workers. Netlify, Google Cloud, and FastMCP 4.0 also shipped support at launch (Model Context Protocol).
Why it matters for vibe coders. You no longer need bespoke infrastructure to host a production MCP server. Pick a platform you already pay for and deploy a stateless server on it. The plumbing that used to gate solo builders is now a managed feature.
What to do today. Deploy a hello-world stateless MCP server on Workers, AgentCore, or Netlify. Confirm it answers requests without sticky sessions, then point Claude at it.
OpenAI open-sources a Codex Security CLI
What shipped. OpenAI published a Codex Security CLI and TypeScript SDK under an Apache-2.0 license on GitHub. It scans repositories, validates suspected flaws, generates patches, tracks findings across runs, and adds security gates to CI/CD, installable with npm install @openai/codex-security. OpenAI calls it an early build and is actively asking for feedback (OpenAI on GitHub).
Why it matters for vibe coders. Free, scriptable security scanning is the kind of tool a one-person storefront never got around to adding. Wiring it into CI catches injection bugs and leaked secrets before they reach production, which matters more than ever after an autonomous agent breach.
What to do today. Install the CLI and run one scan on your most exposed repo. Add a non-blocking CI step first, triage the findings, then promote the highest-severity checks to blocking.
Also worth noting
- Nvidia launched the Open Secure AI Alliance, with more than 40 organizations building open AI cyber-defense tools after the recent breach. OpenAI, Google, and Anthropic are absent (Nvidia).
- Hugging Face published a forensic timeline of the July 9-13 OpenAI agent intrusion, reconstructing roughly 17,600 attacker actions, a sharp reminder to scope agent permissions tightly (Hugging Face).
- The FCC moved to bar US imports of new Chinese humanoid and quadruped robots plus connected power inverters, framing it as protecting the AI supply chain (Yahoo Finance).
Build of the day
Add an automated security gate to one repository using OpenAI’s new Codex Security CLI. Install it with npm, run a scan locally, then add a CI step that scans every pull request and posts the results. Keep it advisory at first so false positives do not block merges, then flip the highest-severity rules to blocking. It is a two-hour change that gives every future push a security pass.
FAQ
What is the MCP 2026-07-28 spec?
It is the fifth version of the Model Context Protocol, and its defining change is a stateless request/response core that replaces the old bidirectional, session-based model. It also adds Multi Round-Trip Requests for mid-call input, header-based routing, cacheable list results, hardened authorization, and a formal extensions framework, with updated Tier 1 SDKs (Model Context Protocol).
What does a stateless MCP server mean for hosting?
It means each request carries everything the server needs, so requests can land on any instance behind a round-robin load balancer without shared session storage. That lets MCP servers run on serverless and edge platforms and scale horizontally, which is far cheaper and more reliable than holding open bidirectional connections (Model Context Protocol).
Do I need to rewrite my MCP server for the new spec?
Not from scratch. The TypeScript, Python, Go, and C# SDKs already speak the new spec, and a Rust SDK is in beta. Migration cost is mostly for servers that relied on session identifiers, and Dynamic Client Registration is deprecated in favor of client metadata documents, with a twelve-month support window to plan the change (Model Context Protocol).
How is Claude supporting the new MCP spec?
Anthropic says support is rolling out across Claude products, whose connectors directory now lists over 950 MCP servers. The company also called out MCP Apps for inline interactive UI, enterprise-managed auth through an identity provider, an observability dashboard for connector developers, and MCP tunnels in research preview for private-network servers (Claude).
What is OpenAI’s Codex Security CLI?
It is an open-source command-line tool and TypeScript SDK, released under Apache-2.0, that scans repositories, validates suspected flaws, generates patches, tracks findings across runs, and adds security gates to CI/CD. You install it with npm install @openai/codex-security, and OpenAI describes it as an early build that is soliciting feedback (OpenAI on GitHub).
Does any of this help a Shopify store built with AI?
Indirectly, and usefully. A stateless MCP core makes it cheaper to self-host the tools behind a storefront assistant, such as product lookups or support triage, on infrastructure you already run. The open-source security CLI gives that same store a way to scan its code before deploy. Test any customer-facing agent before you ship it.
Sources
- Model Context Protocol — The 2026-07-28 Specification: https://blog.modelcontextprotocol.io/posts/2026-07-28/
- Claude — Bringing MCP 2026-07-28 to Claude: https://claude.com/blog/bringing-mcp-2026-07-28-to-claude
- OpenAI — Codex Security CLI (GitHub): https://github.com/openai/codex-security
- Nvidia — Open Secure AI Alliance: https://blogs.nvidia.com/blog/open-secure-ai-alliance/
- Hugging Face — Agent intrusion technical timeline: https://huggingface.co/blog/agent-intrusion-technical-timeline
- Yahoo Finance — FCC move on Chinese robots and inverters: https://finance.yahoo.com/news/exclusive-trump-administration-ban-chinese-183301640.html
About the author
Robert McCullock runs Design Delight Studio, an eco-focused DTC brand, and builds AI-assisted commerce tooling on Shopify, Claude, and Firebase. See his work and background in his professional portfolio.