MCP Server Transport in Code-Review-Graph: STDIO vs Streamable-HTTP Explained

The code-review-graph MCP server supports two transports—STDIO for child-process communication and Streamable-HTTP for networked daemon mode—selected via the --http flag in main.py.

The MCP (Message Communication Protocol) server in the tirth8205/code-review-graph repository provides a FastMCP-based interface for code review graph operations. Understanding how the MCP server transport works is essential for deploying the server in different environments, whether as a local IDE plugin companion or as a persistent HTTP service.

How the MCP Server Transport Works

The transport layer determines how clients communicate with the FastMCP instance. The implementation in code_review_graph/main.py creates a single FastMCP object that can operate over either transport depending on startup flags.

STDIO Transport (Default)

When you run code-review-graph serve without additional flags, the server initializes in STDIO mode. In this configuration, the FastMCP instance communicates through standard input and output using the canonical JSON-RPC format.

All tool calls serialize to stdout as pure JSON, allowing clients to read and write without additional framing. This mode suits IDE plugins like Claude Code that launch the server as a child process and pipe messages directly through file descriptors.

Streamable-HTTP Transport

Adding the --http flag switches the server to Streamable-HTTP mode. FastMCP spins up an ASGI server on localhost:5555 (configurable via --port) that speaks the streamable-HTTP variant of the MCP protocol.

This transport supports both standard JSON responses and Server-Sent Events (text/event-stream), enabling long-running tools to stream progress to clients. The HTTP layer allows standard tooling like curl or browser-based clients to interact with the graph operations.

Implementation Details in the Source Code

The transport selection logic resides in code_review_graph/main.py. The FastMCP instance checks for the --http argument and dispatches to either run_stdio or run_http_async accordingly.

When HTTP mode is active, the server attaches middleware from code_review_graph/http_origin_guard.py. This Loopback Origin Guard validates Host and Origin headers to prevent cross-origin attacks such as DNS rebinding, ensuring the HTTP transport only accepts connections from legitimate localhost sources.

Both transports share identical tool registration and graph state management. The only difference lies in the I/O layer that FastMCP uses to receive requests and emit responses.

Practical Usage Examples

Starting the Server with STDIO

Use the default command for IDE integrations and local process communication:

code-review-graph serve

The client writes JSON-RPC requests to the server's stdin and reads responses from stdout. No network stack is involved, keeping the communication lightweight and secure within the process tree.

Starting the Server with Streamable-HTTP

Enable HTTP mode for remote access or browser-based clients:

# Default port 5555

code-review-graph serve --http

# Custom port

code-review-graph serve --http --port 7777

The server listens on http://127.0.0.1:5555/mcp/ and accepts standard JSON-RPC POST requests.

Calling Tools via HTTP

List available tools using curl:

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  --data '{"jsonrpc":"2.0","id":1,"method":"list_tools","params":{}}' \
  http://127.0.0.1:5555/mcp/

For long-running operations that stream progress, request the event-stream media type:

curl -N -H "Accept: text/event-stream" \
  http://127.0.0.1:5555/mcp/ \
  -d '{"jsonrpc":"2.0","id":2,"method":"build_or_update_graph","params":{}}'

The response returns a series of data: lines until the tool execution completes.

Security Considerations for HTTP Transport

The Streamable-HTTP transport implements security measures in code_review_graph/http_origin_guard.py. The Loopback Origin Guard middleware enforces strict header validation on every incoming request.

This protection prevents malicious websites from accessing your local MCP server through DNS rebinding attacks. The guard ensures that both Host and Origin headers indicate localhost origins, rejecting any cross-site requests before they reach the tool execution layer.

Summary

• STDIO is the default transport when running code-review-graph serve, ideal for IDE plugins and child-process communication through JSON-RPC on stdin/stdout.
• Streamable-HTTP activates with the --http flag, exposing an ASGI server on port 5555 that supports both standard JSON and Server-Sent Events for streaming.
• Both transports share the same FastMCP instance and tool registry, differing only in the I/O layer implementation in code_review_graph/main.py.
• The HTTP transport includes a Loopback Origin Guard in code_review_graph/http_origin_guard.py to prevent cross-origin attacks.
• Clients can switch between transports without changing tool logic, as the underlying graph operations remain identical.

Frequently Asked Questions

What is the default MCP transport in code-review-graph?

The default transport is STDIO (standard input/output). When you execute code-review-graph serve without flags, the FastMCP instance in code_review_graph/main.py calls run_stdio, establishing a JSON-RPC communication channel over stdin and stdout. This suits local IDE integrations where the server runs as a child process.

How do I enable HTTP transport for remote access?

Add the --http flag to the serve command: code-review-graph serve --http. This instructs the FastMCP instance to call run_http_async instead of run_stdio, starting an ASGI server on localhost port 5555. You can customize the port using --port 7777 or similar values.

What security measures protect the HTTP transport?

The HTTP transport implements a Loopback Origin Guard defined in code_review_graph/http_origin_guard.py. This middleware validates Host and Origin headers on every request to ensure connections originate from localhost, preventing DNS rebinding and cross-origin attacks from malicious websites.

Can the server support both transports simultaneously?

No, the current implementation in code_review_graph/main.py selects one transport at startup based on the presence of the --http flag. The FastMCP instance initializes with either run_stdio or run_http_async, but not both. To switch transports, you must restart the server with the appropriate flag.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}