Tailcat – Like netcat, but over Tailscale’s data plane
Points and comments are a snapshot, not live.
Tailcat lets two machines connect and transfer data without needing a Tailscale account or control plane.
Tailcat is an open-source CLI and Go library that reuses Tailscale's data-plane components (WireGuard, magicsock, DERP relay, gVisor netstack) to create point-to-point encrypted tunnels without the Tailscale control plane or root access. One side runs a server and gets a connection token; the other passes that token to connect. The token encodes the server's WireGuard public key and DERP info. Traffic is encrypted end-to-end; initial bootstrapping goes through a DERP relay, then the library attempts NAT traversal to upgrade to a direct peer-to-peer UDP connection. Users can run their own DERP servers or use Tailscale's free rate-limited relays. The tool supports piping stdin/stdout, exposing local TCP ports, and running an SSH server without authentication. The project offers no API or CLI stability promises and the public DERP relays have no SLAs.
What commenters are saying
Most commenters saw Tailcat as a clever repackaging of existing components to deliver NAT traversal without Tailscale's control plane, and the author (Brad Fitzpatrick) confirmed there is no vendor lock-in: the DERP server is open source and users can run their own. A few pushed back via lower-ranked comments, arguing that plain WireGuard or port forwarding already works for many, and that building a dependency on Tailscale's stack creates ecosystem lock-in. Others countered that NAT traversal is genuinely hard, especially from mobile hotspots or restrictive networks, and that Tailcat's zero-config approach offers real convenience.
Discussion also surfaced alternatives: magic-wormhole, Netbird, OpenZiti, and ZeroTier were mentioned as existing solutions, with some users noting that the key differentiator is Tailcat's minimalism and its removal of the Tailscale control plane requirement.