Twelve months or six weeks, the deprecation window is the positioning now

MCP grew up, and “we speak MCP” stopped being a pitch

The 2026-07-28 spec (opens in a new tab) is the protocol’s largest revision since launch. The core goes stateless: no initialize handshake, no session ID, any server instance can answer any request, which makes an MCP server an ordinary HTTP workload you can run on serverless or the edge. Auth hardens (RFC 9207 issuer validation, Client ID Metadata Documents replacing Dynamic Client Registration). And a stack you may be running, the old HTTP+SSE transport, DCR, the Roots, Sampling and Logging features, went onto a deprecation path with a minimum twelve-month window. All four Tier-1 SDKs shipped support day one. Tuesday’s technology piece has the full argument.

The follow-through is the story, and its speed. Within 48 hours GitHub moved Copilot code review’s agent skills and MCP support to GA (opens in a new tab): a SKILL.md file under .github/skills now steers an enterprise code-review product, with MCP tool calls deliberately restricted to read-only and per-comment attribution showing which skill or server produced a suggestion. Anthropic shipped its own rollout (opens in a new tab) the same day. GitHub’s read-only restriction is the checkpoint-before-the-action pattern from the July 26 piece, applied by an incumbent to its own reviewing agent.

Your move: if you ship an MCP server, your differentiator has moved up a layer, from whether you speak the protocol to what your server exposes and how safely an agent can act through it. Your integration and auth docs are now agent-facing surfaces. Walk your quickstart as an agent would: a step it can follow but an auth step it cannot complete is a closed door.

GitHub gave Models six weeks, and the window is the positioning

On July 30, GitHub Models was retired (opens in a new tab): playground, model catalog, inference API and BYOK, gone for every customer including existing ones with active usage. Closed to new customers June 16, full retirement announced July 1, dead July 30. Departing users are pointed at Microsoft Foundry or Copilot’s model access, adjacent products rather than replacements.

The sunset itself is a defensible portfolio decision. The window is the tell. Six weeks from “no new customers” to “your integration returns errors” is a schedule set for the vendor’s convenience, not the integrator’s, and it landed two days after the MCP project showed what the adult version looks like: a dated spec, a migration guide, deprecated pieces that keep working for at least a year. Developers build on platform surfaces literally, hardcoded endpoints, cron jobs, CI steps. Since the Cerebras episode this desk has argued the damage from a rushed sunset is rarely public outrage; it is the quiet re-anchoring on “this vendor breaks things” that surfaces at the next build-vs-buy decision. Two clocks, one week: twelve months reads as infrastructure, six weeks reads as a warning label.

Your move: publish your deprecation policy as a page before you need it, with a minimum window, and hold yourself to it in public the next time a product goes. A competitor’s six-week exit is your positioning claim only if yours is written down.

Google settled the llms.txt question: ship it, expect nothing

A pair of Google moves, both predating this week, cleared our sweep, and together they resolve a question this desk has hedged on since the GEO dive. The Search Central AI-features guide (opens in a new tab) now says it outright: you do not need machine-readable files, AI text files or Markdown to appear in Google Search including its generative capabilities, “as Google Search itself doesn’t use them”. So llms.txt is not a ranking or visibility input for AI Overviews or AI Mode. Meanwhile Chrome’s Lighthouse added a default Agentic Browsing category (opens in a new tab) (Chrome 150 or later) that checks for llms.txt and WebMCP as agent-readiness signals, deliberately unscored because “the standards for the agentic web are still emerging”.

That is the retrieval-versus-ranking split made official by the one company that owns both a search engine and a browser: llms.txt buys you nothing with the search index and something, still unmeasured, with browser-borne agents.

Your move: ship the file as an afternoon’s insurance for the agent surface, never as an SEO strategy, and retire the internal pitch that calls it a growth hack. If someone on your team has it in a quarterly plan as a traffic lever, this is the link to send them.

Quick hits

• Cloudflare’s dogfooding post earned the swipe file. Moving cdnjs, 9 billion requests a day (self-reported), onto its own Developer Platform proves little by itself; the receipt is the two public platform limits the migration forced Cloudflare to raise for every customer, checkable today in the live limits docs. Saturday’s campaigns piece has the template.
• GitHub shipped a supply-chain security bundle (npm publish-time malware scanning, expanded Dependabot malicious-package alerts) on July 28, two days after a widely read post showed ~10,000 malware repos discoverable by basic search, deleted after HN attention, and regrown within hours. A fix that lands two days after the critique reads as a press response until it outlasts the news cycle.
• Tines pitched “3B” on Show HN with the sharpest positioning line of the week: “you told everyone to use AI, now give them a secure place to do it”. Agent governance reframed as a shadow-AI problem rather than a tool-call guardrail. Thin traction; the framing travels anyway.
• Devtools ads reached the departure lounge. One practitioner photographed LaGuardia’s screens (opens in a new tab) running back-to-back AI devtool ads, Codex twice, Devin. A single observation with no spend data, but out-of-home is a channel developer marketing almost never uses. Someone is testing it.
• Gradle Technologies renamed to Develocity, from build-tool company to “the context engineering layer for software delivery”, shedding the name of its own famous open-source project to chase the AI-review bottleneck. The build tool itself stays open source and unaffected.

Watch

1. The MCP migration becomes a comms event, or a pile-up, by end of September. At least one devtool that ships an MCP server publishes a dated, public migration plan off HTTP+SSE and DCR, a changelog entry, a deadline, a guide, or the first stranded-integrator complaint thread lands instead. The first outcome means the industry learned what GitHub Models’ exit teaches by counterexample: the deprecation is part of the product. If neither happens, everyone is deferring the same bill to mid-2027.
2. GitHub’s supply-chain fix outlasts the news cycle, through August. The critique’s exact charge was that past cleanups did not stick; the researcher’s own script found the deleted repos regrown within hours. That script can re-answer the question any day. If regrown malware repos are reported again through August, the bundle was a press response, not a filter.
3. DevRelCon NYC recaps, deadline mid-August. The measurable-ROI hiring bar claim from W29 remains single-sourced, and recaps are now more than ten days overdue. If nothing corroborates it by mid-August, it retires as one person’s job search.