Transports
Local vs remote: the two transports
Same JSON-RPC messages, two ways to carry them. The next two slides look inside each one.
stdio
stdinstdout
Hostspawns process
Serverchild process
- Newline-delimited JSON on stdin and stdout; logs go to stderr.
- One client, local only, no network exposure.
- Credentials come from the environment (e.g. env vars).
Streamable HTTP
POST JSON-RPCJSON or SSE stream
Clientanywhere
ServerPOST/GET /mcp
- A single endpoint. The server replies with plain JSON, or opens an SSE stream to send progress and server-initiated requests.
- Many clients, with sessions tracked by an
Mcp-Session-Idheader. - Auth with standard HTTP: OAuth 2.1 bearer tokens.
The older “HTTP + SSE” transport (two endpoints, from the 2024-11-05 spec) is deprecated in favour of Streamable HTTP.