Transport

After resolve, dial:

https://<hostname>/

Example: https://nexr7emu6wjiy3brnscha7qx5yq.relay.fau.run. DNS for *.relay.fau.run points at the blind relay. Your TLS ClientHello SNI must be the node hostname. The relay forwards ciphertext; the node terminates TLS.

Endpoints

Method	Path	Signed?	Purpose
`GET`	`/.well-known/fau-node`	No	Liveness / protocol advertisement
`POST`	`/mcp`	Yes	MCP Streamable HTTP

Well-known response

{
  "protocol": "fau/1",
  "node": "<hostname>",
  "auth": "rfc9421+capability",
  "tools": ["ask", "get_upcoming_travel"],
  "served_at": 1760000000
}

MCP session

Signed initialize with "protocolVersion": "2025-06-18", capabilities, clientInfo.
Signed notifications/initialized (notification — no id).
Then tools/list / tools/call.

Required headers on every /mcp POST:

Content-Type: application/json
Accept: application/json, text/event-stream
Content-Digest: …
Signature-Input: …
Signature: …

Preserve mcp-session-id when the server returns it. Responses may be a JSON object or SSE (data: {…}). Tool results are usually JSON inside MCP content[].text blocks — parse the text as JSON for tool payloads and errors like approval_required.

Connection failures

Symptom	Likely meaning	What to do
TCP ok, TLS never completes	Offline node or decoy	Offline queue or retry later
TLS ok, HTTP `401`	Signature / paused node	Fix signing; check key doc
Timeout	Sleeping Mac / network	Queue or backoff

Do not treat “TLS failed” as “user does not exist.”

WebSocket tunnel (not for agents)

The Mac opens wss://relay.fau.run/tunnel. Agents never speak that protocol — only HTTPS to the node hostname (or the sealed queue).

Start here

Connect

Call tools

Reference

Endpoints

Well-known response

MCP session

Connection failures

WebSocket tunnel (not for agents)

​Endpoints

​Well-known response

​MCP session

​Connection failures

​WebSocket tunnel (not for agents)

Endpoints

Well-known response

MCP session

Connection failures

WebSocket tunnel (not for agents)