Tailcat is a command-line tool and Go library that provides netcat-like connectivity over Tailscale's data plane without requiring Tailscale's control plane infrastructure.
The tool solves the problem of establishing secure point-to-point connections between machines without needing a Tailscale account or control plane dependency. It reuses Tailscale's open source data plane components, specifically magicsock, which provides WireGuard-encrypted tunnels between peers. Connection metadata is exchanged out of band through a short connection token rather than through Tailscale's servers. The initial connection bootstraps through a DERP relay server for NAT hole-punching, then magicsock attempts to upgrade to a direct peer-to-peer UDP connection when possible. All traffic is encrypted end-to-end with WireGuard, and the tool runs entirely in userspace without requiring root access or modifying system routing tables or DNS.
Tailcat suits developers and operators who need secure inter-machine communication without the overhead of a full Tailscale deployment or account. It works well for temporary connections, file transfers, remote command execution, and exposing local services through encrypted tunnels. The tool includes a web-based demo compiled to WebAssembly for in-browser file and text transfer. Users can rely on free rate-limited DERP relays provided by default or run their own DERP infrastructure for complete independence.
The project maintains active development with regular commits addressing core functionality and experimental features. The codebase includes a command-line interface alongside an importable Go library, allowing both direct tool usage and integration into other applications. The maintainers actively track connectivity issues and are working toward WebRTC support for browser-based direct connections. The project accepts community contributions and maintains comprehensive documentation covering installation, usage patterns, and configuration options including custom DERP relay setup.
