> ## Documentation Index
> Fetch the complete documentation index at: https://docs.monolex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How It Works

> A coordination server introduces your two machines, then steps out. Your data goes peer-to-peer.

## The matchmaker model

vpncli works like a matchmaker. A coordination server verifies who you are,
tells you which machines are yours, and helps your two machines find each other.
Once they're connected, the server **steps out** — your terminal data travels
directly between the machines and is encrypted end to end.

```
┌──────────────────────────────────────────────────────────────────┐
│  WHAT THE SERVER DOES  (then gets out of the way)                │
├──────────────────────────────────────────────────────────────────┤
│                                                                  │
│   1. VERIFY      confirms your Monolex login                     │
│   2. DISCOVER    "here are your machines"                        │
│   3. INTRODUCE   helps the two machines find each other          │
│   ───────────────────────────────────────────────────────────    │
│      ↓ server is now OUT of the loop                             │
│   4. DIRECT      data flows machine ↔ machine, peer-to-peer      │
│                                                                  │
└──────────────────────────────────────────────────────────────────┘
```

## The connection, step by step

```
   your laptop                 coordination            my-server
   (vpncli)                    server                  (daemon)
      │                          │                        │
      │  1. log in ───────────►  │  ◄──── daemon logs in  │
      │                          │                        │
      │  2. which machines? ───► │                        │
      │  ◄──── my-server (+how)  │                        │
      │                          │                        │
      │  3. introduce us ──────► │ ◄──── introduce us ─── │
      │                          │  (exchange connect info)│
      │                          │                        │
      │  4. ═══════ DIRECT PEER-TO-PEER LINK ════════════ │
      │            (encrypted; server not involved)        │
      │                                                    │
      │  "run: hostname"  ═══════════════════════════════► │
      │  ◄═══════════════════════════════════ "my-server" │
```

## Peer-to-peer, not a pipe

The server only helps with the introduction. It does **not** relay your
terminal data. Your two machines punch through NAT and talk directly.

```
┌───────────────────────────────┬───────────────────────────────────┐
│  The server CAN see           │  The server CANNOT see            │
├───────────────────────────────┼───────────────────────────────────┤
│ • that you logged in          │ • your keystrokes                 │
│ • which of your machines      │ • the command output              │
│   are connecting              │ • the files you copy              │
│                               │                                   │
│ (metadata, to route)          │ (the data never passes through it)│
└───────────────────────────────┴───────────────────────────────────┘
```

This is the same idea as Tailscale's coordination server: a lightweight
matchmaker that introduces peers, while the actual conversation stays private
between them.

<Note>
  For the interactive `shell`, if two machines genuinely cannot punch through to
  each other, vpncli can fall back to relaying the session through the server —
  and even then the data stays encrypted, so the server still only forwards
  scrambled bytes it cannot read. See [Security](/vpncli/security).
</Note>

## Next

<Card title="Is it encrypted?" icon="lock" href="/vpncli/security">
  Yes — every byte. Here's exactly what that means.
</Card>