# Local stdio or remote HTTP: compare MCP approaches

Choose where code runs and who maintains the access boundary.

Updated 2026-10-29. Also on the [web page](https://mcpdirectory.fyi/guides/local-vs-remote-mcp).

The MCP transport specification describes stdio and Streamable HTTP. Use the server's docs and your client's current support to choose. “Local” and “remote” are deployment descriptions, not quality ratings.

## Compare the data paths

| Question | Local stdio | Remote HTTP |
| --- | --- | --- |
| Where does the server run? | A process launched near the client | A separately operated service |
| Who patches it? | Usually the local operator | The remote service operator |
| What needs review? | Package code, process permissions and credentials | Endpoint identity, user mapping and service data handling |
| Can it call remote APIs? | Yes, if its implementation and permissions allow it | Yes, if its implementation allows it |
| Does the transport prove safety? | No | No |

## Choose local for a reason

Local execution can fit filesystem or development tasks. Confirm which directories the process can read or write. Check whether it inherits environment credentials. A local process can still transmit data over the network. Do not call it offline unless you have verified its behaviour.

Pin the artifact and keep a rollback path. Shared team configuration needs a documented update process, not a command copied from a chat message.

## Choose remote for a reason

Remote operation can simplify centralized maintenance. It also requires an identity and data review. Confirm endpoint ownership, authentication, tenant boundaries, revocation and logging. Check what happens if the service is unreachable.

Avoid treating an old HTTP example as current guidance. Use the transport supported by the exact server and client versions. Record any compatibility limits before rollout.

## Compare the same task

Use the same account scope, dataset and expected result. Measure whether the workflow succeeds and how it fails. Include a denied read and a revoked credential. Choose based on ownership and controls, then document how to disable the connection.

## Sources

- [MCP specification: Transports, revision 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports). Fetched 2026-10-29.
- [MCP specification: Authorization, revision 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization). Fetched 2026-10-29.
- [MCP specification: Security best practices, revision 2025-06-18](https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices). Fetched 2026-10-29.

## Questions

### Does local mean offline?

No. A local process can still call remote APIs and send data over the network.