stdio transport
The connection mode where a client launches the server as a local process and talks to it over standard input and output.
What makes it wrong.
The mechanism, not the warning.
Everything the server writes to standard output is protocol traffic. A stray log line, a debug print, a dependency that greets on startup, and the connection breaks with an error that names none of them. Servers that log must log to standard error.
In detail.
This is how a self-hosted server runs. The client starts the process, usually through a package runner, passes credentials as environment variables, and exchanges protocol messages over the process pipes. Nothing listens on a port and nothing leaves the machine except the calls the server itself makes to the platform API.
It is the mode that gives the strongest answer to the credentials question, because the token is only ever on the machine that uses it.