{"record":{"id":"8fb6caf34b5607f4","repo":"Tencent/WeKnora","slug":"stdio-transport-is-disabled-for-security-reasons-8fb6ca","errorCode":null,"errorMessage":"stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead","messagePattern":"stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/mcp/manager.go","lineNumber":66,"sourceCode":"\t}\n\treturn service.ID\n}\n\n// GetOrCreateClient gets an existing client or creates a new one\n// Caches and reuses existing connections for SSE/HTTP Streamable\n// Note: Stdio transport is disabled for security reasons\n//\n// For OAuth-enabled services the connection is keyed per principal (derived from\n// ctx) so each identity connects with its own token.\nfunc (m *MCPManager) GetOrCreateClient(ctx context.Context, service *types.MCPService) (MCPClient, error) {\n\t// Check if service is enabled\n\tif !service.Enabled {\n\t\treturn nil, fmt.Errorf(\"MCP service %s is not enabled\", service.Name)\n\t}\n\n\t// Stdio transport is disabled for security reasons\n\tif service.TransportType == types.MCPTransportStdio {\n\t\treturn nil, fmt.Errorf(\"stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead\")\n\t}\n\n\tvar tenantID uint64\n\tvar principal types.Principal\n\tif service.AuthConfig.IsOAuth() {\n\t\ttenantID, _ = types.TenantIDFromContext(ctx)\n\t\tprincipal, _ = types.PrincipalFromContext(ctx)\n\t\tprincipal = types.MCPOAuthPrincipalFromContext(ctx)\n\t\tif !principal.Valid() {\n\t\t\treturn nil, fmt.Errorf(\"principal context is required to connect to OAuth MCP service %s\", service.Name)\n\t\t}\n\t}\n\tkey := cacheKey(service, principal)\n\n\t// For SSE/HTTP Streamable, check if client already exists and reuse\n\tm.clientsMu.RLock()\n\tclient, exists := m.clients[key]\n\tm.clientsMu.RUnlock()","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/mcp/manager.go#L48-L84","documentation":"GetOrCreateClient hard-blocks stdio transport for security reasons: launching local subprocesses from the server is disallowed, so MCPTransportStdio returns this error. Users must switch the service to SSE or HTTP Streamable transport.","triggerScenarios":"Creating/registering an MCPService with TransportType == types.MCPTransportStdio and calling GetOrCreateClient (directly or via GetMCPToolsInfo/GetMCPServiceTools/GetMCPServiceResources).","commonSituations":"Importing a config that was written for a local stdio-based MCP setup (e.g. claude-desktop style configs with command+args) into this server; migrating from a local dev setup to the hosted server.","solutions":["Change the service's TransportType to MCPTransportSSE or MCPTransportHTTP (streamable) and set the appropriate URL","Run the stdio MCP server as a separate networked process (e.g. wrap it with a supergateway/proxy exposing SSE) and point the service at that URL","Remove stdio services from the configuration since they will never be connectable"],"exampleFix":"// before\nsvc := &types.MCPService{Name: \"fs\", TransportType: types.MCPTransportStdio}\n// after\nsvc := &types.MCPService{Name: \"fs\", TransportType: types.MCPTransportSSE, URL: \"http://127.0.0.1:8080/sse\"}","handlingStrategy":"validation","validationCode":"if svc.TransportType == types.MCPTransportStdio {\n    return errors.New(\"stdio MCP services are unsupported; use SSE or HTTP streamable\")\n}","typeGuard":"func supportsRemoteTransport(svc *types.MCPService) bool {\n    return svc.TransportType == types.MCPTransportSSE || svc.TransportType == types.MCPTransportHTTP\n}","tryCatchPattern":"client, err := manager.GetOrCreateClient(ctx, svc)\nif err != nil && strings.Contains(err.Error(), \"stdio transport is disabled\") {\n    return fmt.Errorf(\"reconfigure %q to SSE/HTTP transport\", svc.Name)\n}","preventionTips":["Reject stdio transport at service-creation time (validation in UI/API)","Convert imported stdio configs to SSE via a network proxy before registering","Document stdio as unsupported in onboarding docs"],"tags":["mcp","transport","security","configuration"],"backgroundTag":"unsupported-transport","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}