<- all tokdocs
2026.08.29@morningcoffeebyte

Tailcat: Tailscale's Open-Source Netcat That Skips the Control Plane

Coding
Watch on TikTok

View on TikTok ->

Tailscale open-sourced Tailcat, a netcat-style CLI that routes connections through Tailscale's encrypted data plane while dropping the control plane entirely. You get WireGuard encryption and NAT traversal between machines on different networks with a single binary, no account, no coordinator server, and no existing Tailscale install. The video pitches it as a trust-no-middleman netcat for the modern internet, and the on-screen captions hammer the same point: "Netcat, but through Tailscale -- no control plane" and "Tailscale's encryption, zero account required."

What Tailcat Actually Is

Netcat is the classic Unix tool for piping raw data between machines over a network. It is simple and requires no setup, but it sends everything in plaintext and fails when both machines sit behind NAT. Tailcat keeps the netcat interaction model and swaps the transport for Tailscale's open-source data plane: userspace WireGuard for encryption, magicsock for NAT hole-punching, and DERP relays for bootstrapping when a direct path is not available. The repo describes it as "like netcat, but over Tailscale's data plane, without Tailscale's control plane," and it ships under a BSD-3-Clause license.

No Control Plane Means No Account

Normal Tailscale depends on a coordination server that handles identity, key distribution, and access control for your tailnet. Tailcat removes that dependency. One side listens and generates a short shareable address, you pass that address to the other machine out of band, and the second side connects with it. That three-step flow (listen, share, connect) replaces the account, login flow, and tailnet membership. The video's framing is accurate here: there is no coordinator server involved, so there is no third party managing who can talk to whom.

One Caveat on "Trust No Middleman"

The video calls Tailcat a "trust no middleman" tool. That holds for the payload, since traffic is end-to-end encrypted with WireGuard. It needs one qualifier: when NAT traversal fails, Tailcat falls back to DERP relay servers to carry the encrypted packets. The relay cannot read your data, but a middlebox does forward it in the worst case. You can also run your own DERP relays if you want to remove Tailscale's infrastructure from the path entirely.

Practical Uses

The transcript and captions focus on scripting and automation, and the official docs back that up with concrete modes:

  • Piping files between machines on different networks with no server in the middle
  • Tunneling local TCP ports across NAT boundaries
  • Running an auth-free SSH server for quick remote access
  • Acting as a SOCKS5 proxy or exit node
  • CI/CD jobs and AI agent sandboxes that need a temporary encrypted path to one specific machine

Because it runs in userspace via gVisor's Netstack, none of this requires root. It also ships as a Go library, so you can embed the same connectivity in your own tools.

Why Auditability Matters Here

The on-screen caption "Self-contained, auditable, built for automation" points at the distribution model. Tailcat is assembled from Tailscale's already open-source components and published as a single BSD-licensed repo, so you can read the code that handles your keys and traffic before you pipe anything sensitive through it. For a tool whose whole pitch is removing trusted intermediaries, source availability is part of the security argument, not a side note.

Key Takeaways

  • Tailcat is netcat's interaction model on top of Tailscale's encrypted data plane: WireGuard, magicsock NAT traversal, and DERP relays.
  • It skips Tailscale's control plane, so no account, coordinator server, or existing Tailscale installation is required.
  • Connection setup is listen, share the generated address out of band, connect.
  • Modes include stdin/stdout piping, TCP port tunneling, auth-free SSH, SOCKS5 proxy, and exit nodes, all in userspace without root.
  • Traffic is end-to-end encrypted, but DERP relays can carry the encrypted packets when direct connection fails; you can self-host relays.
  • Open source under BSD-3-Clause, usable as both a CLI and a Go library.

Resources

Published August 29, 2026. Writeup generated from a favorited TikTok.