01 / The operating case
What changes in a real workflow?
A local stdio server inherits a developer workstation’s files, while a remote HTTP server accepts requests from many clients.
- 01Client / task
- 02MCP server
- 03Tool call + arguments
- 04Downstream effect
02 / Decision contract
What the executor must check
For local use constrain process privileges and filesystem access; for remote use authenticated resource access, audience checks, tenant isolation and network controls.
03 / Failure and evidence
What goes wrong, and what can be proven?
Treating local launch as intrinsically trusted or remote TLS as complete action authorization leaves the effect boundary open.
Record deployment mode, process or resource identity, credential source and downstream invocation.
04 / Canonical scope
Why this reference stands alone
Server isolation focuses compromise blast radius; this page compares deployment trust boundaries.
Protocol or attack trace
Transport threat split
stdio server inherits local filesystem rights; HTTP server receives a request from another machine with a bearer token.
Local: attempt path outside approved workspace. Remote: attempt token for another MCP audience. Both must fail for different reasons.
Primary references