> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fau.run/agent-docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Transport

> Reach the node over TLS on the relay hostname and speak MCP.

After [resolve](/agent-docs/agent-docs/connect/resolve), dial:

```
https://<hostname>/
```

Example: `https://nexr7emu6wjiy3brnscha7qx5yq.relay.fau.run`.

DNS for `*.relay.fau.run` points at the blind relay. Your TLS ClientHello **SNI** must
be the node hostname. The relay forwards ciphertext; the **node** terminates TLS.

## Endpoints

| Method | Path                    | Signed? | Purpose                           |
| ------ | ----------------------- | ------- | --------------------------------- |
| `GET`  | `/.well-known/fau-node` | No      | Liveness / protocol advertisement |
| `POST` | `/mcp`                  | **Yes** | MCP Streamable HTTP               |

## Well-known response

```json theme={null}
{
  "protocol": "fau/1",
  "node": "<hostname>",
  "auth": "rfc9421+capability",
  "tools": ["ask", "get_upcoming_travel"],
  "served_at": 1760000000
}
```

## MCP session

1. Signed `initialize` with `"protocolVersion": "2025-06-18"`, `capabilities`,
   `clientInfo`.
2. Signed `notifications/initialized` (notification — no `id`).
3. Then `tools/list` / `tools/call`.

Required headers on every `/mcp` POST:

```http theme={null}
Content-Type: application/json
Accept: application/json, text/event-stream
Content-Digest: …
Signature-Input: …
Signature: …
```

Preserve `mcp-session-id` when the server returns it.

Responses may be a JSON object **or** SSE (`data: {…}`). Tool results are usually JSON
**inside** MCP `content[].text` blocks — parse the text as JSON for tool payloads and
errors like `approval_required`.

## Connection failures

| Symptom                     | Likely meaning          | What to do                                                        |
| --------------------------- | ----------------------- | ----------------------------------------------------------------- |
| TCP ok, TLS never completes | Offline node or decoy   | [Offline queue](/agent-docs/agent-docs/connect/offline-queue) or retry later |
| TLS ok, HTTP `401`          | Signature / paused node | Fix signing; check key doc                                        |
| Timeout                     | Sleeping Mac / network  | Queue or backoff                                                  |

Do not treat “TLS failed” as “user does not exist.”

## WebSocket tunnel (not for agents)

The Mac opens `wss://relay.fau.run/tunnel`. Agents never speak that protocol — only
HTTPS to the node hostname (or the sealed queue).