Tailscale ships tailcat: netcat over WireGuard with no control plane or accounts

What tailcat is

Tailscale has released tailcat, an open-source Go package and command-line tool that connects two machines over the company's data plane — WireGuard encryption, NAT traversal and the DERP relay fallback — while dropping the coordination layer that normally surrounds it. According to a Tailscale blog post that reached the Hacker News front page, the tool behaves like netcat, except the bytes travel over magicsock, Tailscale's transport stack.

The omissions are the point. The post lists what tailcat does without: IP addresses, accounts and logins, a control plane, users and admins, administrative controls, and root or administrator access to the operating system. There is also no dependence on Tailscale as a company, provided you run your own derper relay server.

How it works

A tailcat listener starts by generating a keypair, either ephemeral or named and reused, and picks a DERP server — one you specify, or an auto-selected Tailscale-operated relay that is bandwidth-limited. It then derives a tailcat address, a short string encoding the public key and relay bootstrap information. You hand that string to the other party out of band, either directly or through a DNS TXT record tied to a hostname.

The client side mirrors this: it picks its own key, contacts the relay named in the address, and introduces itself to the server's public key with a message the protocol calls MEOW. If the server accepts that key — it can optionally be locked down to an allowed set — it replies and the two sides connect.

Actual data travels through an embedded userspace TCP stack running on top of WireGuard. Synthetic IPv6 addresses derived from the public keys exist on the wire but are never exposed to the user, and the host operating system never participates at the TCP layer; it only sees UDP WireGuard packets or TCP connections to the relay. No TUN devices, routing table changes or other network reconfiguration take place.

Because the magicsock layer handles NAT traversal, the peers try to establish a direct UDP path first, falling back to relaying over DERP only when both sit behind hard NATs with no port mapping available. Tailscale's own relays are rate-limited, the post notes, since the bandwidth costs the company money; running your own relay removes both the limit and the last tie to Tailscale.

In default server mode, tailcat pipes whatever it receives to stdout, netcat-style. In client mode, it can bring up a SOCKS server on an ephemeral local port and launch a child process — curl, for example — configured to use it, so programs with no knowledge of tailcat can use the tunnel transparently.

Why Tailscale built it

The post's author writes that tailcat was originally written in September 2023 during a ten-hour flight and treated as an internal novelty, though some customers later received copies alongside arrangements for Tailscale-hosted fallback relays.

The renewed interest is tied to AI agents. The author describes handing sandboxed agents tailcat together with untrusted nested virtual machines and remote hardware: a fleet of Raspberry Pis covering every generation, an EC2 instance used while porting Tailscale into EC2's UEFI environment, and a Windows host for repeated Hyper-V debugging. Tailscale argues the tool shines when two shells on two very different machines need connecting quickly — a file copy, a port forward, an SSH hop — especially when one side is untrusted or ephemeral and touching its system configuration is unappealing.

The post also recalls that netcat-style sharing between nodes was among the first requests when Taildrop launched in 2021, and says a tailcat-like feature may yet find its way into the main client. Tailscale is candid that a tool like this was bound to exist regardless, and says it would rather have people using, improving and filing bugs against its data plane, since that work feeds back into the broader product.

Why it matters

Tailcat cleanly separates the parts of Tailscale that are open source — the data plane, the DERP server and the Linux and Android clients — from the control plane, which remains closed. Engineers who previously chose between raw WireGuard on a public IP and a full mesh network with accounts and ACLs now get a middle option: encrypted, NAT-traversing, relay-backed byte pipes requiring no infrastructure beyond a shared address string.

The agent angle may matter even more. Giving autonomous, sandboxed code a constrained connectivity primitive instead of firewall edits or port forwards is a pattern many teams are reaching for, and Tailscale is effectively inviting that use. The bet seems to be that wider adoption of its data plane — even with no control plane attached — ultimately benefits the product it sells.