Tailscale's Tailcat repackages its WireGuard data plane as a netcat-style tunnel tool

What Tailcat does

Tailscale has released Tailcat, an open-source command-line tool and importable Go library that reassembles pieces of its existing open-source stack into a netcat-like utility. According to the project's GitHub repository, which reached the front page of Hacker News, Tailcat establishes point-to-point WireGuard-encrypted tunnels between two machines while skipping Tailscale's control plane entirely — effectively Tailscale's networking without the Tailscale service.

The tool is built on the same data plane that underpins the main product, a component the company calls magicsock, reusing its ability to form direct peer-to-peer UDP connections and to fall back to relayed transport when NAT traversal fails. Where Tailscale normally leans on its coordination servers to hand out keys and connection metadata, Tailcat moves that exchange out of band by whatever channel the user prefers: one side starts a listener that prints a short connection token, and the other side passes that token to the client to connect. The Go library is importable as github.com/tailscale/tailcat, and the CLI lives in the repository's cmd directory.

No account, no root

Because there is no control plane, no Tailscale account is needed, and the tool runs entirely in userspace. The GitHub documentation notes that it does not modify routing tables or DNS settings and requires no root or administrator privileges. Connections bootstrap through Tailscale's DERP relay network, after which magicsock attempts NAT traversal to upgrade to a direct UDP path, which the documentation says usually succeeds. Tailcat ships with a default map of free, rate-limited DERP relays, and operators can run their own.

What you can do with it

The repository's examples cover a netcat-like range of uses:

• Piping stdin and stdout between two machines, with the server printing an ephemeral address and the client piping data to it.
• Forwarding local TCP ports with --serve, exposing services bound to localhost through the tunnel.
• Running an SSH server with no authentication on Linux and macOS via --serve=no-auth-ssh, or proxying to the system SSH daemon instead when credentials are wanted.
• A ping mode that reports for each reply whether it arrived over a relay or a direct path, plus an --until-direct flag that keeps probing, up to a 10-second default timeout, until a direct path works.
• A SOCKS5 mode that routes commands through the tunnel; tokens can double as URL hostnames for tools like curl, though not for browsers, which lowercase hostnames and break the case-sensitive tokens.
• An exit-node mode that lets a client reach the server's broader network.

Keys, tokens and DNS names

A server's token is derived from its WireGuard key. Ephemeral keys are the default: each run generates a fresh key in memory, and once the process exits, that address is dead permanently. Alternatively, tailcat genkey saves a key to disk so the address stays stable across restarts — with the trade-off that anyone who ever received the address can connect to future servers on that key unless clients are restricted with --allow. The README warns about a subtle default here: once a saved key named "default" exists, plain tailcat silently reuses it, so the startup line is the way to tell which mode you are in.

Tokens can also be published as DNS TXT records and looked up by name, and a DNS name works anywhere the CLI accepts a token. The documentation demonstrates this with an SSH server reachable by hostname with no inbound ports open on the machine, where WireGuard authenticates the client before the SSH layer ever sees a packet.

Why it matters

Tailcat is a notable unbundling of a commercial product into reusable parts. Tailscale's pitch has always centered on the managed control plane layered over WireGuard; Tailcat shows the data plane is a useful primitive on its own. For developers, it offers ad-hoc encrypted connectivity — one-off transfers, quick access to machines behind NAT, temporary SSH exposure — without provisioning accounts, opening ports or configuring a VPN. For Tailscale, it doubles as a demonstration that its open-source components stand alone, and plausibly a funnel: users who outgrow manual token exchange will eventually want coordination, identity and access control, which is precisely what the paid control plane provides. The security model is worth watching, though — with the token acting as both address and capability, the choice between ephemeral and saved keys carries real consequences, and the project is explicit about them.