MCP over stdio

When to use stdio

Choose stdio for a local AI application that can launch a command and exchange MCP messages through standard input and output. There is no MCP network port to expose: the client owns the process lifecycle.

Start Kavach

Configure your MCP-aware client to launch this command from the Kavach repository:

uv run kavach-mcp --transport stdio

The command writes protocol messages to stdout. Do not add diagnostic output to stdout; use stderr for local process diagnostics.

Client configuration

Use this generic shape in a desktop client's MCP server configuration:

{
  "mcpServers": {
    "kavach": {
      "command": "uv",
      "args": ["run", "kavach-mcp", "--transport", "stdio"],
      "cwd": "/path/to/Kavach"
    }
  }
}

After the client starts the process, it initializes MCP, lists tools, and calls the same Kavach tool names used by the HTTP transports.

Identity and security

In Keycloak mode, the local stdio process uses its configured REST credential (a supplied token or the kavach-mcp client credentials flow). The resulting service-account subject is the actor evaluated by Kavach tenant membership and RBAC. For a remote user identity, use native Streamable HTTP instead.