MCP architecture: layered patterns for high-concurrency edge apps
The edge-delivery view of MCP's layering and data flow.
Quick answer
Can MCP stdio and HTTP transports be mixed?
No — one Server picks one transport. Remote endpoints must use Bearer auth with the scope minimized to read-only, or you are effectively shipping your source naked.
Machine-readable page data: /data/mcp-architecture.json
In-depth analysis
MCP (Model Context Protocol) is an open standard released in 2024 that lets large language models connect to tools and data sources through one uniform protocol. Write a Server once and any MCP-compatible agent (Claude Desktop, Cursor) discovers and calls it. Architecture should be edge-first — static pre-render sinks to the edge, dynamic capability falls back to functions with circuit breakers.
// mcp-server.ts — @modelcontextprotocol/sdk ^1.0 stdio read-only Server
import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
const server = new McpServer({ name: 'docs-readonly', version: '1.0.0' });
server.tool('read_doc', { path: schema.string() }, async ({ path }) => {
// scope is minimized to read-only — never expose write or full filesystem access
return { content: [{ type: 'text', text: readAllowed(path) }] };
});
const transport = new StdioServerTransport();
await server.connect(transport);
// Client registration in claude_desktop_config.json:
// "mcpServers": { "docs": { "command": "node", "args": ["mcp-server.ts"] } }MCP Architecture · Key takeaways
- Static and dynamic boundaries defined
- Third-party calls wrapped in circuit breakers
- Environment config separated from code
- Boundary contracts documented
FAQ & pitfalls
How do I authenticate an MCP Server deployed at the edge?
Remote MCP uses Bearer-authenticated SSE or HTTP, with scope limited to read-only tools. Local stdio stays off the network — never expose it to avoid privilege escalation.
Explore the hub
See all 5 guides in AI AgentsSame category as this article, sorted across the codebase.
AEO architecture: layered patterns for high-concurrency edge apps
The edge-delivery view of AEO's layering and data flow.
AEO best practices: engineering conventions for production
Field-tested AEO practices from production, avoiding the common anti-patterns.
AEO deployment guide: zero-ops edge publishing with Cloudflare Pages
Git-driven AEO deployment in practice: commit to build, atomic publish to every edge node.
AEO engineering practice: a full guide from architecture to production
Production architecture and core pain points for AEO.
Share & save
What readers are asking
Questions that keep coming back in reader feedback, already answered.
- 01
Can one MCP server speak both stdio and HTTP?
No — a server picks a single transport. A remote endpoint must carry Bearer auth and scope its tools to read-only, otherwise you are exposing source execution to the public internet.
See the full guide → - 02
How should auth work when an MCP server runs at the edge?
Remote MCP goes over SSE or HTTP with a Bearer token, and tools get read-only scope; local stdio is never network-exposed. Do not put both transports behind the same server.
See the full guide → - 03
Why is my Astro component's interactivity not working?
Components ship as zero-JS HTML by default, so an interactive one needs a client:* directive (client:load, client:visible, …). Without it the script is never bundled into the page.
See the full guide →