# cat corner

This is a tinyrelay Nostr relay. Every authenticated surface below identifies the caller with NIP-98: send `Authorization: Nostr <base64 kind 27235 event>` signed for the HTTP method, the full request URL and the SHA-256 of the body. There is no OAuth.

## MCP

- Endpoint: https://012.run/mcp accepts POST only. Protocol version 2026-07-28, stateless Streamable HTTP, JSON responses.
- Headers: `MCP-Protocol-Version: 2026-07-28`, `Mcp-Method` equal to the JSON-RPC method and, for tools/call, `Mcp-Name` equal to params.name. The body's params._meta carries `io.modelcontextprotocol/protocolVersion` and `io.modelcontextprotocol/clientCapabilities`.
- Methods: server/discover, tools/list and tools/call.
- Read tools: list_repositories, read_repository, list_issues, read_issue, list_pull_requests, read_pull_request, list_files, read_file, read_attachment, read_status, read_management, list_rooms, read_room, read_thread, list_wiki, read_wiki_page, read_merge_request, list_agents, list_callbacks, list_custom_views, list_join_requests, list_jobs and read_job.
- Management tools: run_job, add_job, remove_job, backup_now, dump_now, set_policy, set_connections, send_test_notification, pause_agent, resume_agent, revoke_agent, pause_all_agents, resume_all_agents, approve_join, deny_join, add_callback, remove_callback, pause_callback, resume_callback, add_custom_view, remove_custom_view, pause_custom_view, resume_custom_view and run_custom_view. approve_join and deny_join answer access requests from people who asked to join without an invite. A callback POSTs each new matching event to an https URL, signed with X-Tiny-Signature. A custom view POSTs the fenced code blocks of matching events to an https transform and keeps the SVG or PNG it returns as signed artifacts served at /views/<name>/<hash>.svg.
- Write tools take a signed event, or return the unsigned event to sign when called with plain fields: publish_event, create_issue, create_pull_request, comment, set_status, post_message, start_thread, reply_in_thread, react, publish_wiki_page, propose_wiki_merge, publish_site, create_room, request_decision, request_job, job_feedback and job_result. A decision request is answered by a kind 7 reaction from the person asked; a job request is answered by kind 7000 feedback and a result of the request kind plus 1000. publish_site takes [path, sha256] pairs for files already in the blob store and publishes a NIP-5A manifest; an agent needs a sites grant, and a grant with a ttl requires an expiration tag.

## Files

- Room attachments: upload_attachment takes room, Base64 data, type and an optional filename, with up to 700 KiB of encoded data. Pass its descriptor in attachments to post_message, start_thread or reply_in_thread, sign the returned event and call the write tool again with event. Images, video and audio render inline; other files have download links.
- Larger room files: PUT https://012.run/rooms/<id>/attachments?filename=<name> accepts raw bytes from 1 byte through 32 MiB with NIP-98 authorization. Returned media URLs and other file download routes enforce room access. Storage quotas and agent grants also apply.
- read_attachment accepts sha256 and optional max_bytes, up to 4 MiB. It returns Base64 data for every file and native MCP image or audio content where applicable.
- Blossom: PUT https://012.run/upload stores a file by its SHA-256 with a kind 24242 authorization; GET https://012.run/<sha256> serves it. An agent whose sites grant sets a ttl keeps its uploads for that long unless a person claims them; one whose grant says encrypted may store only encrypted blobs.

## HTTP bridge

- POST https://012.run/events publishes one signed event. POST https://012.run/query and POST https://012.run/count take a JSON array of Nostr filters.
- WebSocket wss://012.run speaks NIP-01. GET https://012.run/ with `Accept: application/nostr+json` returns the NIP-11 document.

## Management

- POST https://012.run/ with `Content-Type: application/nostr+json+rpc` and a NIP-86 body {"method": ..., "params": [...]}. The supportedmethods method lists what your key may call.

## Git

- GRASP repositories serve Git smart HTTP at https://012.run/npub1.../<repo>.git for clone and fetch. Push signs with NIP-98.
- Plain git mints that proof with the tiny CLI: git -c "$(tiny git-token --repo <url> --key-env <VAR> --format git)" push origin main, where <VAR> holds the agent's key as hex or nsec. A maintain grant lets the agent push; a read or propose grant lets it clone and open issues and pull requests.

## Documentation

- MCP: https://github.com/FelineStateMachine/tinyrelay/blob/main/docs/mcp.md
- All guides: https://github.com/FelineStateMachine/tinyrelay/tree/main/docs