**An MCP transport** is the wire layer that carries JSON-RPC 2.0 messages between an MCP client and an MCP server. The protocol defines the message shapes; the transport defines how the bytes actually travel.
Two transports are in active use in 2026.
**Stdio** is the default for local servers. The host launches the server as a child process and they exchange newline-delimited JSON over standard input and standard output. Standard error is reserved for log output. Stdio is zero-configuration: the user adds a server by editing a config file with the launch command, and the host runs it on demand. No network ports are opened. Most personal-productivity servers use stdio: filesystem, fetch, memory, sqlite.
**Streamable HTTP** is the standard for remote servers. It uses a single HTTP connection with bidirectional streaming and OAuth 2.1 with PKCE for authentication. SaaS-backed servers like GitHub, Slack, Linear, Notion, and Sentry use this transport.
The earlier **HTTP plus SSE** transport used a separate Server-Sent Events stream for server to client messages. It was deprecated late 2025 because operating two connections proved more complex than the gains justified. New servers should not target it.
From host code, calling a tool on a stdio server and calling a tool on a streamable HTTP server looks identical. Only the connection setup differs. The protocol is transport-agnostic by design.
**An MCP transport** is the wire layer that carries JSON-RPC 2.0 messages between client and server. MCP is transport-agnostic: the same `tools/list`, `tools/call`, and `resources/read` messages travel over whichever transport fits the deployment shape.
Two transports are in active use as of 2026.
**Stdio** is the default for local servers. The host launches the server as a child process. Messages are newline-delimited JSON over stdin and stdout; stderr is reserved for log output. Properties: zero configuration (user adds a config entry with the launch command), no network exposure (no ports opened), and sandboxing inherited from the host's process boundaries. Most official reference servers (filesystem, fetch, memory, sqlite, sequential-thinking) use stdio.
**Streamable HTTP** is the 2026 standard for remote servers. It uses a single HTTP connection supporting bidirectional streaming, with OAuth 2.1 plus PKCE for authentication. It replaced the earlier HTTP plus SSE transport, which used a separate Server-Sent Events stream for server to client messages and was deprecated late 2025. Multi-tenant SaaS servers (GitHub's Go-rewritten server, Slack, Linear, Notion, Sentry, Stripe) use streamable HTTP.
The transport-agnostic design means the JSON-RPC framing, capability negotiation, and request handling are identical regardless of transport. From host code, the only difference is the connection setup phase. Future transports can be added without breaking existing implementations.
The decision is simple: local subprocess servers get stdio. Remote services get streamable HTTP. HTTP plus SSE is legacy; do not target it.
Quick reference
TL;DR
An MCP transport is the wire layer carrying JSON-RPC messages. Stdio (local subprocess) and streamable HTTP (remote service) are the two active transports in 2026; HTTP plus SSE was deprecated.
Think of MCP messages as letters in a specific envelope format. The transport is the delivery service that carries them. The letters do not care which service delivers them; they only care that they arrive intact.
MCP has two delivery services in use today. Stdio is for when the destination is on the same machine (a local program on your laptop). Streamable HTTP is for when the destination is across the internet (a remote server in the cloud). An older third service called HTTP plus SSE was retired in late 2025 because it was harder to operate. New servers should not use it.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example.
Building a new remote server in 2026 and considering HTTP plus SSE. That transport was deprecated late 2025. Use streamable HTTP; SSE is being phased out across the ecosystem.
Shipping a stdio server as a multi-user shared service. Stdio is per-process and per-host. A multi-user deployment needs streamable HTTP so multiple clients can connect to one server instance.
Inventing a custom transport for a niche deployment. Custom transports lose ecosystem compatibility. Every official SDK and host targets the two standard transports; a custom one will not interoperate without reimplementing the SDK layer.
Quick scan · 2–4 min
Everything important, quickly.
5 min: define transport as the wire layer, name the two active transports (stdio for local, streamable HTTP for remote), explain why HTTP plus SSE was deprecated, describe OAuth 2.1 authentication on remote transports, and close with why transport-agnosticism matters for ecosystem evolution.
Real-world examples
Real products, models, and research that use this idea.
1Claude Desktop's filesystem server uses stdio: launched as a Node subprocess on the user's machine, messages over stdin/stdout.
2GitHub MCP server (rewritten in Go in 2025) uses streamable HTTP: multi-tenant, OAuth 2.1 authentication, deployed in GitHub's cloud.
3Slack, Linear, Notion, Sentry, and Stripe all ship first-party remote servers over streamable HTTP in 2026.
4The sqlite MCP server uses stdio: ideal for local databases the user wants the model to query without network exposure.
5Older community servers built on HTTP plus SSE are being migrated to streamable HTTP through 2026.
Interviewer follow-ups
What an interviewer would ask next. Try answering before peeking at the approach.
QWhy did the spec move from HTTP plus SSE to streamable HTTP?
Sign in or go Pro to see the approach for this follow-up.
QCan the same MCP server speak both stdio and streamable HTTP?
Sign in or go Pro to see the approach for this follow-up.
QHow does authentication work across transports?
Sign in or go Pro to see the approach for this follow-up.
Don't say this
Red flags and common mistakes that signal junior thinking. Click to expand.
Most common mistake
Targeting HTTP plus SSE for new servers. That transport was deprecated late 2025 in favor of streamable HTTP. New remote servers should use streamable HTTP exclusively.