{
  "title": "Local vs Remote MCP Architecture",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "2026-07-28",
  "count": 19,
  "records": [
    {
      "recordId": "R5-TOPOLOGY01",
      "property": "Typical server location",
      "local": "Same machine or controlled local environment",
      "remote": "Network-accessible service, often cloud-hosted",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY02",
      "property": "Common transport",
      "local": "stdio; sometimes loopback HTTP or in-process SDK transport",
      "remote": "Streamable HTTP over HTTPS",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY03",
      "property": "Process lifecycle",
      "local": "Client/host often launches and terminates server subprocess",
      "remote": "Independent service lifecycle operated by server provider",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY04",
      "property": "Logical client relationship",
      "local": "One client component to one server process",
      "remote": "One client component to one logical server endpoint/service",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY05",
      "property": "Physical connection",
      "local": "Long-lived stdin/stdout streams are common",
      "remote": "Independent HTTP requests; no current protocol session required",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY06",
      "property": "Version handling",
      "local": "Current requests carry version; clients may probe with server/discover",
      "remote": "Current requests carry version; discovery can precede calls",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY07",
      "property": "Authentication",
      "local": "Often process/user trust; not necessarily absent",
      "remote": "Usually OAuth, token, API key or enterprise identity",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY08",
      "property": "Authorization",
      "local": "Filesystem/process identity and explicit path/tool policy",
      "remote": "User, tenant, object and upstream-service authorization",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY09",
      "property": "Secrets",
      "local": "Environment variables, local keychain, config or secret manager",
      "remote": "Managed secret stores, delegated tokens, service identities",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY10",
      "property": "Primary scaling concern",
      "local": "Startup time, process count, local resources",
      "remote": "Horizontal scaling, routing, latency, tenant isolation",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY11",
      "property": "Primary supply-chain risk",
      "local": "Downloaded packages, binaries, project config, dependency compromise",
      "remote": "Server provider, deployment pipeline, dependencies and endpoint identity",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY12",
      "property": "Primary network risk",
      "local": "Loopback exposure and proxy/DNS-rebinding edge cases",
      "remote": "TLS, SSRF, DNS, routing, DDoS and token interception",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY13",
      "property": "Permission interface",
      "local": "Host should show local paths/commands and process authority",
      "remote": "Host should show account, scopes, server identity and actions",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY14",
      "property": "Underlying identity",
      "local": "Often operating-system user",
      "remote": "Delegated user, service account or workload identity",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY15",
      "property": "Tenant model",
      "local": "Usually single user/workspace",
      "remote": "Potentially many users and organizations",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY16",
      "property": "Failure mode",
      "local": "Child process crash, malformed stdout, package startup failure",
      "remote": "HTTP errors, auth expiry, service outage, throttling, routing mismatch",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY17",
      "property": "Observability",
      "local": "Host logs plus child-process stderr",
      "remote": "Client traces plus server, gateway and authorization logs",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY18",
      "property": "Best fit",
      "local": "Personal tools, local files, IDE/project access, low-latency private code",
      "remote": "Vendor services, shared enterprise data, SaaS integrations, managed deployment",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    },
    {
      "recordId": "R5-TOPOLOGY19",
      "property": "Not guaranteed",
      "local": "Local does not mean safe or read-only",
      "remote": "Remote does not mean official, authenticated or multi-tenant-safe",
      "packageSourceIds": [
        "S005",
        "S006",
        "S007"
      ],
      "sourceIds": [
        "S057",
        "S132",
        "S131"
      ]
    }
  ]
}