Tailscale Releases Tailcat for Encrypted Machine Links Without Accounts or Admins
The new open-source utility makes Tailscale’s connection layer available to isolated and short-lived systems, but leaves token sharing, access decisions and reliable fallback infrastructure outside the tool.
Listen to this story
The audio brief
Story brief
3 key pointsTailscale’s Tailcat targets short-lived or hard-to-manage machines that need secure connectivity without modifying the host or enrolling it in an account-based network. A server-created address carries the public key and relay bootstrap data, making that address an out-of-band credential. Tailcat prefers direct WireGuard-over-UDP links but falls back to DERP, whose hosted relays are throttled and regionally limited....
- 01
Tailcat requires no root, TUN device, routing-table changes, administrator access, or host-network reconfiguration.
- 02
DERP provides initial connectivity and fallback; successful NAT traversal moves traffic directly between machines over UDP.
- 03
The Tailcat address must be shared separately and functions as a connection credential.
Tailscale has released Tailcat, an open-source Go package and command-line tool that creates encrypted connections between two machines without accounts, logins, administrators or a control plane. The tradeoff is deliberate: it removes setup friction for temporary systems while moving connection sharing and infrastructure choices to the operator.
A token starts the connection
Tailcat is a netcat-like tool for moving bidirectional bytes between a client and server. The server generates a key pair and a Tailcat address containing its public key and DERP relay bootstrap information; the address must be shared with the client through another channel.
The client first connects through DERP, Tailscale’s relay system, while the company’s magicsock networking layer attempts a direct peer-to-peer WireGuard connection over UDP. If NAT traversal succeeds, traffic moves directly between the machines; DERP carries traffic when it does not.
The host network stays untouched
An embedded userspace TCP/IP stack handles the connection inside Tailcat rather than changing the host networking stack. The tool does not create a TUN device, alter routing tables or require root or administrator operating-system access—useful where a machine is ephemeral, untrusted or awkward to reconfigure.
Connections Tailcat can support
- A quick file copy or port forward between two machines.
- An SSH session, including when one side should not have its system configuration changed.
- A temporary local SOCKS proxy for a child process that does not natively know about Tailcat.
A use case for agent-controlled machines
Brad Fitzpatrick, who authored Tailscale’s launch post, said customer use cases helped revive Tailcat. He has also used it to link sandboxed coding agents with temporary virtual machines and remote hardware, including Raspberry Pi systems, EC2 instances and a Windows host creating and destroying Hyper-V virtual machines.
Management remains the paid layer
Tailcat makes the boundary around Tailscale’s managed product more visible. Tailscale says its core, DERP server and clients on open-source platforms are open source, while its server-side control plane is not. Operators can run an open-source DERP server themselves; Tailscale also offers integration help and operation of a global relay fleet for customers that need it.
Sources
- tailscale.comTailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP
