AI Product Updates, July 27: Kimi K3 Goes Open, MCP Turns Stateless, and More (2026)

At a glance

Moonshot released the Kimi K3 model weights and technical report late on July 27 in the channel's display timezone. The same window brought a breaking MCP specification candidate that is scheduled to finalize on July 28, plus Cloudflare's open-source privacy-client CLI for debugging privacy-preserving protocols.

Product or platform	Releasing entity	Release date	Core change	Availability
Kimi K3 weights and technical report	Moonshot AI	July 27, 2026, 23:14 GMT+8	Released the weights, report, and more of the stack behind a 2.8T MoE model with native vision and a 1M-token context window	Weights linked from the official announcement; hosted Kimi, Kimi Work, Kimi Code, and the Kimi API remain available
MCP `2026-07-28`	Model Context Protocol project	July 28, 2026 final date	Moves the protocol core to stateless HTTP, adds first-class extensions, hardens authorization, and formalizes deprecations	Release candidate available now; final specification scheduled for July 28; breaking changes
`privacy-client` (`pvcli`)	Cloudflare	July 27, 2026, 21:00 GMT+8	Open-sourced a Rust CLI for testing and debugging OHTTP and related privacy-protocol flows	Available under Apache-2.0 on GitHub

Kimi K3 weights are now available

Moonshot's official account announced at 23:14 GMT+8 that it had released the Kimi K3 model weights and technical report. The post also points to high-performance attention kernels, an MoE communication library, and infrastructure for running agent environments at scale. 1

This is the meaningful follow-up to Kimi K3's July 17 hosted launch: developers can now inspect and run the model rather than relying only on Kimi's hosted surfaces. Moonshot describes K3 as a 2.8-trillion-parameter mixture-of-experts model with native visual understanding and a 1-million-token context window. 2

The model-weight link in the announcement resolves to the Moonshot Kimi-K3 repository on Hugging Face. The official Kimi blog lists Kimi.com, Kimi Work, Kimi Code, and the Kimi API as hosted access points. It lists API pricing of $0.30 per million cache-hit input tokens, $3.00 per million cache-miss input tokens, and $15.00 per million output tokens. 2

For teams evaluating a local deployment, the practical constraint is hardware and runtime support, not model discovery. The blog says K3 uses MXFP4 weights and recommends deployments with 64 or more accelerators; its limitations section also warns that a harness must preserve the model's thinking history and that K3 can act too proactively on ambiguous tasks. 2

Status: Weights and technical report released. Hosted access and API access remain available. The model's license and production-readiness guarantees were not stated in the announcement reviewed here.

MCP is about to lose its protocol-level session

The MCP project's 2026-07-28 release candidate makes the protocol stateless at the transport layer. The final specification is scheduled for July 28, and the project calls the revision a breaking change. The intended operational result is that a remote MCP server can sit behind an ordinary round-robin load balancer without sticky sessions or a shared session store. 3

The migration changes the request model. The initialize handshake and Mcp-Session-Id header go away; protocol version, client information, and capabilities move into request metadata. Streamable HTTP also requires Mcp-Method and Mcp-Name headers, while list and resource results gain ttlMs and cacheScope so clients can cache them deliberately. 3

The same candidate promotes extensions to a formal mechanism. MCP Apps provides server-rendered interfaces in a sandboxed iframe, and the Tasks extension gives long-running work a handle-based lifecycle with tasks/get, tasks/update, and tasks/cancel. Teams using the experimental Tasks API will need to migrate to that new lifecycle. 3

There is a softer transition for three older features. Roots, Sampling, and Logging are deprecated, but the methods and capability flags continue to work during the protected compatibility period described by the project. GitHub says its MCP Server already supports the next specification and has removed Redis session reads and writes from its implementation. 4

Status: Release candidate available. Final specification scheduled for July 28. Builders operating MCP clients or servers should test the draft against real workloads and remove assumptions about handshake state before adopting it in production.

Cloudflare open-sources a privacy debugging CLI

Cloudflare released privacy-client, or pvcli, under the Apache-2.0 license. It is a curl-like Rust command-line tool that can execute and inspect end-to-end Oblivious HTTP requests, including the relay, gateway, encryption, and binary HTTP steps that are easy to debug incorrectly by hand. 5

The tool is available in the Cloudflare Research pvcli repository. The launch post shows support for ordinary HTTP and HTTP/3 testing as well as OHTTP flows, with verbose output for inspecting parsed keys, encoded requests, and relay or gateway behavior. Cloudflare lists post-quantum cryptography, Chunked OHTTP, timing information, and additional proxy protocol support as future work rather than current availability. 5

This is adjacent to the model launches in today's brief, but it matters for teams building AI clients that need to keep request identity separate from request content. The useful test is straightforward: can an AI product's relay, gateway, and target be exercised from one reproducible command before an incident reaches production?

Status: Released and open source. No hosted service or commercial tier was announced in the launch post.

What to act on

Running Kimi K3 through a hosted endpoint: the new weight release gives you a self-hosting path, but validate memory, MXFP4 support, and thinking-history handling before treating it as a drop-in replacement.
Maintaining an MCP integration: test the 2026-07-28 candidate against load balancing, authorization, elicitation, caching, and Tasks. Treat the removal of Mcp-Session-Id as a migration item, not a cosmetic version bump.
Operating privacy-sensitive AI traffic: install pvcli and make one end-to-end OHTTP test part of your integration checks. The project is open source, so the test harness can be reviewed with the rest of the client stack.

AI Product Updates, July 27: Kimi K3 Goes Open, MCP Turns Stateless, and More

At a glance

Kimi K3 weights are now available

MCP is about to lose its protocol-level session

Cloudflare open-sources a privacy debugging CLI

What to act on

References

Related content