Transport Choice: stdio and Streamable HTTP

stdio

The local host spawns a child process. JSON-RPC messages flow through stdin and stdout.

Best for: Local developer tools, single-user desktop integrations, and simple setups.

Important: Reserve stdout for the protocol; send logs to stderr. Pass secrets through configuration or environment variables, and restrict child-process permissions.

Streamable HTTP

A remote network endpoint operating over HTTP. In the current SDK, it is the recommended transport for remote serving.

Best for: Shared remote services, managed authentication, multiple users, and centralized deployment.

Needs: TLS, authentication, Origin/Host validation, request limits, timeouts, monitoring, and a state strategy.

Legacy note

Older tutorials may show a standalone HTTP+SSE transport and @modelcontextprotocol/sdk v1 imports. New TypeScript projects should start with the stable v2 split packages. Before choosing legacy compatibility, verify the actual clients you need to support.