MCP uses JSON-RPC 2.0 to represent requests, notifications, and responses, while MCP methods and transport bindings define what those messages do and how they travel. Neither JSON-RPC nor MCP’s standard transports provide a universal operating-system sandbox for tools: execution isolation must come from the client, server, and deployment environment.
How does MCP use JSON-RPC 2.0?
JSON-RPC 2.0 supplies MCP’s message format and request-response correlation. MCP adds protocol methods, metadata, and interaction conventions on top. The current MCP transport overview says that the meaning of a protocol interaction stays the same across transports; a binding determines how messages are framed and delivered, how metadata is carried, and how cancellation works.
![Computer Networking Bible: [3 in 1] The Complete Crash Course to Effectively Design, Implement and Manage Networks. Including Sections on Security, Performance and Scalability](https://m.media-amazon.com/images/I/41H4YJnxKgL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Requests, notifications, and responses
A JSON-RPC request has "jsonrpc":"2.0", a method name, optional parameters, and usually an id. The client chooses the identifier; the server returns it unchanged so the client can match the response to the request. The response contains either a result or an error object, never both.
A message without an id is a notification. It does not expect a response, and the receiver must not send a JSON-RPC response to it. This distinction matters when implementing asynchronous protocol events: a notification is not merely a request whose reply can be ignored.
#1 Best Overall
What is the difference between stdio and Streamable HTTP?
The current comparison below follows MCP’s 2026-07-28 specification revision. These bindings carry the same MCP protocol semantics but have different process, network, framing, and cancellation boundaries.
| Aspect | stdio | Streamable HTTP (2026-07-28) |
|---|---|---|
| Typical topology | The client launches the MCP server as a subprocess. | An independent server accepts client connections at an MCP endpoint. |
| Message delivery | Newline-delimited JSON-RPC messages over standard input and output. | The client sends each message in a new HTTP POST to one endpoint. |
| Response | The server writes protocol messages to standard output. | The response is JSON or a request-scoped server-sent event (SSE) stream. Clients must support both. |
| Cancellation | The client sends notifications/cancelled. |
The client closes the request’s response stream. |
| Key implementation boundary | Process launch and standard-stream handling; stdout must remain valid protocol output. | HTTP origin validation, authentication, and consistency between headers and the JSON body. |
| Version-specific behavior | Keep stdout reserved for MCP messages. | The 2026-07-28 revision removes the standalone GET stream and protocol sessions; earlier revisions differ. |
The specification permits custom transports if they preserve JSON-RPC message format, message patterns, and per-request metadata. A custom binding does not change what an MCP method means, but its implementer must define and secure its own delivery and cancellation behavior.
stdio: a subprocess and two streams
With stdio, the client starts the server process and exchanges newline-delimited messages through stdin and stdout. The server should write diagnostics and logs to stderr, not stdout: stray output on stdout can be mistaken for protocol data and disrupt message parsing. Starting a process does not itself restrict what that process can access; filesystem, network, and credential controls have to be enforced separately.
Streamable HTTP: POST requests and request-scoped responses
In the current 2026-07-28 binding, each client message is sent as a POST to the MCP endpoint. A response may be an application/json object or a text/event-stream response scoped to that request. The client needs to handle either form.
This revision is stateless at the protocol level: it removes protocol sessions and the standalone GET stream. It also retires initialize/initialized and Mcp-Session-Id. A client that needs server capabilities before acting may use server/discover. Implementations targeting earlier MCP revisions may encounter different session and streaming behavior, so clients and servers should apply the compatibility rules for the negotiated or supported version rather than assume all deployments use the same flow.
Headers are part of the HTTP security boundary
The current HTTP specification requires standard headers including Mcp-Method and, for named operations, Mcp-Name. Where a parameter value is mirrored in a header, unsafe values must be encoded and the header must be checked against the JSON body; implementations must reject mismatches. This is important because an intermediary may route or authorize based on headers while the MCP server dispatches the request from its body.
How do MCP tool calls work?
A tool is a named operation described with metadata, including a description and an input schema. A client discovers tools with tools/list, then invokes one with tools/call, providing the tool name and arguments. The method is an MCP protocol operation carried in a JSON-RPC message; the transport determines how that message reaches the server, not what the tool is allowed to do.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Discover: The client requests
tools/listand reads the available tool names, descriptions, and input schemas. A list response may include a cache hint; for example, the tools specification’s 2026-07-28 example showsttlMs: 300000, an illustrative five-minute hint rather than a universal required cache duration. - Present and authorize: The host application decides how to present the proposed operation and obtain any required user approval. MCP tools guidance recommends that users have an available way to deny invocations.
- Invoke: The client sends
tools/callwith the selected tool name and arguments. The server handles the request and returns a result or an error through the active transport. - Continue if needed: A result may request further user input through the current multi-round-trip mechanism. The client and application need to manage that interaction rather than assume every call is a single exchange.
Tool descriptions, annotations, and other metadata are not proof of safety. The tools specification says annotations should be treated as untrusted unless they come from trusted servers. A client should base trust decisions on the server’s provenance and its own policy, not on descriptive text supplied with a tool.
Best Value
Does MCP sandbox tools?
No universal operating-system or container sandbox is mandated by MCP’s transport specification. MCP standardizes interoperable tool discovery and invocation; it does not, by itself, isolate a server process or tool from the host filesystem, network, credentials, or other processes. “MCP tool” describes a protocol-level operation, not a security boundary.
Security controls belong at distinct layers. The client or host application can gate invocation and present consent prompts; the MCP server can validate requests and enforce application-level permissions; the operating system or container runtime can constrain process access; and network policy can restrict reachable services. A deployment may combine these controls, but it should identify which component enforces each one instead of treating transport choice as sandboxing.
Which security controls matter in practice?
For local HTTP servers
- Validate the HTTP
Originheader to defend against DNS rebinding, where a malicious website attempts to reach a local server from a user’s browser. - When a server is intended for local use, bind it to
127.0.0.1rather than exposing it on all network interfaces, and use appropriate authentication. - Validate mirrored header values against the request body and reject mismatches before dispatch or authorization.
For stdio servers
- Reserve stdout for valid MCP messages and send logs to stderr.
- Review the client’s process-launch configuration and apply operating-system or container restrictions where the tool’s access needs to be limited.
For authorization and user consent
MCP’s security guidance discusses confused-deputy risks in authorization-proxy flows. It calls for per-client consent, exact redirect-URI validation, and secure OAuth state handling. It identifies token passthrough as an anti-pattern: a server must not accept a token that was not explicitly issued for that server. In practice, validate token audience and authorization flow at the server boundary, and do not infer a token’s legitimacy merely because an upstream client supplied it.
Recommended Free Tools
These measures address different threats. Origin checks limit browser-originated access to local HTTP services; authentication and authorization control who can use a server; consent supports user oversight; and process or container restrictions limit what a tool can reach after invocation. None should be described as a complete sandbox unless the deployment’s actual isolation controls justify that claim.
What changed in the 2026-07-28 MCP revision?
The MCP project’s July 28, 2026 release announcement describes revision 2026-07-28 as a stateless protocol core with self-describing requests, header-based routing, multi-round-trip requests, and authorization hardening. For Streamable HTTP, the consequential changes are removal of protocol sessions and the standalone GET stream, alongside retirement of initialize/initialized and Mcp-Session-Id. Code written for an older revision should not be assumed to implement this current flow without version-aware compatibility handling.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
