# MCP Server Transport in Code-Review-Graph: STDIO vs Streamable-HTTP Explained

> Explore MCP server transport in code-review-graph. Understand the differences between STDIO for child processes and Streamable-HTTP for networked daemons. Choose the right option for your needs.

- Repository: [Tirth Kanani/code-review-graph](https://github.com/tirth8205/code-review-graph)
- Tags: deep-dive
- Published: 2026-08-09

---

**The code-review-graph MCP server supports two transports—STDIO for child-process communication and Streamable-HTTP for networked daemon mode—selected via the `--http` flag in [`main.py`](https://github.com/tirth8205/code-review-graph/blob/main/main.py).**

The **MCP (Message Communication Protocol) server** in the `tirth8205/code-review-graph` repository provides a FastMCP-based interface for code review graph operations. Understanding how the **MCP server transport** works is essential for deploying the server in different environments, whether as a local IDE plugin companion or as a persistent HTTP service.

## How the MCP Server Transport Works

The transport layer determines how clients communicate with the FastMCP instance. The implementation in [`code_review_graph/main.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/main.py) creates a single FastMCP object that can operate over either transport depending on startup flags.

### STDIO Transport (Default)

When you run `code-review-graph serve` without additional flags, the server initializes in **STDIO mode**. In this configuration, the FastMCP instance communicates through standard input and output using the canonical JSON-RPC format.

All tool calls serialize to stdout as pure JSON, allowing clients to read and write without additional framing. This mode suits IDE plugins like Claude Code that launch the server as a child process and pipe messages directly through file descriptors.

### Streamable-HTTP Transport

Adding the `--http` flag switches the server to **Streamable-HTTP mode**. FastMCP spins up an ASGI server on **localhost:5555** (configurable via `--port`) that speaks the streamable-HTTP variant of the MCP protocol.

This transport supports both standard JSON responses and **Server-Sent Events** (`text/event-stream`), enabling long-running tools to stream progress to clients. The HTTP layer allows standard tooling like `curl` or browser-based clients to interact with the graph operations.

## Implementation Details in the Source Code

The transport selection logic resides in [`code_review_graph/main.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/main.py). The FastMCP instance checks for the `--http` argument and dispatches to either `run_stdio` or `run_http_async` accordingly.

When HTTP mode is active, the server attaches middleware from [`code_review_graph/http_origin_guard.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/http_origin_guard.py). This **Loopback Origin Guard** validates `Host` and `Origin` headers to prevent cross-origin attacks such as DNS rebinding, ensuring the HTTP transport only accepts connections from legitimate localhost sources.

Both transports share identical **tool registration** and **graph state** management. The only difference lies in the I/O layer that FastMCP uses to receive requests and emit responses.

## Practical Usage Examples

### Starting the Server with STDIO

Use the default command for IDE integrations and local process communication:

```bash
code-review-graph serve

```

The client writes JSON-RPC requests to the server's stdin and reads responses from stdout. No network stack is involved, keeping the communication lightweight and secure within the process tree.

### Starting the Server with Streamable-HTTP

Enable HTTP mode for remote access or browser-based clients:

```bash

# Default port 5555

code-review-graph serve --http

# Custom port

code-review-graph serve --http --port 7777

```

The server listens on `http://127.0.0.1:5555/mcp/` and accepts standard JSON-RPC POST requests.

### Calling Tools via HTTP

List available tools using `curl`:

```bash
curl -X POST \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  --data '{"jsonrpc":"2.0","id":1,"method":"list_tools","params":{}}' \
  http://127.0.0.1:5555/mcp/

```

For long-running operations that stream progress, request the event-stream media type:

```bash
curl -N -H "Accept: text/event-stream" \
  http://127.0.0.1:5555/mcp/ \
  -d '{"jsonrpc":"2.0","id":2,"method":"build_or_update_graph","params":{}}'

```

The response returns a series of `data:` lines until the tool execution completes.

## Security Considerations for HTTP Transport

The Streamable-HTTP transport implements security measures in [`code_review_graph/http_origin_guard.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/http_origin_guard.py). The **Loopback Origin Guard** middleware enforces strict header validation on every incoming request.

This protection prevents malicious websites from accessing your local MCP server through DNS rebinding attacks. The guard ensures that both `Host` and `Origin` headers indicate localhost origins, rejecting any cross-site requests before they reach the tool execution layer.

## Summary

- **STDIO** is the default transport when running `code-review-graph serve`, ideal for IDE plugins and child-process communication through JSON-RPC on stdin/stdout.
- **Streamable-HTTP** activates with the `--http` flag, exposing an ASGI server on port 5555 that supports both standard JSON and Server-Sent Events for streaming.
- Both transports share the same FastMCP instance and tool registry, differing only in the I/O layer implementation in [`code_review_graph/main.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/main.py).
- The HTTP transport includes a **Loopback Origin Guard** in [`code_review_graph/http_origin_guard.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/http_origin_guard.py) to prevent cross-origin attacks.
- Clients can switch between transports without changing tool logic, as the underlying graph operations remain identical.

## Frequently Asked Questions

### What is the default MCP transport in code-review-graph?

The default transport is **STDIO** (standard input/output). When you execute `code-review-graph serve` without flags, the FastMCP instance in [`code_review_graph/main.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/main.py) calls `run_stdio`, establishing a JSON-RPC communication channel over stdin and stdout. This suits local IDE integrations where the server runs as a child process.

### How do I enable HTTP transport for remote access?

Add the `--http` flag to the serve command: `code-review-graph serve --http`. This instructs the FastMCP instance to call `run_http_async` instead of `run_stdio`, starting an ASGI server on localhost port 5555. You can customize the port using `--port 7777` or similar values.

### What security measures protect the HTTP transport?

The HTTP transport implements a **Loopback Origin Guard** defined in [`code_review_graph/http_origin_guard.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/http_origin_guard.py). This middleware validates `Host` and `Origin` headers on every request to ensure connections originate from localhost, preventing DNS rebinding and cross-origin attacks from malicious websites.

### Can the server support both transports simultaneously?

No, the current implementation in [`code_review_graph/main.py`](https://github.com/tirth8205/code-review-graph/blob/main/code_review_graph/main.py) selects one transport at startup based on the presence of the `--http` flag. The FastMCP instance initializes with either `run_stdio` or `run_http_async`, but not both. To switch transports, you must restart the server with the appropriate flag.