The two standard MCP transports
The 2026-07-28 MCP specification defines two standard transports. With stdio, the client launches the server as a local subprocess and exchanges newline-delimited JSON-RPC messages over its standard input and output. With Streamable HTTP, the server runs on its own and the client sends each message as an HTTP POST to one MCP endpoint.
Protocol behavior is the same on both. What differs is who runs the code, what it can reach and who else can connect to it. The older HTTP+SSE transport from 2024-11-05 is deprecated, and new implementations should not adopt it.
stdio: a local process with your privileges
A stdio server is an ordinary process started by your AI application under your user account. It inherits the environment it was launched with, can read whatever your account can read, from SSH keys to cloud credentials, and can open network connections. The transport provides no sandbox.
MCP's OAuth flow does not apply here; stdio servers should get credentials from their environment. That makes the launch command in your client configuration the real security decision. These are the common problems:
- Unpinned packages: a command like npx -y some-mcp-server can pull a newer version whenever it runs. A compromised release then reaches your machine without any change on your side. Pin an exact version.
- Partial pins: a version pinned through npx or uvx fixes only the top-level package, and dependencies are usually resolved fresh. A container image pinned by digest freezes the whole tree.
- Shell wrappers: launching through sh -c, bash -c, cmd /c or PowerShell adds a parsing step where metacharacters can run extra commands. Call the executable directly with plain arguments.
- Temporary directories: places like /tmp are often writable by other users or processes, so the program you approved can be swapped. Keep server executables in a protected location.
- Secrets in the file: keys in env blocks can end up in backups and shared configs, and command-line arguments are visible in process listings.
Streamable HTTP: a network service
A Streamable HTTP server exposes one endpoint, such as https://example.com/mcp, that accepts POST. Each request gets either a single JSON response or a Server-Sent Events stream scoped to that request.
The 2026-07-28 revision removed protocol-level sessions, the Mcp-Session-Id header and the standalone GET stream. Each POST now carries MCP-Protocol-Version and Mcp-Method headers, plus Mcp-Name for tool calls, resource reads and prompt requests, all mirrored from the JSON body.
Servers must reject a request with 400 Bad Request when a header and the body disagree. That stops a proxy that routes on headers and a server that acts on the body from being played off against each other.
Remote servers otherwise need the protections of any web API. Use HTTPS, because the OAuth access token travels in the Authorization header of every request. Use the MCP authorization flow with tokens bound to the server, and validate inputs, rate limit and log on the server side.
Local HTTP servers and DNS rebinding
An HTTP server on your own machine can be reached by any local process and, through your browser, by websites. In a DNS rebinding attack, a page on an attacker's domain switches that domain's DNS answer to 127.0.0.1. Script on the page can then send requests to your local server and read the replies.
The specification requires servers to validate the Origin header on every incoming connection and to answer 403 Forbidden when an Origin is present and invalid. Local servers should bind to 127.0.0.1 instead of 0.0.0.0 and should authenticate every connection.
Binding to loopback keeps other machines out, but it is not authentication. Any program on the same machine can still connect, which is why a token or an access-restricted socket is still needed.
How to choose a transport
Choose by what the server needs to touch.
- Use stdio when the server must work with local files, local tools or hardware. Pin it, launch it directly and run third-party servers in a container with only their working directory mounted.
- Prefer a remote Streamable HTTP server when it only wraps an internet API. It runs no code on your machine, uses the authorization flow instead of a token in a local file, and is patched in one place.
- If you must run a local HTTP server, validate Origin, bind to 127.0.0.1 and require a token. MCP's security guidance recommends stdio for local servers because only the launching client can talk to them.