update

Author: blva

README.md

@@ -230,6 +230,20 @@ With Atlas API credentials:
 
 #### Option 6: Running as an HTTP Server
 
+> **⚠️ Security Notice:** This server now supports Streamable HTTP transport for remote connections. **HTTP transport is NOT recommended for production use without implementing proper authentication and security measures.**
+
+The server supports Streamable HTTP transport for remote connections.
+
+**Required Security Measures:**
+
+- Implement authentication (e.g., API gateway, reverse proxy)
+- Use HTTPS/TLS encryption
+- Deploy behind a firewall or in private networks
+- Implement rate limiting
+- Never expose directly to the internet
+
+For more details, see [MCP Security Best Practices](https://modelcontextprotocol.io/docs/concepts/transports#security-considerations).
+
 You can run the MongoDB MCP Server as an HTTP server instead of the default stdio transport. This is useful if you want to interact with the server over HTTP, for example from a web client or to expose the server on a specific port.
 
 To start the server with HTTP transport, use the `--transport http` option:
@@ -412,27 +426,6 @@ You can disable telemetry using:
 - **Command-line argument**: `--telemetry disabled`
 - **DO_NOT_TRACK environment variable**: `export DO_NOT_TRACK=1`
 
-#### Streamable HTTP Transport
-
-> **⚠️ Security Notice:** This server now supports Streamable HTTP transport for remote connections. **HTTP transport is NOT recommended for production use without implementing proper authentication and security measures.**
-
-The server supports Streamable HTTP transport for remote connections.
-
-**Required Security Measures:**
-
-- Implement authentication (e.g., API gateway, reverse proxy)
-- Use HTTPS/TLS encryption
-- Deploy behind a firewall or in private networks
-- Implement rate limiting
-- Never expose directly to the internet
-
-**Configuration:**
-
-- **Environment variables**: `export MDB_MCP_TRANSPORT=http`
-- **Command-line argument**: `--transport http`
-
-For more details, see [MCP Security Best Practices](https://modelcontextprotocol.io/docs/concepts/transports#security-considerations).
-
 ### Atlas API Access
 
 To use the Atlas API tools, you'll need to create a service account in MongoDB Atlas: