MCP Server Transport Layers: STDIO, SSE, and HTTP Communication Support

The flux159/mcp-server-kubernetes MCP server supports three transport layers—STDIO (default), Server-Sent Events (SSE), and Streamable HTTP—to enable flexible communication between AI clients and Kubernetes clusters.

The Model Context Protocol (MCP) server implementation in the flux159/mcp-server-kubernetes repository provides multiple transport options for different deployment scenarios. Understanding these transport layers is essential for configuring secure, efficient communication between your MCP client and the Kubernetes management server.

Supported Transport Layers

The MCP server implementation offers three distinct transport mechanisms, each suited for different architectural requirements and security profiles.

STDIO (Standard Input/Output)

STDIO serves as the default transport layer when no special environment variables are configured. This transport is ideal for local CLI usage and direct process-to-process communication.

In src/index.ts (lines 61-62), the server automatically instantiates a StdioServerTransport and connects it to the MCP Server instance:

const transport = new StdioServerTransport();
const server = new Server({ transport });

This mode requires no additional configuration and is considered the safest option for local development, as it avoids exposing network endpoints entirely.

Server-Sent Events (SSE)

Server-Sent Events (SSE) provides a persistent HTTP streaming connection suitable for real-time, push-based communication between clients and the MCP server.

To enable SSE transport, set the environment variable ENABLE_UNSAFE_SSE_TRANSPORT=true. The helper function startSseServer in src/utils/sse.ts (lines 6-19) spins up an Express application that creates an SSEServerTransport:

// src/index.ts lines 54-56
if (process.env.ENABLE_UNSAFE_SSE_TRANSPORT === 'true') {
  await startSseServer(server);
}

The SSE implementation registers two critical endpoints: /sse for establishing the event stream and /messages for client-to-server communication.

Streamable HTTP

Streamable HTTP transport supports conventional HTTP POST/GET request-response patterns for JSON-RPC payloads, making it compatible with standard HTTP clients and load balancers.

Enable this transport by setting ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT=true. The startStreamableHTTPServer function in src/utils/streamable-http.ts (lines 14-33) creates a new StreamableHTTPServerTransport for each incoming request:

// Per-request transport instantiation in streamable-http.ts
const transport = new StreamableHTTPServerTransport({
  sessionIdGenerator: undefined,
});

Configuration and Usage Examples

STDIO Transport (Default)

# No environment variables required

bun run start

The CLI client spawns the server process, which automatically uses the StdioServerTransport defined in src/index.ts.

SSE Transport Setup

Enable the transport and start the server:

export ENABLE_UNSAFE_SSE_TRANSPORT=true
bun run start

Connect from a client using the MCP SDK:

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";

const transport = new SSEClientTransport(new URL("http://localhost:3000/sse"));
const client = new Client({ name: "k8s-client", version: "1.0.0" });

await client.connect(transport);
const result = await client.callTool("kubectl_get", { resourceType: "pods" });

Streamable HTTP Transport Setup

Enable the transport:

export ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT=true
bun run start

Send requests using standard HTTP tools:

curl -X POST http://localhost:3000/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",
    "method": "callTool",
    "params": {"name": "kubectl_get", "arguments": {"resourceType": "pods"}},
    "id": 1
  }'

Security Considerations

The "UNSAFE" prefix in the environment variable names (ENABLE_UNSAFE_SSE_TRANSPORT and ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT) indicates that exposing these transports to the open internet requires additional security measures. The STDIO transport remains the recommended default for local CLI usage, while HTTP-based transports should be deployed behind authentication proxies, TLS termination, and network segmentation when used in production environments.

Implementation Reference

File	Purpose	Key Components
src/index.ts	Entry point and transport selection	StdioServerTransport, environment variable checks (lines 54-56, 61-62)
src/utils/sse.ts	SSE transport implementation	startSseServer, SSEServerTransport, Express routes (lines 6-19)
src/utils/streamable-http.ts	HTTP transport implementation	startStreamableHTTPServer, StreamableHTTPServerTransport (lines 14-33)

Summary

• STDIO transport is the default, secure option for local CLI usage, implemented in src/index.ts using StdioServerTransport (lines 61-62).
• SSE transport provides persistent streaming connections via HTTP, enabled with ENABLE_UNSAFE_SSE_TRANSPORT=true and implemented in src/utils/sse.ts.
• Streamable HTTP transport supports standard request-response patterns, enabled with ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT=true and implemented in src/utils/streamable-http.ts.
• All HTTP-based transports carry "UNSAFE" labels to warn against direct internet exposure without proper authentication and TLS.
• Transport selection occurs at startup based on environment variables, with STDIO serving as the fallback when no HTTP transports are explicitly enabled.

Frequently Asked Questions

How do I switch between transport layers in the MCP server?

Set the appropriate environment variable before starting the server. For SSE, use ENABLE_UNSAFE_SSE_TRANSPORT=true. For Streamable HTTP, use ENABLE_UNSAFE_STREAMABLE_HTTP_TRANSPORT=true. If neither is set, the server defaults to STDIO transport automatically as implemented in src/index.ts.

Why are the HTTP transports labeled as "unsafe"?

The "UNSAFE" designation warns that these transports expose network endpoints accessible to unauthorized clients if exposed to the internet. Unlike STDIO, which requires local process access, HTTP transports need additional security layers such as authentication, TLS encryption, and network policies before production deployment according to the source code warnings.

Can I use multiple transport layers simultaneously?

According to the source code in src/index.ts (lines 54-56), the server checks for SSE and Streamable HTTP environment variables sequentially. The implementation initializes HTTP transports when explicitly enabled, while STDIO serves as the baseline communication method.

What port does the HTTP transport use?

Both SSE and Streamable HTTP implementations default to port 3000 when started via their respective helper functions (startSseServer and startStreamableHTTPServer), though this can typically be configured through additional environment variables or modifications to the utility files in src/utils/.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}