Tailcat
Secure tunnels in seconds
Tailcat connects machines over an encrypted connection, even when they’re on different networks. No accounts, login flow, tailnets, or IP addresses. Just share a tailcat address and connect.
Tailcat connects machines over an encrypted connection, even when they’re on different networks. No accounts, login flow, tailnets, or IP addresses. Just share a tailcat address and connect.
Setting up a tailnet makes sense when you need governable access, identity, and policy. Sometimes you don’t. You might need to SSH into a development environment for an hour. Give an agent access to a test machine for one task. Connect a game session. Move a file between two machines. Tailcat gives you a secure connection without requiring either side to become part of a larger network.
Run Tailcat on the machine you want to reach. It generates an address you can share to make a secure connection from other machines.
Securely send the address to the person, machine, or agent you want to connect.
Use the address from another machine to connect securely. Tailcat makes a direct connection whenever possible, and can fall back to a tailcat relay if needed.
Try quickly sending some development files over to your AI agent sandbox for testing and verification by piping your files over tailcat.
Tailcat is a netcat-style CLI from Tailscale for connecting two or more machines across different networks. It gives you an encrypted connection without requiring a Tailscale account, login flow, tailnet, or IP address.
No. Tailcat doesn’t require an account or login. Access comes from the tailcat address generated by the machine you want to reach.
Tailcat is not an entirely anonymous service.
While tailcat doesn’t require you to create an account with Tailscale, have any concept of users, or declare your identity before use, access is based on possession of a tailcat address and public keys each node shares. Those public keys represent a node’s identity.
During a connection, tailcat clients exchange MEOW messages, keys, encode themselves into a network map, and check against an optional key-based allowlist to confirm access.
Keys can be generated as ephemeral keys on every tailcat run (default) or optionally as a long-lived keypair.
Tailscale is designed for ongoing, scalable, auditable connectivity. It gives people, devices, services, and agents identities and lets you define who can access what, with auditability and governance built-in.
Tailcat is designed for a narrower job. It connects your machines without requiring an account, identity, or tailnet first.
Use Tailscale when you need a governable network. Use tailcat when you need a quick connection.
Tailcat works well for short-lived connections like remote development, SSH access, file transfers, CI jobs, game sessions, and sandboxed environments. It’s also useful when software or an AI agent needs temporary access to a specific machine without joining your network.
Yes. Agents often need to reach a machine for a specific task, but they can’t always complete login flows and may not need persistent network access. Give the agent a tailcat address and it can connect to the machine for that workflow without joining a tailnet.
Yes. The address grants access to a specific connection. Treat it like a password. Don’t log it, commit it to source control, or share it with anyone who shouldn’t have access. Definitely don’t tweet it.
No. Tailcat intentionally leaves out accounts, identity, policies, device management, and persistent network access. If you need ongoing and governable access to multiple users, services, agents, or machines, use Tailscale. If you need a quick, lightweight connection between two machines, use tailcat.
Tailcat is a remix of Tailscale which gives you a way to use the open-source Tailscale data plane (WireGuard® + NAT traversal + DERP) without the Tailscale control plane. Tailcat relies on a tailcat relay service to bootstrap connections. Note that our hosted relay service keeps metadata logs and isn't intended for privacy.
Tailcat does not have a control plane or coordination service. This means tailcat has:
Tailcat relays are built on a DERP fleet designed for fairness across the fleet. Our hosted relay service keeps metadata logs and isn't intended for privacy or high-throughput use cases.
You can either run your own derper with Tailscale’s Custom DERPs, or contact us to have Tailscale host a DERP fleet for you.