When running local stdio servers, you rely on the local user's OS file permissions. But once you deploy an MCP Server to the cloud over HTTP/SSE, you are opening it to the internet.
The 2025 MCP spec formalizes servers as OAuth 2.0 Resource Servers. Before establishing an SSE connection, the Client must authenticate using an Authorization: Bearer <token> header.