Transport (stdio / HTTP / SSE)
Also called: MCP transport
The channel an MCP client and server use to exchange messages — a local subprocess pipe, or a networked HTTP connection.
MCP defines two transport families. stdio: the client launches the server as a child process and exchanges JSON-RPC messages over standard input and output — local only, no network. HTTP: the server is a web service the client reaches over the network. The original HTTP transport used a POST endpoint plus a long-lived Server-Sent Events (SSE) stream; the March 2025 spec revision replaced it with "Streamable HTTP", though SSE-style deployments are still in the wild.
Why it matters
Transport determines exposure. A stdio server's risk is mostly about what code you chose to run locally. An HTTP server is reachable infrastructure — it can be port-scanned, indexed, and accessed by anyone who can route to it unless authentication and network controls are in place. Fingerprinting the transport is how an outside observer tells "someone is running an MCP server here" without interacting with it.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.