A desktop AI assistant must let a single user search and summarize documents stored on that user's own laptop. Which way of running the MCP server fits best?
Select an answer to reveal the explanation.
Short Explanation
When the files live on your own laptop, you want the helper sitting right next to them, not across the internet. The trap is dragging in OAuth or network exposure for something that's local and single-user.
Full Explanation
With the stdio transport, the client launches the MCP server as a subprocess and exchanges newline-delimited JSON-RPC messages over its standard input and output. That suits a single user working with files on the same machine: there is no network listener to secure, the server runs with the user's local permissions, and the host controls its lifetime. The authorization specification says stdio implementations should not follow it and should instead retrieve credentials from the environment, so running OAuth on every stdio message misreads the spec. Uploading every document to a cloud server before each search adds latency and a large data-exposure risk for no benefit when the data and the user are both local. A local HTTP server bound to all interfaces invites access from other machines; the transport guidance says local servers should bind to 127.0.0.1 and validate the Origin header to resist DNS rebinding. Exam caveat: stdio servers still deserve scrutiny, because they run code with the user's privileges, so hosts should show the exact launch command and get consent before starting them. Operational check: confirm the host's configuration launches the server as a subprocess, that the server writes only MCP messages to stdout and logs to stderr, and that no network port is opened.