Three transports
- stdio — local subprocess, simplest, safe
- SSE — server-sent events, ideal for remote services
- HTTP — standard request/response, fits stateless services
A complete config
{
"mcpServers": {
"github": {
"transport": "stdio",
"command": "npx",
"args": ["@modelcontextprotocol/server-github"],
"env": { "GITHUB_TOKEN": "$GITHUB_TOKEN" },
"timeout": 30000
},
"internal-api": {
"transport": "http",
"url": "https://mcp.internal/v1",
"headers": { "Authorization": "Bearer $INTERNAL_KEY" }
}
}
}Production lessons
- Set per-server timeouts
- `scope` field restricts available tools to prevent misuse
- Remote MCP: prefer mTLS / short-lived tokens
- Track the server list in vault docs under version control