A duplicate-charge bug in an MCP tool, found by static analysis before it shipped A few weeks ago I ran a small side project of mine — Nexum , a deterministic static scanner for OpenAPI/MCP specs — against a public MCP server: adotob-mcp by Fabian Williams . It flagged something real. The finding The purchase_free_bundle tool had no idempotency protection. In plain terms: nothing in the spec stopped the same call from executing twice. For a human-driven API, tha...