stdio: the client starts a local process and talks over stdin/stdout. It fits local files, a local browser, and a local database. Latency is low; secrets stay in the process env.
Early remotes often used SSE; many hosted endpoints now use Streamable HTTP. Both are network transports, so you deal with TLS, OAuth, and expiry.
Do not commit production secrets in mcp.json. Use a least-privilege account on remote endpoints. Entries here mark transport as stdio or http.
Ask whether you need a local path or someone else’s API. For more, read local-vs-remote MCP and the OAuth basics guide.