A team is building a local MCP server that the client launches over stdio. The server needs an API key for a backend service. How should it obtain the key under the authorization specification?
Select an answer to reveal the explanation.
Short Explanation
stdio servers don't do the OAuth dance; they pick up their keys from the environment they were started in, like a worker finding the toolbox already on the bench. The trap is thinking you can ask the user for the key in a form, which the spec forbids.
Full Explanation
The authorization specification defines its flow for HTTP-based transports. It says authorization is optional for MCP implementations; implementations using HTTP should conform when they support it, while implementations using stdio should not follow it and should instead retrieve credentials from the environment. A stdio server is launched as a subprocess by the client, so its credentials typically come from environment variables or local configuration the user controls. Running OAuth over stdin fails on both counts: authorization is optional, not mandatory, and the specification steers stdio away from that flow. Requesting the key through form-mode elicitation fails because servers must not use form mode for sensitive information such as API keys; a server that genuinely needs one from the user would have to use URL mode, which keeps the secret out of the client. Reading an Authorization header from stdin fails by concept: stdio carries newline-delimited JSON-RPC messages only, with no HTTP headers, and anything else on the stream would corrupt it. Exam caveat: credentials placed in a stdio server's environment are visible to that process, which runs with the user's privileges, so only vetted servers should receive them, and the key should be scoped to the backend's least needed permissions. Operational check: launch the server with the key in its environment and confirm it never asks the user for the key.