AI News, Volume 34: The Agent Stack Goes Stateless
MCP sheds hidden sessions, OpenAI turns plugins and tool programs into runtime primitives, Microsoft serves skills remotely, and GitHub hardens the path from agent-written code to production.
The Agent Stack Goes Stateless
MCP sheds hidden sessions, OpenAI turns plugins and tool programs into runtime primitives, Microsoft serves skills remotely, and GitHub hardens the path from agent-written code to production.
Front Page
The infrastructure beneath agents is being rebuilt for scale and control.
MCP’s July 28 specification introduces a stateless protocol core, explicit discovery, multi-round-trip requests, tasks, extensions, and hardened authorization; Cloudflare and official SDKs already provide migration paths.
OpenAI expanded Codex with Agent Plugins, forkable histories, secure skill discovery, and remote execution while hardening Programmatic Tool Calling and launching ChatGPT-based partner sign-in.
Microsoft Agent Framework can now retrieve centrally published skills over MCP.
GitHub added workflow holds, broader malicious-package alerts, and npm publish-time malware screening.
Copilot gained Grok 4.5, attributable app metrics, and a coming default model-enablement policy.
Vercel added regional inference and WebSocket Responses transport.
Gemini Enterprise now exposes planning before tool use.
New loop engines place stages, budgets, verifiers, and termination outside the model.
Today’s AI News Stories
MCP replaces hidden server sessions with an explicit stateless core
The Model Context Protocol reached its scheduled July 28 release with a stateless protocol core designed for remote tool servers that need to scale behind ordinary load balancers.
The revision adds server/discover, Multi Round-Trip Requests, an extensions framework, tasks, MCP Apps, authorization hardening, and a formal deprecation policy. The central architectural change is that a server no longer needs protocol-level session state, sticky routing, or a shared session store for ordinary remote tool calls. Applications that require continuity can pass explicit handles through tool inputs and store durable state in their own backends.
Implementations arrived alongside the specification. Cloudflare Agents SDK 0.20.0 can expose tools, prompts, resources, and elicitation through Workers without requiring a transport session or Durable Object. Its client manager probes server/discover and falls back to legacy initialize when needed. The official Go SDK negotiates the highest mutually supported version and exposes stateless request metadata, multi-round-trip behavior, subscriptions, and deprecation handling. The TypeScript server SDK moved to a stable v2 package line built around the new specification.
Stateless transport makes MCP more compatible with horizontal scaling, ordinary HTTP infrastructure, retries, tracing, and regional routing. It does not make application state disappear. Cursors, jobs, files, transactions, approvals, and long-running operations still need durable identifiers and explicit recovery rules.
Platform teams should inventory their assumptions about initialize, Mcp-Session-Id, roots, sampling, logging, server-pushed calls, and resumability. A safe migration should negotiate versions, preserve a legacy route during rollout, and test what happens when consecutive calls land on different server instances.
OpenAI turns plugins, tool programs, and identity into agent-runtime primitives
OpenAI released a cluster of agent-platform changes on July 29 spanning Codex, the Agents SDK, and partner authentication.
Codex CLI 0.146.0 introduces Agent Plugin manifests, workspace plugin publishing, additional plugin marketplaces for Amazon Bedrock and Claude Code, forkable threads with paginated history, WebSocket connections from the app server to remote Code Mode hosts, standalone web search for compatible custom providers, and executor-provided skill discovery with secure resource reads.
The release makes a coding session more portable and extensible. A thread can branch into alternative approaches without losing history. Skills can be supplied by the execution environment rather than copied into every workspace. Plugins can be distributed through several marketplaces. Remote Code Mode separates the interactive client from the machine performing the work.
OpenAI Agents SDK 0.19.1 also hardens Programmatic Tool Calling, introduced in 0.19.0. The feature allows generated JavaScript to coordinate bounded tool sequences while the runner retains streaming, approvals, guardrails, sessions, and tracing. The patch adds native host paths to sandbox grants and fixes redaction, WebSocket retries, streamed input, memory counting, trace batching, and guardrail cancellation.
Finally, Sign in with ChatGPT began a beta rollout for selected plugins and partner sites, initially including Airtable, GitLab, HubSpot, Notion, Supabase, and Vercel. Account linking shares basic profile information, while access to each plugin remains subject to a separate permission approval.
Together, the changes create a broader runtime surface—and a broader trust surface. Teams should review plugin provenance, marketplace policy, thread-fork state, remote-host authority, sandbox grants, generated tool programs, and identity scopes before enabling the new extension points in managed environments.
Microsoft makes Agent Skills a remotely governed dependency
Microsoft Agent Framework for .NET can now discover and load Agent Skills directly from MCP servers through the Microsoft.Agents.AI.Mcp package.
A central team can publish a skill once and allow connected agents to retrieve either skill-md resources or packaged skill archives over an authenticated MCP connection. The pattern moves skills beyond local Markdown files and per-repository copies. Domain procedures, runbooks, and reusable workflows can be distributed as runtime dependencies from a shared source.
Central distribution improves consistency. A compliance team can update one approved procedure instead of asking every application team to replace embedded instructions. It also creates a new software-supply-chain path. A skill can influence planning, tool selection, script execution, and the interpretation of business policy without changing the model or application binary.
Agent teams should therefore manage skills like packages. Each skill needs an owner, immutable version, integrity check, provenance record, compatibility declaration, review history, and rollback path. Archived bundles need size limits and content inspection. Executable scripts should require a stronger approval class than descriptive instructions.
The client should record which skill version entered each run and should not silently replace a pinned version during an active task. Authentication to the MCP server establishes where a skill came from; it does not establish that every retrieved artifact is safe for every agent. Authorization and policy still need to govern which skills a particular runtime may load.
GitHub adds three checkpoints against agent-amplified supply-chain attacks
GitHub released three software-supply-chain protections on July 28 that are directly relevant to autonomous coding and release workflows.
GitHub Actions now holds certain potentially malicious workflow runs in public repositories until a collaborator with write access approves them through an authenticated web session. The control targets attacks in which compromised credentials are used to push workflow changes that steal CI/CD secrets or extend an intrusion.
Dependabot’s malware alerts now ingest advisories from the OpenSSF malicious-packages repository, expanding coverage beyond npm into ecosystems including PyPI. Repositories and organizations with malware alerting enabled receive notifications when a dependency matches the broader advisory set.
GitHub also added npm publish-time malware screening. A newly published package can proceed normally, be held for manual review, or be blocked before it becomes installable. New contentPolicy metadata and a DISCLOSURE file requirement support legitimate dual-use security packages.
The controls matter because coding agents operate on both sides of the package boundary. They can modify workflow files, add dependencies, generate release automation, and publish packages. A single compromised instruction or dependency suggestion can otherwise move rapidly from source change to privileged CI execution.
Teams should classify workflow files, dependency manifests, lockfiles, and publishing configuration as high-risk agent output. Deterministic tests are not enough when the change affects the test runner itself. Require human review for automation changes, enable malware alerts, use protected publishing identities, and make agent loops understand that a held workflow or delayed package is a security state—not a failure to bypass.
GitHub shifts Copilot model choice from one-time approval to active governance
GitHub added Grok 4.5 to Copilot on July 28 across VS Code, Visual Studio, Copilot CLI, the cloud agent, the Copilot app, JetBrains, Xcode, and Eclipse. GitHub positions the model for complex multi-step coding work with up to 500,000 tokens of context, text and image inputs, and adjustable reasoning effort. Business and Enterprise administrators must enable its policy.
The following day, GitHub announced a broader default model-enablement policy for Copilot Business and Enterprise. The setting is configurable now and takes effect on August 26. Generally available models without an explicit administrator choice will inherit the enterprise or organization default. Existing explicit enable or disable decisions remain intact. Open-weight models and models outside GitHub’s data-retention agreement are excluded from automatic enablement.
GitHub also expanded Copilot app metrics. Reports can now attribute sessions, requests, prompts, and token use to individual users and include app activity in model, language, code-activity, lines-of-code, feature, and daily-active-user rollups.
The combination changes model governance from a static allowlist exercise into an ongoing operating process. New models can enter approved pools by default, while telemetry provides more evidence about which surfaces and models are actually being used.
Administrators should decide before August 26 whether inherited enablement matches their risk posture. Regulated teams may prefer explicit model pinning. Platform teams should also update metrics pipelines so model availability, token use, user adoption, and autonomous cloud-agent activity can be reviewed together rather than as separate product dashboards.
Vercel moves residency and persistent transport into the gateway
Vercel added two AI Gateway controls that affect long-running and regulated agent workloads.
Regional inference lets applications request U.S. or European Union processing through an inferenceRegion field. The serving region is returned with the response, and the gateway can fail closed when no provider is available in the requested geography. This creates a provider-independent residency policy rather than requiring each model integration to implement its own location logic.
Vercel also added WebSocket support for OpenAI Responses API traffic. Persistent connections can continue from a previous_response_id, operate with store=false, and support Zero Data Retention-compatible configurations.
Agent loops benefit from both features. A gateway can enforce where repeated model calls are served, while a persistent connection can reduce transport overhead for long tool sequences and realtime sessions. The combination is useful only if the policy and evidence remain visible across provider routing.
Teams should log the requested and actual region for every run and decide whether fallback to another provider is allowed when residency cannot be met. They should benchmark WebSocket transport against ordinary requests under tool-heavy workloads, test reconnect behavior, and verify how continuation identifiers, audit records, and non-storage settings interact.
A gateway can centralize policy, but it can also hide provider changes. Residency, retention, price, latency, and model identity should remain explicit fields in the agent trace.
Gemini Enterprise exposes planning before the tool call
Google made Transparent thinking generally available in Gemini Enterprise on July 27. During an interaction, the product can display real-time planning in the user interface before it calls tools or data sources. Google also supports exporting Canvas output to Google Workspace, Microsoft Office formats, and PDF.
Visible planning can help a user understand the intended direction of a multi-step task before the agent crosses an external boundary. A plan might reveal that the system intends to query a sensitive source, create an artifact, or use a tool the user did not expect.
The interface should not be mistaken for a complete safety proof. A displayed plan may be simplified, may change during execution, or may omit the internal factors that produce a tool choice. It is most useful when connected to actionable controls: inspect the proposed tool, narrow its scope, require approval, or stop the run.
Enterprise teams should evaluate whether the planning view improves intervention and whether the final trace records changes between the displayed plan and actual actions. They should also test how much sensitive context appears in the interface and who can view retained planning data.
Transparent planning is strongest as one layer in a trace system. The durable record still needs structured tool calls, inputs, outputs, approvals, identities, and results that can be audited independently of the model’s explanation.
Outer-loop engines put stages, budgets, and termination outside the model
New practitioner projects are converging on a two-loop architecture for autonomous agents: a model-driven inner loop performs the immediate task, while an external workflow engine governs stages, artifacts, resources, and stopping behavior.
Atomic’s “Building a Loop Engine” describes typed TypeScript workflows with named stages, explicit artifacts, gates, model selection, fallback chains, pause and resume controls, and persisted run state. The model’s ReAct process is treated as an inner loop inside an observable and resumable outer runtime.
OpenLegion documents a related control-plane design with sandboxed agent containers, mesh-managed credentials, browser isolation, shared blackboard state, scheduled and event-driven triggers, and external budget enforcement. Its task mode has a 20-iteration bound. Chat mode uses tool-round limits, compaction ceilings, and duplicate tool-call detection that escalates from warning to blocking and termination.
Comet adds phase guards, resumable tasks, workflow artifacts, and skill evaluation using rubric, Pass@k, and Pass^k measures. The common design choice is to move critical constraints out of prompt text and into code and persisted state.
Teams do not need to adopt any one of these projects to use the pattern. A production loop should have named stages, input and output contracts, a durable checkpoint, a resource budget, an independent verifier, and explicit stop states. The model may recommend continuing; the harness should retain final authority over whether it can.
Opinion: What This Means for Harness Engineering
Opinion: Stateless MCP and stateful outer loops are not contradictory. They are a healthy separation. The transport should avoid hidden server sessions, while the application should represent meaningful state explicitly through job handles, artifacts, checkpoints, and versioned skills. Hidden state is difficult to route and debug; explicit state can be governed.
The OpenAI and Microsoft releases also show extension systems becoming supply chains. Plugins, skills, tool programs, remote hosts, and identity links can all change agent behavior without changing the base application. Harnesses need provenance and admission control for behavioral dependencies, just as software platforms need them for packages.
GitHub’s workflow holds and malware screening provide a useful model for agent gates. High-risk transitions should not look like ordinary retries. A held workflow, blocked package, denied skill, or failed regional route should become a distinct state that requires an authorized decision, not another attempt from the same model.
Finally, every agent trace should answer five questions without reconstructing a chat transcript: which model ran, which extensions were loaded, which identity authorized the action, where the computation and data went, and which independent check accepted the result. The systems in this issue are beginning to expose those facts. Harness engineering must connect them.
Closing Note
The agent stack is becoming easier to scale precisely because its hidden assumptions are being pulled into the open: sessions become handles, skills become versioned dependencies, models become policy choices, and loops become typed state machines. That explicitness is the foundation for reliability—and for knowing where to stop.
References
If you are a paid subscriber, thank you. Your support makes this work possible.
If you are a free subscriber and find these articles useful, please consider upgrading. A paid subscription is $80 per year or $8 per month.
Free subscribers typically receive access to the full versions of paid articles after one to two months.
About the Author — Claude Certified Architect
Rick Hightower is a former Senior Distinguished Engineer at a Fortune 100 company, focusing on delivering ML / AI insights to front-line applications, and a practitioner building multi-agent production systems. Follow him on SubStack and Medium for more hands-on agent engineering content. You can also book him to speak and train your team: Check out Rick Hightower’s SpeakerHub.
Rick Hightower helps companies become AI-first through practical mentoring, executive and team training, and custom AI solution development. He is a former Senior Distinguished Engineer at a Fortune 100 company, where he focused on bringing ML and AI insights into real front-line business applications.
Subscribe to Rick’s newsletter to see videos and guides.
Rick is a Claude Certified Architect, AI systems practitioner, and builder of production multi-agent systems. He is currently working on authoring a book on Harness Engineering with Manning Publishing. He created Skilz, a universal agent skill installer supporting 30+ coding agents, including Claude Code, Gemini, Copilot, and Cursor, and co-founded one of the largest agentic skill marketplaces.
Today, Rick and the Spillwave team work with leaders and teams who want to move beyond AI experiments and build real AI capability inside their companies. He helps organizations adopt AI safely, train their people, redesign workflows, and build practical AI systems that create measurable business value.
Ready to make your company AI-first? Connect with Rick on LinkedIn, Substack, or Medium, book him to speak or train your team, or visit Spillwave to explore mentoring, training, and custom AI solutions for your organization.
Before we get into it, please consider subscribing to my Substack newsletter.
If this kind of practical, production-minded AI work is useful to you, a subscribe, like, comment, or share really helps grow the channel and supports the work.
Thank you for reading and helping these ideas reach more builders.