The pace of Anthropic’s platform evolution has crossed a threshold. This week’s developments are not incremental updates — they are structural changes to how AI infrastructure works, how enterprises consume it, and how the company behind it positions itself in the market. The MCP specification is five days from its largest revision ever, going stateless at the protocol layer. Claude Cowork has escaped the desktop and now runs AI tasks on cloud infrastructure while your devices are offline. Claude Code shipped seven releases in seven days with a quadratic performance fix that will matter to every team running long sessions. And Anthropic — now at a $1.2 trillion implied valuation on secondary markets — is in investor meetings for an October IPO that would be the largest AI public offering in history.

For engineering leaders, this is the week to pay attention. The infrastructure decisions you make in the next quarter — MCP server architecture, SDK migrations, enterprise admin configuration, model selection for production — will determine whether your organization is positioned for the platform transition that is now clearly underway.

MCP 2026-07-28: The Protocol Goes Stateless

The single most consequential change this week is the MCP 2026-07-28 specification, which finalizes on July 28. This is the largest revision of the Model Context Protocol since its launch in November 2024, and the headline change is fundamental: MCP is now stateless at the protocol layer.

What Stateless Means in Practice

The initialize handshake is gone. The Mcp-Session-Id header is eliminated. Protocol version, client info, and capabilities now travel in _meta fields on every request. Any request can land on any server instance — no sticky sessions, no shared session store, no session affinity required at the load balancer. Remote MCP servers can run behind plain round-robin distribution for the first time.

Two new mandatory HTTP headers — Mcp-Method and Mcp-Name — enable edge routing without JSON body inspection. This is the change that makes MCP feasible at cloud scale. If you have been holding back on MCP server deployment because of session management complexity, this removes the primary architectural objection.

Six Breaking Changes

The spec introduces six breaking changes that server authors must address:

  1. Sessions eliminated. Remove session-based state. Use explicit handles — basket_id, browser_id — passed as tool arguments.
  2. Initialize handshake gone. Implement the new mandatory server/discover RPC. Read version and capabilities from _meta.
  3. Two new required HTTP headers. All Streamable HTTP POSTs must include Mcp-Method and Mcp-Name. Servers must reject mismatches.
  4. Tasks API redesigned. Tasks move from core spec to an extension (io.modelcontextprotocol.tasks). Blocking tasks/result is replaced by polling via tasks/get.
  5. Error code changed. Missing resource errors shift from -32002 to -32602 (standard JSON-RPC Invalid Params).
  6. W3C Trace Context mandatory. Distributed trace propagation is now strictly required.

Deprecations with a 12-Month Window

Three features enter deprecated status on July 28 with a guaranteed minimum 12-month grace period (to mid-2027): Roots (move to tool parameters or resource URIs), Sampling (call the LLM API directly from your server), and Logging (emit to stderr or OpenTelemetry). HTTP+SSE transport is also deprecated.

Backward Compatibility

Nothing breaks on July 28. New clients fall back to the initialize handshake when reaching old servers. V2 servers can answer both revisions from one endpoint. Existing clients and servers continue working. But the 12-month deprecation clock starts on July 28, and the smart move is to begin migration planning now.

Beta SDKs Available for Testing

All four Tier 1 SDKs have betas targeting the new spec. Python mcp v2.0.0b2 replaces FastMCP with MCPServer and migrates from httpx to httpx2. TypeScript v2 splits into separate @modelcontextprotocol/server and @modelcontextprotocol/client packages (ESM-only) with a codemod: npx @modelcontextprotocol/codemod@beta v1-to-v2 .. Go v1.7.0-pre.1 and C# v2.0.0-preview.1 maintain API compatibility with changes limited to deprecated features. Stable releases target July 28 alongside the spec.

Claude Cowork: From Desktop to Cloud

Claude Cowork reached general availability on macOS and Windows earlier this year. This week, it expanded to web and mobile — and the expansion is more than a port. It is a fundamental shift in how AI agent workflows operate.

Sessions now run remotely on Anthropic’s servers. Work continues when you close your laptop. Scheduled tasks fire with no device online. Sessions and files stay in your Claude account and follow you across devices — start a task at your desk, check progress from your phone, pick up the finished output anywhere. For tasks requiring human validation, Claude sends a push notification to your phone. Approve or reject the next step without opening a computer.

The unified home screen merges chat and Cowork into a single workspace for projects and artifacts. Chat and agent modes are no longer separate workflows. The rollout began with Max plan subscribers on July 7, with Pro, Team, and Enterprise access described as “coming weeks.” Doubled usage limits run through August 5 as a launch promotion.

For engineering teams, the implication is significant: AI agent workflows no longer require a developer’s machine to be online. Scheduled code reviews, automated dependency updates, and long-running migrations can execute on cloud infrastructure and deliver results when the team logs in. This is the “AI assistant that never sleeps” pattern, and it changes how teams think about asynchronous work.

Claude Code: Seven Releases in Seven Days

Claude Code shipped versions 2.1.212 through 2.1.218 between July 17 and July 22. The release cadence is extraordinary, but two changes stand out for engineering teams.

The Quadratic Slowdown Fix (v2.1.216)

Message normalization cost was growing quadratically with session length. A 100-message session was 100x slower than a 10-message session at the same operations. If your team has been experiencing degraded Claude Code performance on long-running sessions, this is why — and the fix is in v2.1.216. Update immediately if you regularly work in sessions longer than 50 messages.

Runaway-Loop Prevention (v2.1.212)

Session-wide caps now prevent runaway delegation loops from burning tokens indefinitely. WebSearch calls are capped at 200 per session (CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION), subagent spawns at 200 per session (CLAUDE_CODE_MAX_SUBAGENTS_PER_SESSION), and concurrent subagents at 20 (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS). Nested subagent spawning is blocked by default. The --max-budget-usd flag now stops running background subagents, not just the main thread. These are guardrails that production deployments need.

Security Hardening Across the Board

Nine security fixes landed in v2.1.213–214 alone. The permission analyzer was overhauled to a fail-closed design. A PowerShell 5.1 permission-check bypass was closed. Single-segment dir/** allow rules — which were auto-approving writes to any matching directory anywhere in the tree — were narrowed to the current working directory. The EndConversation tool lets Claude terminate sessions facing abusive users or jailbreak attempts. Plan mode no longer auto-runs file-modifying Bash commands without a permission prompt.

Later versions added symlink escape fixes in background session isolation, worktree git bypasses via git -C/--git-dir/GIT_DIR/GIT_WORK_TREE, and an MCP tool output memory leak patch. A Windows path corruption bug — paths containing segments starting with \u (like C:\Users\unicorn) were being converted to CJK characters — was fixed in v2.1.218.

/code-review as Background Subagent (v2.1.218)

Code review work no longer consumes conversation context. /code-review runs as a background subagent, and stacked /commands can target it. Combined with /verify and /deep-research becoming opt-in (no longer auto-launched by Claude), the session context stays cleaner and focused on the primary task.

Claude Sonnet 5: The New Default

Claude Sonnet 5 is now the default model for Claude Code, Free and Pro plans, and the API. The introductory pricing of $2/$10 per million tokens (input/output) runs through August 31, after which it steps up to $3/$15. With a native 1M-token context window and 128K max output, it is the most agentic Sonnet to date — substantial improvements over Sonnet 4.6 in reasoning, tool use, coding, and knowledge work.

The API rate limit simplification matters for scaling teams: Claude Sonnet and Haiku rate limits now match Claude Opus at every usage tier. Tiers consolidated from four to three (Start, Build, Scale), and most organizations were automatically promoted to a higher tier. No organization received lower limits. Check the Claude Console to see your new tier.

Enterprise APIs: Admin, Analytics, Compliance

Three new enterprise APIs landed this week, each targeting a different governance need:

Admin API (Beta): Programmatic member management for Claude Enterprise organizations. List and search users by email, change roles, remove members, send and cancel invitations, manage groups and memberships, and view custom roles. The beta header ce-user-management-2026-07-13 is required for group and custom-role requests.

Analytics API: Programmatic access to usage and engagement data for Claude and Claude Code Remote. Data is aggregated per organization per day, with requests capped at 31 days wide, starting within the last 365 days and no earlier than January 1, 2026. Data refreshes every 4 hours. For invoicing-grade totals, query dates 30+ days in the past for reconciliation.

Compliance API: Integrations with security and compliance tools that give IT and security teams programmatic access to usage data and customer input content. Designed for audit, regulatory compliance, and governance — the kind of integration that lets organizations treat Claude like any other governed application in their stack.

The IPO Trajectory

Anthropic confidentially filed an S-1 with the SEC on June 1, 2026. Lead underwriters Goldman Sachs, Morgan Stanley, and JPMorgan Chase were confirmed June 3. Investor meetings began scheduling the week of July 14. The target listing window is October 2026 on Nasdaq, with analyst pricing ranging from $1.1T to $1.25T (bull case up to $1.4T if ARR accelerates past $60B pre-IPO).

The revenue trajectory supports the valuation: $47B annualized revenue run-rate as of May 2026, up from $14B ARR in February. The Series H raised $65 billion at a $965 billion post-money valuation — the largest single venture funding round in history. Anthropic surpassed OpenAI in valuation for the first time, with secondary markets trading Anthropic shares at an implied $1.2T versus OpenAI’s ~$908B.

Infrastructure spending matches the ambition. AMD committed up to $5B investment with 2 gigawatts of Instinct MI450 GPUs (first deployment H1 2027). Amazon added $4B with AWS as primary training partner on Trainium2 and Trainium3 chips. SpaceX/Colossus 1 runs $1.25B/month through May 2029. Andrej Karpathy joined the pretraining team. The company is spending like a hyperscaler to secure compute capacity for next-generation model training.

Action Items

  1. Read the MCP 2026-07-28 release candidate. The spec finalizes July 28. Identify usage of Roots, Sampling, and Logging — the 12-month deprecation clock starts then. Begin SDK migration planning against the beta releases.

  2. Update Claude Code to v2.1.218. The quadratic slowdown fix alone justifies the update for any team running long sessions. The security hardening across v2.1.213–217 is non-negotiable.

  3. Test Claude Sonnet 5 before August 31. The $2/$10 introductory pricing is the cheapest entry point for production workloads. Lock in projects at this rate before the step-up to $3/$15.

  4. Configure enterprise admin APIs. If you are on Claude Enterprise, the Admin API, Analytics API, and Compliance API are available now. Automate user management, stream usage data to your FinOps tools, and integrate compliance data with your existing security stack.

  5. Evaluate Claude Cowork for asynchronous workflows. Scheduled tasks that run without a device online change the calculus on AI-assisted code review, dependency management, and long-running migrations. Start with Max plan access if available.

  6. Audit your MCP servers for the stateless migration. Remove Mcp-Session-Id assumptions. Replace session-based state with explicit handles. Add Mcp-Method and Mcp-Name headers. Test against beta SDKs in CI.

  7. Plan for the IPO’s market impact. An October IPO at $1T+ valuation will reshape the AI vendor landscape. Evaluate your Claude dependency footprint now — pricing, licensing, and support structures may shift as Anthropic transitions to public-company reporting and quarterly revenue pressure.

The platform transition is not coming. It is here. MCP goes stateless in five days, Claude Cowork runs in the cloud, Claude Code ships at a pace that outstrips most products’ monthly output in a single week, and Anthropic is preparing for the largest AI IPO in history. The organizations that treat this as infrastructure planning rather than vendor tracking will be the ones positioned to capitalize on it.