A stdio server is spawned by the client. The usual pattern is an env field that reads a local variable. Do not put a production key in a JSON file that may be committed.
Remote HTTP endpoints that use OAuth keep tokens in the client session. Revoke access on a shared computer when you are done.
Project config may commit command and args with placeholder paths. Each person injects real values from .env or a shell profile.
Pair this with the OAuth basics and MCP security guides. Prefer read-only scopes.