Daily briefingJuly 28, 2026

Scout Briefing — Tuesday July 28 2026

10 movers0 research signals1 risk16 min read

🧭 Today's Thesis

The MCP TypeScript SDK reached GA on npm before the specification it implements was published, and that ordering is the story — the reference implementation, not the normative document, is now the artifact the ecosystem actually adopts. The evidence is unusually clean because both sides are machine-checkable at the same instant: dist-tags.latest = 2.0.0 on five @modelcontextprotocol/* packages, against a spec repo whose only tag for this revision is 2026-07-28-RC from May 29, a schema/ directory with no 2026-07-28 folder, a docs site still serving 2025-11-25 and still describing the protocol as stateful, and a GA announcement sitting in draft PR #3145. A protocol is supposed to work the other way round: the document is normative, implementations conform, and conformance is what makes independent implementations interoperate. Here the document trails the code, which means the real conformance target for the next few weeks is whatever @modelcontextprotocol/server@2.0.0 does, and the honest description of an "MCP 2026-07-28 server" is "one that talks to the TypeScript SDK." That the aggregate coverage already reports the spec as shipped — search results today assert "the final specification shipped on July 28, 2026" while the repo says otherwise — is the same failure in miniature: everyone is reading the announcement, nobody is reading the tag.

The contrarian operator claim is about what to migrate against. The instinct on a protocol break is to read the spec, model the diff, and plan. The ordering says that is now the slower path: the SDK ships a codemod, a compat package (server-legacy, GA, not deprecated), and two deliberately separate migration guides that decouple "move to v2 packages" from "adopt the 2026-07-28 wire protocol." That is a migration designed by people who expect you to do it in two independent steps over months, not a flag day — and it is a materially better migration than the spec text could have described, because it is executable. Run the codemod, keep server-legacy mounted, and read the spec afterwards to understand what you already shipped.

Two limits, stated plainly. First, this is a one-day ordering and the spec may well tag within hours — but the ordering already happened and the SDK-first pattern is what generalizes, not the gap's duration. Second, and more consequential: the desynchronized SDKs are a real cost that "just upgrade" hides. On launch day one of four official SDKs is GA, and it is the TypeScript one — Python v2.0.0rc1, Go v1.7.0-pre.3, Rust rmcp-v3.0.0-beta.3. A Node/React/Postgres shop is, unusually, on the fast side of that split, and the reflex to move the whole fleet at once is exactly the mistake server-legacy exists to prevent. The thing that makes MCP valuable is that servers written by strangers work with clients written by strangers; for the next quarter that property lives in a compat package, not in the spec.

Jump to section

🔥 Top Movers

(raw 243-row trending pull diffed against the 775-entry registry through the operator lens; score.py again returned an unranked flatten — see Pipeline)

• alibaba/open-code-review (+979 ⭐ today, 14,937 total) — day 5, 92% of its 1,066 peak, +3,835 on the weekly board. Hybrid deterministic-pipeline + LLM code review. The most on-lens repo on the board.
• CoreBunch/Instatic (+674 ⭐, 6,253) — 76% of yesterday's 888 all-time peak. Agentic self-hosted visual CMS (MIT).
• yorukot/superfile (+600 ⭐, 20,944) — new all-time peak (102% of 586). Terminal file manager, Go. Off-lens.
• moeru-ai/airi (+572 ⭐, 44,111) — 923% of its only prior reading (62 on 05-26). Self-hosted companion agent. Off-lens; a consumer-agent demand signal.
• usestrix/strix (+507 ⭐, 45,015) — 241% of prior peak, flipped fading → rising. Autonomous pentesting with dynamically-validated PoCs.
• shiyu-coder/Kronos (+441 ⭐, 34,592) — 88% of peak, day 5.
• bradautomates/claude-video (+434 ⭐, 11,169) — back on the board.
• opengeos/GeoLibre (+420 ⭐, 2,759) — browser/desktop/Jupyter GIS platform. Off-lens.
• pascalorg/editor (+412 ⭐, 18,111) — back after a fade flip. Off-lens.
• NanmiCoder/MediaCrawler (+362 ⭐, 58,311) — CN social scraper. Off-lens.

Four of yesterday's top six are gone from the daily board in one step — see Fading. Fifteen repos set new all-time daily peaks.

🎯 What Matters to Us This Week

• The MCP TypeScript SDK went GA — and the spec it implements did not. Verified at scan time from GitHub releases and registry.npmjs.org directly, not from aggregators: @modelcontextprotocol/server@2.0.0, /server-legacy@2.0.0, /node@2.0.0, /hono@2.0.0, /fastify@2.0.0 all published 2026-07-27 with prerelease=false, and npm dist-tags.latest = 2.0.0 as of today. The spec repo's only tag for this revision is still 2026-07-28-RC (published 2026-05-29); schema/ contains 2024-11-05, 2025-03-26, 2025-06-18, 2025-11-25, draft and no 2026-07-28 directory; modelcontextprotocol.io/specification still serves 2025-11-25 and still lists "Stateful connections" under Base Protocol; and the GA announcement is open draft PR #3145 (branch blog/2026-07-28-ga, opened 2026-07-27T22:48). This corrects the standing record twice over — 07-26 said "no SDK is production-ready for the new spec," 07-27 corrected that to "beta SDKs since 06-29, still not GA." Both were accurate when written. The TS SDK went stable overnight.
• The migration is engineered rather than announced, and that is the part to copy. The old monolith @modelcontextprotocol/sdk is frozen at 1.30.0 (maintenance only: Zod 3.25 literals, SSE keep-alive lifecycle, Content-Type validation). The new surface is seven co-versioned packages with schema modules centralized in /core so a process evaluates one shared schema graph with shared object identity. Three details carry the weight for an app team: an official codemod rewrites v1 imports (including Protocol / mergeCapabilities from shared/protocol.js to the package root); server-legacy is a first-class GA package, so a v2 codebase keeps serving old clients instead of forcing a flag day; and there are two separate migration guides — upgrade-to-v2.md and support-2026-07-28.md — deliberately decoupling "move to the new packages" from "adopt the new wire protocol." Also shipped: CJS builds alongside ESM (require() works), and 415 on non-JSON Content-Type via parsed media type rather than substring match.
• Official Hono and Fastify adapters, GA today. Easy to miss under the protocol news and squarely on-lens: @modelcontextprotocol/hono@2.0.0 and /fastify@2.0.0 both moved from the alpha dist-tag to latest. The integration story becomes "add a framework plugin," not "hand-mount a transport." Statelessness is the enabler — with no session affinity there is nothing framework-specific left to get wrong.
• alibaba/open-code-review is the supply-side answer to yesterday's thesis. Verified: deterministic file selection, bundling and rule matching, with the agent confined to dynamic decisions and context retrieval; ships an MCP server; GitHub Actions / GitLab CI / GitFlic CI / Gerrit; self-hostable with custom providers; Apache-2.0, Go. Published claim: higher F1 than a general-purpose agent at ~1/9 the tokens, with recall deliberately traded down to suppress false positives. The precision-over-recall trade is the tell — it optimises the reviewer's time, not the benchmark.

🚀 What Changed the Frontier

• A reference implementation shipped stable ahead of its normative document. For a Node/TS shop the operative artifact today is not the spec — it is npm i @modelcontextprotocol/server@2.0.0 plus a codemod plus a compat package. The spec becomes documentation of what the SDK already does.
• The four official SDKs desynchronized on launch day. TypeScript is GA; Python is v2.0.0rc1 (prerelease, 2026-07-27); Go is v1.7.0-pre.3 (2026-07-17); Rust is rmcp-v3.0.0-beta.3 (tagged prerelease=false but the version string is a beta — treat as beta). A polyglot estate can move its TS half this week and not its Python half. server-legacy stops being a nicety and becomes the thing that keeps a mixed fleet talking. First time in the tracked window that TypeScript leads Python on an MCP revision.
• Deterministic gating spread to skill selection. sickn33/agentic-awesome-skills (AAS Core) makes the agent pick skill IDs from a full local catalog, validates the selection with a read-only in-memory tool, and hands a human an immutable plan. Third member of the cohort after sigbound (07-26) and open-code-review.

🆕 First Appearances

• sickn33/agentic-awesome-skills — 44,031 ⭐, MIT, 1,991-skill catalog, local read-only stdio MCP + CLI. Registered today at +73/d; found by diffing the raw pull against the registry, never by velocity ranking. AAS explicitly does not rank or recommend — the agent inspects the project, searches the complete catalog, names exact skill IDs; compose_stack validates in memory; the CLI persists aas-stack.json and an immutable plan for human review. Apply and recovery are flagged experimental and outside the supported path.
• vudovn/ag-kit — 7,984 ⭐, MIT. Antigravity-first kit: rules, skills, specialist agents, workflows, persistent memory, MCP guidance, safety hook. The {harness}-kit template the ignore lane has skipped since 07-25, now large enough to be a market fact. Registered as a lane marker, ignore_candidate: true.
• arc53/DocsGPT — 18,131 ⭐, MIT, created 2023-02-02, +48/d. Self-hosted RAG-and-agents platform. A three-year-old repo that was never registered is a registry gap, not a new signal — logged for the agent-memory comparison set.
• raine/workmux — already registered 07-05; new all-time daily peak (+21/d, 162% of prior, 1,947 ⭐). git worktrees + tmux. Calls no model; it is the isolation substrate the parallel-agent pattern assumes and mostly does not ship.

🌱 Rising Stars

• usestrix/strix — +507/d at 241% of prior peak, 45,015 ⭐. Docker-sandboxed, LLM-agnostic, wraps Caido / Playwright / Nuclei, GitHub Actions compatible. Emits working proof-of-concepts from dynamic execution, not static findings.
• different-ai/openwork — +88/d, 180% of prior peak, 17,319 ⭐, pushed today. Open-source alternative to Claude Cowork, built on opencode. ⚠️ License is NOASSERTION — unresolved licensing on a 17K-star repo is an adoption blocker worth naming out loud.
• Zackriya-Solutions/meetily — +204/d, 107% of peak. Reverses yesterday's fading flip one day later.

📉 Fading

Zero repos flipped on the >80%-off-peak rule today. All four flips came from board exit, which that rule structurally cannot see.

• block/buzz — off the daily board entirely after five consecutive days at #1 (3252 → 2162 → 3270 → 2491 → 1710 → absent). Weekly still +14,253.
• virgiliojr94/book-to-skill — absent from every window, one day after setting an all-time peak of +417. Sharpest single-day reversal in the tracked window.
• Automattic/harper — off the daily board (876 → 503 → 327 → absent). Weekly +2,581, monthly +2,808. The 07-26 registration stands: it was registered for the shape, and the shape does not fade with the board.
• ComposioHQ/awesome-claude-skills — off after 5 days (663 → 577 → 440 → absent). Weekly +2,940.

Caveat that matters: weekly totals are intact for three of the four. This is cohort exhaustion and board rotation, not abandonment.

⚔️ Battles

• open-code-review vs. a general coding agent as reviewer — same job, opposite cost curve. open-code-review: deterministic selection/bundling/rule-matching with the LLM only for dynamic context, ~1/9 the tokens, recall traded down on purpose. General agent: full context every PR, higher recall, and every false positive is billed in reviewer-minutes.
• @modelcontextprotocol/server@2.0.0 vs @modelcontextprotocol/sdk@1.30.0 — not really a fight; the monolith is frozen and the split is latest. The genuine contest is server vs server-legacy, i.e. how long you serve both wire protocols. The project's answer is "both, from one codebase, indefinitely."
• TypeScript vs Python as the MCP reference language — TS GA, Python rc1, Go pre.3, Rust beta.3. The historical default in this ecosystem has been Python-first.

🔄 What's Changing

Yesterday's board was a skills cohort at full velocity; today that cohort is gone and a protocol shipped underneath it. The two facts are less unrelated than they look — both are about what an agent loads and how a human checks it. Meanwhile the three repos doing best on-lens today (open-code-review, AAS Core, workmux) share a property none of them advertises: the interesting part of each is deterministic, and the model is confined to the part where being wrong is cheap.

🧪 One Experiment Worth Running

Run the official v2 codemod against one low-stakes internal MCP server, mount server-legacy alongside the new server, and put a Hono or Fastify adapter in front — timeboxed to half a day. Concretely: pick the smallest MCP server you own, follow docs/migration/upgrade-to-v2.md only (do not touch support-2026-07-28.md on this pass), run the codemod, and confirm existing clients still work through server-legacy before adopting a single stateless behaviour. What you learn is worth more than the migration: whether the codemod actually handles your import surface, whether the seven-package split creates dual-schema-graph problems in your build (the /core centralization exists specifically to prevent this — verify it), and whether require() works if any part of your monorepo is still CJS. Upside: you find out the true cost of the break on a server nobody depends on, while the spec is still settling. Cost cap: if the codemod does not converge in half a day, stop — that itself is the finding, and it is worth reporting.

⚠️ One Risk to Track

Servers and clients built against the RC may not interoperate with servers built against the final spec, and the SDK's GA status will make people assume that risk is gone. Stacklok's 07-23 warning still stands unresolved: 2026-07-28 servers may simply fail against older clients absent explicit version negotiation or deliberate fallback, and David Soria Parra's concession — "if you built your own implementation, it's going to be a lot of uplift to make this correct" — was about hand-rolled implementations, which are exactly the ones that will not get a codemod. Trigger to watch: the moment the 2026-07-28 final tag lands, diff schema/2026-07-28/schema.ts against the RC schema. Any normative change between RC and final means everything shipped against the RC — including, potentially, packages published yesterday — is talking a protocol that no longer exists. Downside if missed: silent interop failures with third-party servers, surfacing as tool-call errors that look like model failures rather than protocol failures. Cheap hedge: pin exact versions of @modelcontextprotocol/* rather than caret ranges until the final tag is out and the schema diff is clean.

🙅 One Thing to Ignore

vudovn/ag-kit and the harness-kit lane generally — registered today, still not worth time. ~8,000 stars for a bundle of rules, skills, specialist agents, workflows, memory and MCP guidance scoped to a single harness. It is registered because at that size it is a market fact rather than the 0★ churn the lane usually produces, but nothing in it is portable: the value is entirely in the fit to one harness, and the fit is exactly what you lose when you switch. What would flip it to study-now: a bundle format that installs unmodified across two or more harnesses, at which point the interesting object is the format, not the bundle. Also holding from prior days: the grey-area free-tier stacking lane (tashfeenahmed/freellmapi +88/d, EvanZhouDev/openai-oauth +43/d) — a real price signal about inference, still not adoptable for anything commercial; and the Go/Rust window-sweep flood (superfile, Pumpkin, rustdesk, vaultwarden, tailscale, headscale, rust-lang/rust, wails, litestream, ntfy, navidrome, nushell, biome, candle, rolldown) — high velocity, no agent/MCP surface.

✍️ Writing Angle To Explore

• "The SDK shipped before the spec" — written up today as articles/2026-07-28-sdk-before-spec.md. First content-lane note of ISO week 31 (target 2/week, Tue + Fri).

💡 Surprise Pick

raine/workmux (1,947 ⭐, Rust, MIT, created 2025-11-04) — git worktrees plus tmux windows, one command, no AI anywhere in it. It set a new all-time daily peak today at +21/d, which is noise by board standards and is the point: the parallel-agent tools that trend at fifty times that velocity all assume per-agent filesystem isolation and mostly do not provide it. This is the fourth instance this month of the same filter lesson — "does it call a model?" rejects it; "does it change what a model is for?" registers it.

📊 Supply vs. Demand

What's being built (supply)	What people want (demand)	Match?
MCP TS SDK v2.0.0 GA + codemod + server-legacy + two split migration guides	"A migration path that separates moving packages from adopting the wire protocol"	✅ Met, and better than asked
Official Hono / Fastify adapters at GA	"Mount MCP into an existing Node service without hand-rolling transport"	✅ Met
open-code-review: ~1/9 tokens, precision over recall, MCP server, 4 CI integrations	"Review that costs less per PR and stops burning reviewer-minutes on false positives"	✅ Met on the tool; ❌ unmet on cross-repo PR visibility and review SLAs
AAS Core: agent-owned selection + deterministic validation + plan preview	"Let the agent choose skills, but gate the choice and give me a plan to approve"	✅ Met
strix: dynamically-validated PoCs, self-proving reports	"An intake whose throughput doesn't scale with human hours" (curl, 07-27)	✅ Partially — and it can worsen the problem if pointed at someone else's queue
Python v2.0.0rc1, Go v1.7.0-pre.3, Rust beta.3	"GA MCP SDKs outside TypeScript"	❌ Unmet — the day's sharpest gap
openwork at 17,319 ⭐	"A self-hostable Cowork equivalent with a resolvable license"	❌ Unmet (NOASSERTION)
Five agent-memory repos, 80K+ combined stars, four incompatible architectures	"One memory layer for conversation recall and code knowledge graphs"	❌ Unmet — proliferation is the signal
Static evals and 500-question benchmark sets	"Longitudinal agent-quality measurement over weeks of real sessions"	❌ Unmet (context rot: 11 of 12 models below 50% past 32K)
Generation tooling at every layer	"Centralized cross-repo PR visibility with risk scoring and review SLAs"	❌ Unmet — standing gap, 8.1M PRs / +91% review time

📊 Category Pulse

Category	New Today	Trending Count	Signal
unregistered / off-lens	0	41	Go/Rust window sweep; standing filter
code-dev-tools	0	6	open-code-review at #1 carries the category
agent-frameworks	0	5	openwork new peak; licensing unresolved
misc	0	5	airi, meetily — consumer-agent lane
coding-agent-tooling	2	3	AAS Core + ag-kit; the skills cohort left the board
model-gateway-routing	0	3	grey-lane free-tier stackers still compounding
agent-infra	0	2	strix flipped fading → rising at 241% of peak
agent-memory-rag	1	1	DocsGPT registered; a 2023 survivor, not a new signal
mcp-protocols	0	1	sirkirby/unifi-mcp only — see Pipeline note

🛠 Pipeline

• ✅ CLOSED — the age-aware fade rule (07-26 caveat, 07-27 action item). The >80%-off-peak test now applies only to repos with first_seen within 90 days and absolute velocity under 60/day. First run suppressed four artifacts the old rule would have flipped: ruvnet/ruflo (peak 2192, today 172), mvanhorn/last30days-skill (2684 → 240), aaif-goose/goose (751 → 83), XTLS/Xray-core (339 → 38) — every one a mature repo whose "peak" was a one-off trending spike, exactly the prisma/iroh failure mode named yesterday. New gap exposed by the fix: the ratio rule cannot see a repo that leaves the board entirely, and all four of today's genuine fades were board exits. Next action: treat "on the daily board yesterday, absent today, prior velocity > 300/d" as its own flip condition.
• ⚠️ score.py — 7th consecutive day unusable. Returned 80 items with no separating score; weekly/monthly carry-over mixed into the top rows again. Today's anchor came from GitHub release tags and registry.npmjs.org, sources score.py does not read at all. Standing conclusion firm: one input, never the frontier. Snapshot and registry passes read github.json raw.
• ⚠️ YouTube fetcher — 19th consecutive dead day, 0 results, 3-byte output. Recommendation unchanged and now overdue: remove it from the daily run and reclaim the 60s.
• ⚠️ HN fetcher — 5 hits, all 5 carried from prior days (the Libretto / ports-and-adapters / Browser Tools / OneCLI cluster, ~23rd recurrence). The widen-terms fix — split into separate "AI agent" / "coding agent" / "MCP" runs — is now 15 days pending and remains the longest-open item in this file. On the day MCP shipped its largest revision since launch, an HN query containing the word "agent" returned nothing about it.
• ✅ Web-research agent — recency fix partially effective. 17 signals, and the dated cluster is genuinely fresh this time (Kimi-K3 07-27, Anthropic open-weights 07-27, SlopCodeBench 07-27, Bun-rewrite audit 07-27, x402 Foundation 07-22, Aion 1.0 07-22). Still no days_old field, and four items are Feb–Jun background (review-bottleneck 04-24, context rot 04-11, license wars 07-06, ICLR reviews). Also newly confirmed: reddit.com is hard-blocked for both WebFetch and WebSearch — 400 via allowed_domains, 403 direct and via mirrors. Reddit signal is currently arriving only second-hand through aggregators, which is worth stating in every briefing that cites it.
• ⚠️ Aggregator claims contradicted by primary sources — new standing check. Web search summaries today asserted "the final specification shipped on July 28, 2026." The repo says 2026-07-28-RC (2026-05-29) is the only tag, schema/ has no such directory, and the GA post is a draft PR. Rule going forward: for any release claim, read the tag, the schema/ tree, or the registry — never the announcement.