{"record":{"id":"b8fc60c0463c1da2","repo":"Tencent/WeKnora","slug":"stdio-transport-is-disabled-for-security-reasons","errorCode":null,"errorMessage":"stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead","messagePattern":"stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/mcp/client.go","lineNumber":226,"sourceCode":"\t\t}\n\t\tif useOAuth {\n\t\t\tmcpClient, err = client.NewOAuthStreamableHttpClient(*config.Service.URL, oauthConfig,\n\t\t\t\ttransport.WithHTTPBasicClient(httpClient),\n\t\t\t\ttransport.WithHTTPHeaders(headers),\n\t\t\t)\n\t\t} else {\n\t\t\t// For HTTP streamable, we need to use transport options\n\t\t\tmcpClient, err = client.NewStreamableHttpClient(*config.Service.URL,\n\t\t\t\ttransport.WithHTTPBasicClient(httpClient),\n\t\t\t\ttransport.WithHTTPHeaders(headers),\n\t\t\t)\n\t\t}\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to create HTTP streamable client: %w\", err)\n\t\t}\n\tcase types.MCPTransportStdio:\n\t\t// Stdio transport is disabled for security reasons (potential command injection vulnerabilities)\n\t\treturn nil, fmt.Errorf(\"stdio transport is disabled for security reasons; please use SSE or HTTP Streamable transport instead\")\n\tdefault:\n\t\treturn nil, ErrUnsupportedTransport\n\t}\n\n\tinstance := &mcpGoClient{\n\t\tservice: config.Service,\n\t\tclient:  mcpClient,\n\t}\n\tif useOAuth {\n\t\tinstance.oauth = newOAuthRuntime(\n\t\t\tconfig.OAuthRepo,\n\t\t\tconfig.TenantID,\n\t\t\tconfig.Principal,\n\t\t\tconfig.Service.ID,\n\t\t\t*config.Service.URL,\n\t\t\toauthConfig,\n\t\t)\n\t}","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/mcp/client.go#L208-L244","documentation":"Hard security guard in NewMCPClient: the stdio transport (spawning a local subprocess) is deliberately disabled because config-controlled command + args would enable command injection / arbitrary process execution. Only SSE and HTTP Streamable remote transports are allowed.","triggerScenarios":"NewMCPClient called with config.Service.TransportType == types.MCPTransportStdio, regardless of StdioConfig contents. Deterministic — always thrown for this transport type.","commonSituations":"Service imported or migrated from a config that used stdio; developer following older MCP docs/examples that spawn a local server (e.g. npx-based servers); environment variable forcing stdio transport.","solutions":["Change the service TransportType to MCPTransportSSE or MCPTransportHTTPStreamable with a remote URL","Run the local MCP server as a standalone HTTP/SSE endpoint (e.g. mcp server with an sse/streamable-http listener) and point the URL at it","Remove any code path or UI option that allows selecting stdio transport"],"exampleFix":"// before\nsvc := &types.MCPService{TransportType: types.MCPTransportStdio,\n    StdioConfig: &types.StdioConfig{Command: \"npx\", Args: []string{\"-y\", \"@modelcontextprotocol/server\"}}}\n// after\nurl := \"http://127.0.0.1:8080/mcp\"\nsvc := &types.MCPService{TransportType: types.MCPTransportHTTPStreamable, URL: &url}","handlingStrategy":"validation","validationCode":"func ensureRemoteTransport(svc *types.MCPService) error {\n    if svc.TransportType == types.MCPTransportStdio {\n        return errors.New(\"stdio transport is disabled; use SSE or HTTP Streamable\")\n    }\n    return nil\n}","typeGuard":"func isStdioService(svc *types.MCPService) bool {\n    return svc != nil && svc.TransportType == types.MCPTransportStdio\n}","tryCatchPattern":"_, err := NewMCPClient(cfg)\nif err != nil && strings.Contains(err.Error(), \"stdio transport is disabled\") {\n    return fmt.Errorf(\"service %s uses the removed stdio transport; migrate to SSE/streamable\", cfg.Service.ID)\n}","preventionTips":["Remove stdio as a selectable option in any service-admin UI","Run local MCP servers behind an SSE/streamable-http endpoint instead","Add a migration that flags/rejects persisted services with stdio transport"],"tags":["go","mcp","security","configuration"],"backgroundTag":"transport-disabled","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}