[tirth8205/code-review-graph](https://github.com/tirth8205/code-review-graph) hit **#1 on GitHub Trending on July 19, 2026** with 20k+ stars in a week. Tree-sitter → persistent SQLite graph of functions, call-chains, imports and blast-radius; exposes 30 MCP tools (semantic search, hub/bridge detection, refactor previews). Claims 8.2× context reduction, 52% lower review token cost on a 1,200-module monorepo.
[rohitg00/agentmemory](https://github.com/rohitg00/agentmemory) — "persistent memory for AI coding agents," one MCP server shared across Claude Code, Cursor, Codex, Cline, Windsurf. Reports **95.2% R@5 on LongMemEval-S vs mem0 68.5% and Letta/MemGPT 83.2%**; ~25k stars. Momentum peaked May–June but still surfacing in this week's trending.
[diegosouzapw/OmniRoute](https://github.com/diegosouzapw/OmniRoute) passed **20k stars in days (mid-July 2026)**. Self-hosted OpenAI-compatible `/v1` proxy: 500+ models, quota-aware auto-fallback, MCP/A2A support, and "RTK+Caveman" prompt compression claiming 15–95% token savings.
[Cloudflare blog](https://blog.cloudflare.com/moltworker-self-hosted-ai-agent/) (**updated July 15, 2026**). Runs a personal AI agent on Workers + Sandbox SDK: entrypoint Worker as API router, isolated Sandbox container, **R2 for persistence via `sandbox.mountBucket()`**, AI Gateway routing to Claude (BYOK), Browser Rendering with MCP, Zero Trust on admin.
[Beta SDKs shipped](https://blog.modelcontextprotocol.io/posts/sdk-betas-2026-07-28/); spec finalizes **July 28**. Largest revision since launch: **stateless transport** (drops the `initialize` handshake + sessions — any instance handles any request), Multi-Round-Trip Requests (`InputRequiredResult` for mid-tool user input), routable `Mcp-Method`/`Mcp-Name` headers, hardened OAuth (RFC 9207 issuer validation, DCR `application_type`), error codes standardized to JSON-RPC (`-32602`), and roots/sampling/logging deprecated. TS SDK **v2 beta** (ESM-only, Node 20+, split packages); Python **2.0.0b1** (`FastMCP` → `MCPServer`).
[v0.115.0](https://github.com/anthropics/anthropic-sdk-typescript/releases/tag/sdk-v0.115.0) (**July 24**) adds the **`claude-opus-5`** model, tool addition/removal blocks + `tool_change` events, and server-side fallback defaults. v0.114.0 (Jul 23) added a `model_context_window_exceeded` stop reason; v0.113.0 added Managed Agents model effort + thread delta streaming.
[workers-types v5](https://developers.cloudflare.com/changelog/post/2026-07-03-workers-types-v5/) exposes only the latest runtime types (experimental entrypoint for unstable APIs) — a breaking simplification. Wrangler **4.113.0** (Jul 21) ships `wrangler flagship`, a CLI suite for feature flags/rollout/split without redeploying Workers.
[v0.32.3](https://releases.sh/ollama) (**July 23**); v0.32.0 (Jul 11) added an interactive agent (chat/code/web-search/delegation) on `ollama` launch. New models: **Kimi K2.7 Code** (Moonshot) and Laguna XS 2.1 (33B/3B MoE, agentic coding).
[The Register, Jul 23](https://www.theregister.com/devops/2026/07/23/model_context_protocol_prepares_to/) + [TokenMix changelog](https://tokenmix.ai/blog/mcp-updates-changelog-every-protocol-change-2026): the spec finalizes **July 28**. It removes the `initialize`/`initialized` handshake and `Mcp-Session-Id` header (stateless core — no more sticky sessions/shared session stores), moves **Tasks** out of core into a wire-incompatible extension (`tasks/get|update|cancel`, ~10h migration/server), and adds **MCP Apps** (sandboxed-iframe UI returned by tools). Servers on the new revision won't interop with old clients.
[Mem0 alternatives roundup, re-verified Jul 19](https://techsy.io/en/blog/best-ai-agent-memory-tools): **Zep retired its self-hosted Community Edition** (Graphiti stays OSS), **Pinecone** dropped vector-count caps for GB pricing, **Mem0** tripled free-tier limits, **Letta** shipped a $20/mo self-host-to-cloud Pro tier. Consolidation around extract+retrieve platforms layered over Pinecone/Redis.
[BleepingComputer](https://www.bleepingcomputer.com/news/security/hugging-face-breach-autonomous-ai-agent-system-internal-datasets-credentials/) / [The Hacker News, Jul 16](https://thehackernews.com/2026/07/worlds-largest-ai-model-repository.html): an autonomous agent uploaded a malicious dataset, chained two code-exec bugs in the dataset pipeline, escalated to node-level, harvested credentials and moved laterally over a weekend — **17,000+ logged actions**. Sysdig separately tracks JADEPUFFER agentic ransomware encrypting model weights/vector indexes.
[Cloudflare blog](https://blog.cloudflare.com/durable-object-facets-dynamic-workers/) + [releases.sh, Jul 2026](https://releases.sh/cloudflare): **DO Facets** let Dynamic Workers spin up per-app isolated SQLite DBs on the fly; this week Wrangler moved DO class lifecycle to **declarative config** (replacing the imperative migrations array) and added `evictDurableObject()` test harness support.