AI Product Updates, July 27: Kimi K3 Goes Open, MCP Turns Stateless, and More
Moonshot released Kimi K3's weights and technical report, MCP prepared a breaking stateless specification, and Cloudflare open-sourced a privacy debugging CLI.
At a glance
Moonshot released the Kimi K3 model weights and technical report late on July 27 in the channel's display timezone. The same window brought a breaking MCP specification candidate that is scheduled to finalize on July 28, plus Cloudflare's open-source
privacy-client CLI for debugging privacy-preserving protocols.| Product or platform | Releasing entity | Release date | Core change | Availability |
|---|---|---|---|---|
| Kimi K3 weights and technical report | Moonshot AI | July 27, 2026, 23:14 GMT+8 | Released the weights, report, and more of the stack behind a 2.8T MoE model with native vision and a 1M-token context window | Weights linked from the official announcement; hosted Kimi, Kimi Work, Kimi Code, and the Kimi API remain available |
MCP 2026-07-28 | Model Context Protocol project | July 28, 2026 final date | Moves the protocol core to stateless HTTP, adds first-class extensions, hardens authorization, and formalizes deprecations | Release candidate available now; final specification scheduled for July 28; breaking changes |
privacy-client (pvcli) | Cloudflare | July 27, 2026, 21:00 GMT+8 | Open-sourced a Rust CLI for testing and debugging OHTTP and related privacy-protocol flows | Available under Apache-2.0 on GitHub |
Kimi K3 weights are now available
Moonshot's official account announced at 23:14 GMT+8 that it had released the Kimi K3 model weights and technical report. The post also points to high-performance attention kernels, an MoE communication library, and infrastructure for running agent environments at scale. 1
This is the meaningful follow-up to Kimi K3's July 17 hosted launch: developers can now inspect and run the model rather than relying only on Kimi's hosted surfaces. Moonshot describes K3 as a 2.8-trillion-parameter mixture-of-experts model with native visual understanding and a 1-million-token context window. 2
The model-weight link in the announcement resolves to the Moonshot Kimi-K3 repository on Hugging Face. The official Kimi blog lists Kimi.com, Kimi Work, Kimi Code, and the Kimi API as hosted access points. It lists API pricing of $0.30 per million cache-hit input tokens, $3.00 per million cache-miss input tokens, and $15.00 per million output tokens. 2
For teams evaluating a local deployment, the practical constraint is hardware and runtime support, not model discovery. The blog says K3 uses MXFP4 weights and recommends deployments with 64 or more accelerators; its limitations section also warns that a harness must preserve the model's thinking history and that K3 can act too proactively on ambiguous tasks. 2
Status: Weights and technical report released. Hosted access and API access remain available. The model's license and production-readiness guarantees were not stated in the announcement reviewed here.
MCP is about to lose its protocol-level session
The MCP project's
2026-07-28 release candidate makes the protocol stateless at the transport layer. The final specification is scheduled for July 28, and the project calls the revision a breaking change. The intended operational result is that a remote MCP server can sit behind an ordinary round-robin load balancer without sticky sessions or a shared session store. 3The migration changes the request model. The
initialize handshake and Mcp-Session-Id header go away; protocol version, client information, and capabilities move into request metadata. Streamable HTTP also requires Mcp-Method and Mcp-Name headers, while list and resource results gain ttlMs and cacheScope so clients can cache them deliberately. 3The same candidate promotes extensions to a formal mechanism. MCP Apps provides server-rendered interfaces in a sandboxed iframe, and the Tasks extension gives long-running work a handle-based lifecycle with
tasks/get, tasks/update, and tasks/cancel. Teams using the experimental Tasks API will need to migrate to that new lifecycle. 3There is a softer transition for three older features. Roots, Sampling, and Logging are deprecated, but the methods and capability flags continue to work during the protected compatibility period described by the project. GitHub says its MCP Server already supports the next specification and has removed Redis session reads and writes from its implementation. 4
Status: Release candidate available. Final specification scheduled for July 28. Builders operating MCP clients or servers should test the draft against real workloads and remove assumptions about handshake state before adopting it in production.
Cloudflare open-sources a privacy debugging CLI
Cloudflare released
privacy-client, or pvcli, under the Apache-2.0 license. It is a curl-like Rust command-line tool that can execute and inspect end-to-end Oblivious HTTP requests, including the relay, gateway, encryption, and binary HTTP steps that are easy to debug incorrectly by hand. 5The tool is available in the Cloudflare Research
pvcli repository. The launch post shows support for ordinary HTTP and HTTP/3 testing as well as OHTTP flows, with verbose output for inspecting parsed keys, encoded requests, and relay or gateway behavior. Cloudflare lists post-quantum cryptography, Chunked OHTTP, timing information, and additional proxy protocol support as future work rather than current availability. 5This is adjacent to the model launches in today's brief, but it matters for teams building AI clients that need to keep request identity separate from request content. The useful test is straightforward: can an AI product's relay, gateway, and target be exercised from one reproducible command before an incident reaches production?
Status: Released and open source. No hosted service or commercial tier was announced in the launch post.
What to act on
- Running Kimi K3 through a hosted endpoint: the new weight release gives you a self-hosting path, but validate memory, MXFP4 support, and thinking-history handling before treating it as a drop-in replacement.
- Maintaining an MCP integration: test the
2026-07-28candidate against load balancing, authorization, elicitation, caching, and Tasks. Treat the removal ofMcp-Session-Idas a migration item, not a cosmetic version bump. - Operating privacy-sensitive AI traffic: install
pvcliand make one end-to-end OHTTP test part of your integration checks. The project is open source, so the test harness can be reviewed with the rest of the client stack.
References
- 1
- 2
- 3The 2026-07-28 MCP Specification Release Candidate
blog.modelcontextprotocol.io
- 4
- 5We're open sourcing our privacy proxy CLI
blog.cloudflare.com
This story was produced automatically by a channel. One sentence is all it takes for Neodrop to keep producing for you.