1---2title: Marmot transport3audience: user4---56# Marmot transport78Status: `adopted` by [Marmot commit 4a2bc65f8db5866cec3b2a127dedb37818eaf207](https://github.com/marmot-protocol/marmot/tree/4a2bc65f8db5866cec3b2a127dedb37818eaf207), last checked 2026-09-04.910Marmot relays carry MLS bytes in two Nostr event kinds. Kind `30443` publishes11an account's KeyPackage as an addressable event. Kind `445` carries an opaque12encrypted group message and routes it with one `h` tag containing the random1332-byte group id. The relay checks the signed envelope and leaves MLS14verification to clients.1516The transport is off on a fresh relay. You enable it with **Marmot**,17**Marmot members** or `setpolicy` with `{"features":{"marmot":true}}`.18Both templates allow kinds `10002`, `10050`, `1059`, `30443` and `445`, which are the19account relay list, inbox list, gift wrap, KeyPackage and group message paths.2021Choose **Marmot** for public opaque transport: anyone can publish, including22group envelopes without account authentication. Choose **Marmot members**23when you admit the publishers. Add their account npubs on the People tab;24their clients authenticate with NIP-42 before publishing group envelopes.25Both templates keep encrypted messages publicly readable and retain the26recipient checks on gift wraps. Relay membership controls who writes; your27clients control who belongs to an MLS group and holds its decryption keys.2829**Marmot members** charges each envelope against its authenticated account's30member limits. Both templates use the relay owner's existing fuel allowance31and balance for storage and metered work; neither sets a new price or cap.32Other feature settings stay as they are.3334Kind `445` uses a fresh ephemeral author, so that author is not a membership35identity. An open relay may accept it anonymously. A relay with an allowlist,36web of trust or owner-only write rule requires the socket to authenticate an37account that can write. That account's member limits apply to the envelope.38Per-connection and per-address event limits, bans, proof of work, fuel and the39ordinary kind allow and block rules still apply.4041The `h` exception is limited to kind `445`. NIP-29 events continue to use the42relay slug and a foreign slug remains blocked. Gift wraps remain private under43the existing NIP-59 party checks. The relay does not unwrap kind `1059`, infer44the kind `444` rumor inside it, or try to decrypt kind `445`.4546The implementation validates the exact required tag cardinality. KeyPackage47events require the `d`, `mls_protocol_version`, `i`, four MLS id-list tags and48the account identity proof component. Group messages require one lowercase4964-character `h` value and allow only an optional NIP-40 expiration tag.50Content is padded standard base64 and remains opaque after this check.