When someone installs an MCP server, they pick a transport. Almost always for convenience, and almost never with the reason written down. That choice determines attack surface, identity model and what you are able to log — and the two options fail in opposite ways.
stdio: no port, but not no risk
With stdio transport, the client launches the server as a child process and talks over standard input and output. Nothing listens on a port, which produces a comforting feeling: a network scan finds nothing.
The risk moved, it did not disappear. The server inherits the context of the user who started it — environment variables, tokens, SSH keys, cloud session. And the launch mechanism itself became a systemic vulnerability: OX Security's April 2026 research described configuration parameters passed straight to the operating system shell without sanitisation, reaching the official SDKs across four languages, with an estimated 200,000 servers potentially affected.
No port does not mean no surface. It means the surface is the process, and you are not looking at it.
HTTP: auditable, and frequently open
HTTP transport makes the server a conventional network service — which is good, because fifteen years of tooling applies: WAF, gateway, mTLS, access logs. The problem is that it also becomes reachable by people you did not anticipate.
The available measurement is not encouraging: a large-scale study found roughly 40% of remote servers exposing their tools with no authentication at all. And a remote server without authentication is not a vulnerable server — it is a public action-execution API.
How to decide
- Single-user tool on the user's machine → stdio, with validated configuration arguments and the process isolated from the rest of the user's environment.
- Service shared by several agents or people → HTTP with OAuth 2.1, audience validation and centralised logging. Improvising here is not worth it.
- Never: HTTP on 0.0.0.0 without authentication “because it is internal only”. Internal networks became flat perimeters at most companies.
What to record about the decision
Write down, per server: transport chosen, reason, who can reach it, which identity the process carries and where the logs go. Five lines. The absence of those five lines is what turns a convenience choice into a permanent architectural decision nobody can justify six months later.
