03.04 · Concept
Transports: stdio and HTTP
Pick a transport and explain what changes about deployment and trust.
Stdio treats an MCP server as a local child process, while HTTP treats it as a networked service. The protocol messages can stay similar, but deployment, lifecycle, access control and trust move to different places. The transport choice decides whether you are securing local execution or a reachable service.
What this lesson answers
- when should MCP use stdio instead of HTTP
- how does MCP transport affect deployment trust boundaries
- what changes when MCP runs over HTTP
Notes
A transport is the way two MCP participants move protocol messages between each other. With stdio, the client starts a server process locally and talks to it through standard input and output streams. With HTTP, the server is a network service with an address, and clients send requests over the network. The MCP messages may describe the same tools, resources, and prompts, but the operational shape around those messages changes a lot.
The mental model is “local subprocess” versus “remote service.” Stdio feels like running git or a language server: the client owns process startup, environment…
Common questions
- What is the practical difference between stdio and HTTP for MCP?
- With stdio, the client launches a local server process and exchanges messages through standard streams. With HTTP, the server is a separately running network service. That changes who manages startup, shutdown, configuration, routing, credentials, observability and failures, even if the MCP tools and resources exposed by the server look the same.
- Is stdio or HTTP safer for MCP servers?
- Neither transport is inherently safer. Stdio concentrates risk in local execution: the server may inherit user permissions, local filesystem visibility and environment secrets. HTTP shifts risk to service exposure: identity, authentication, authorisation, tenancy and remote attack surface matter. The safer choice depends on which boundary you can control and monitor better.
- When should I choose HTTP for an MCP server?
- Choose HTTP when the server needs to be reached across machines, shared by multiple clients, deployed independently, or operated like a normal backend service. That means accepting the operational work of hosting, TLS, routing, versioning, monitoring and access control. It is a service boundary, not just a different wire format.
Short definition: what is Transports: stdio and HTTP?