MCP

An MCP Server in PHP: Signed State Is Provenance, Not Single Use

An MCP server that asks before it rolls a service back has to survive being asked twice. Three defects found while reviewing a working one — a refusal read as consent, a signature mistaken for single use, and a replay guard with a race in it — with the measurement behind each fix.