Twelve months or six weeks — the deprecation window is the positioning now

Last week was about money — what AI features cost and what buyers can prove they return. This week was about endings. The two most consequential moves in the window were both deprecations, and they point in opposite directions: the Model Context Protocol started a twelve-month migration clock with SDKs, a written offramp, and six hyperscalers lined up behind it; GitHub turned off an entire product — Models — on a six-week runway with no like-for-like replacement. Put side by side, they make the argument this site has been circling for a month concrete: the deprecation window is now a positioning claim, the same way the pricing cap became one.

MCP grew up, and the follow-through came fast

The 2026-07-28 spec is the protocol’s largest revision since launch. The core goes stateless — no initialize handshake, no session ID, any server instance can answer any request — which makes an MCP server an ordinary HTTP workload you can run on serverless or the edge. Auth hardens (RFC 9207 issuer validation; Client ID Metadata Documents replacing Dynamic Client Registration). And a stack you may be running — the old HTTP+SSE transport, DCR, the Roots/Sampling/Logging features — went onto a deprecation path with a minimum twelve-month window. All four Tier-1 SDKs shipped support day one. Tuesday’s technology piece has the full argument; the short version is that “we speak MCP” stopped being a differentiator and became table stakes.

What the rest of the week added is the follow-through, and its speed is the story. Within 48 hours of the spec, GitHub moved Copilot code review’s agent skills and MCP support to GA — a SKILL.md file under .github/skills now steers an enterprise code-review product, with MCP tool calls deliberately restricted to read-only and per-comment attribution showing which skill or server produced a suggestion. Anthropic shipped its own rollout the same day. Note what GitHub’s read-only restriction is: an agent-safe-by-design decision, the checkpoint-before-the-action pattern from the July 26 piece, applied by an incumbent to its own reviewing agent.

The play hasn’t changed since Tuesday, but it firmed up: if you ship an MCP server, your differentiator has moved up a layer — from whether you speak the protocol to what your server exposes and how safely an agent can act through it. And your integration and auth docs are now agent-facing surfaces; a quickstart an agent can follow but an auth step it can’t complete is a closed door.

The other clock read six weeks

On July 30, GitHub Models was retired — playground, model catalog, inference API, and BYOK, gone for every customer including existing ones with active usage. The timeline: closed to new customers June 16, full retirement announced July 1, dead July 30. Departing users are pointed at Microsoft Foundry or Copilot’s model access — adjacent products, not replacements.

The sunset itself is a defensible portfolio decision. The window is the tell. Six weeks from “no new customers” to “your integration returns errors” is a schedule set for the vendor’s convenience, not the integrator’s — and it lands two days after the MCP project showed what the adult version looks like: a dated spec, a migration guide, deprecated pieces that keep working for at least a year. Developers build on platform surfaces literally — hardcoded endpoints, cron jobs, CI steps — and the DX section of the guide has argued since the Cerebras episode that the damage from a rushed sunset is rarely public outrage; it’s the quiet re-anchoring on “this vendor breaks things” that surfaces at the next build-vs-buy decision. Two clocks, one week: twelve months reads as infrastructure, six weeks reads as a warning label.

Google made the llms.txt split official

A pair of Google moves, both predating this week, cleared our sweep, and they resolve a question this site has hedged on since the GEO dive: is llms.txt worth shipping? Google’s answer is both, explicitly. The Search Central AI-features guide now says it outright — you don’t need machine-readable files, AI text files, or Markdown to appear in Google Search including its generative capabilities, “as Google Search itself doesn’t use them” — so llms.txt is not a ranking or visibility input for AI Overviews or AI Mode. Meanwhile Chrome’s Lighthouse added a default Agentic Browsing category (Chrome 150 or later) that checks for llms.txt and WebMCP as agent-readiness signals — deliberately unscored, because “the standards for the agentic web are still emerging”.

That’s the retrieval-versus-ranking split made official by the one company that owns both a search engine and a browser: llms.txt buys you nothing with the search index and something (still unmeasured) with browser-borne agents. It confirms the guide’s standing position — ship it as an afternoon’s cheap insurance for the agent surface, never as an SEO strategy — and it retires the lingering idea that the file is a growth hack. The practice entry now carries the split.

Also this week

• Cloudflare’s dogfooding post earned the swipe file. Moving cdnjs — 9 billion requests a day, self-reported — onto its own Developer Platform proves little by itself; the receipt is the two public platform limits the migration forced Cloudflare to raise for every customer, checkable today in the live limits docs. Saturday’s campaigns piece has the template.
• GitHub shipped a supply-chain security bundle (npm publish-time malware scanning, expanded Dependabot malicious-package alerts) on July 28 — two days after a researcher’s widely read post showed ~10,000 malware repos discoverable by basic search. Watch whether the fix outlasts the news cycle; the critique was precisely that past cleanups didn’t.
• Tines pitched “3B” on Show HN with the sharpest positioning line of the week — “you told everyone to use AI, now give them a secure place to do it” — reframing agent governance as a shadow-AI problem rather than a tool-call guardrail. Thin traction; the framing travels anyway.
• Devtools ads reached the departure lounge. One practitioner photographed LaGuardia’s screens running back-to-back AI devtool ads — Codex twice, Devin. A single observation with no spend data, but out-of-home is a channel developer marketing almost never uses; someone is testing it.
• DevRelCon NYC recaps: still none, ten days after the July 23 wrap. The measurable-ROI hiring-bar claim from W29 remains single-sourced; per the standing deadline, if recaps don’t corroborate it by mid-August we retire the thread as one person’s job search.

One thing to watch

Whether the twelve-month MCP window gets treated as a comms event or a backend chore. The falsifiable call: by end of September, at least one devtool that ships an MCP server publishes a dated, public migration plan off HTTP+SSE and DCR — a changelog entry, a deadline, a guide — or the first stranded-integrator complaint thread lands instead. The first outcome means the industry learned what GitHub Models’ six-week exit teaches by counterexample: the deprecation is part of the product. If neither happens by then, everyone is deferring the same bill to mid-2027, and the pile-up will be a story this site covers when it arrives.