MCP Architecture: Transport Protocols, Client Differences & Security
Stdio vs. SSE: Selecting the Optimal MCP Transport
BLUF (Bottom Line Up Front): Use stdio for local subprocesses (filesystem access, SQLite, git tooling) because it operates with zero networking latency and inherits OS process boundaries. Use SSE (Server-Sent Events) for centralized enterprise tool pools, shared databases, or containerized cloud microservices where multiple agents share state.
The Model Context Protocol (MCP) standardizes how AI agents discover tools, inspect resources, and query prompts. In stdio transport, the host client launches the server as a child process and exchanges newline-delimited JSON-RPC 2.0 messages over standard input/output streams.
In contrast, SSE transport binds an HTTP server that provides persistent event streams for incoming tool calls and HTTP POST endpoints for responses. While flexible, SSE requires explicit authentication, TLS termination, and network firewall protection.
Cross-Client Compatibility: Claude Desktop, Cursor & Windsurf
BLUF: While all four major clients adopt the mcpServers top-level JSON structure, configuration file paths and SSE parameter keys vary. Windsurf Cascade expects serverUrl instead of url for HTTP streams, and Cursor allows both workspace-level (.cursor/mcp.json) and global editor tools.
| Client | Default File Name | Config Scope | SSE Transport Key |
|---|---|---|---|
| Claude Desktop | claude_desktop_config.json | Global OS Config | url |
| Cursor IDE | mcp.json | Workspace & Global | url |
| Claude Code | claude.json | User CLI Config | url / CLI |
| Windsurf (Cascade) | mcp_config.json | Global Codeium Config | serverUrl |
Security & Secret Isolation in MCP Servers
BLUF: Never commit API keys or database connection strings to version control in workspace-level .cursor/mcp.json files. Use environment variable indirection or OS-level credential stores to prevent secret leakage in public git repositories.
When an MCP server is invoked via stdio, child processes inherit environment variables defined in the env map. To minimize attack surfaces:
- Scope filesystem server arguments strictly to project worktrees rather than root directories.
- Provision read-only database roles for SQL servers to mitigate unauthorized updates from prompt injection.
- Rotate long-lived personal access tokens (GitHub, Slack) using fine-grained repository permissions.
Deploying Production Multi-Agent Systems?
We design deterministic agent state machines, custom enterprise MCP servers, and prompt-injection guardrail pipelines for engineering teams and AI startups.