Last verified
Connect machines across networks with end-to-end WireGuard encryption, no accounts or IP addresses required.
Run `tailcat --serve=no-auth-ssh` on the target machine, share the token, and SSH in from anywhere without port forwarding or VPN setup. The ephemeral key means the access expires when the tailcat process stops.
You need persistent, stable SSH access to the same machine across sessions. Publish a stable keypair in DNS, or use Tailscale for ongoing device access instead of generating a new ephemeral token each time.
Agents often cannot complete interactive login flows and may not need persistent network membership. Give the agent a tailcat address and it connects to the target machine for that specific workflow without joining a tailnet.
Your agent framework already manages network access through Tailscale, or the agent needs to reach multiple services that are already on a tailnet. Tailcat adds no value inside an existing tailnet.
Pipe files over stdin/stdout with plain `tailcat`, or forward a local TCP port to a teammate with `tailcat --serve=8080`. No shared network membership required. Works across NAT and different networks without additional configuration.
You need to share access with more than one person at the same time, or need the connection to persist after your machine sleeps or restarts. Tailcat is designed for point-to-point, single-session use.
Import `github.com/tailscale/tailcat` and use the zero-value `Server` struct to start a listener, get a connection token via `ConnBlob()`, and accept inbound TCP connections. The library picks safe defaults without configuration. Useful for test harnesses or CLI tools that need temporary connectivity.
Your use case requires a stable versioned API. The tailcat Go library has no stability promises and the API, CLI flags, or wire format may change between releases.
Setting up a full VPN or mesh network to make one short connection between two machines is more work than the job deserves. Most tools in this space require accounts, device enrollment, an admin dashboard, and policy configuration before the first packet moves. SSH port forwarding is fragile across NAT boundaries. VPN clients need OS-level routing changes and root access.
The pain is worse when the connection is temporary. Giving an AI agent access to a test machine for one task, sharing development files with a teammate for an hour, or exposing a local port for a quick demo should not require a persistent network membership that outlasts the task. Commercial platforms optimized for ongoing, auditable access do not fit narrow, time-limited use cases.
Connects two machines using a short connection token derived from a WireGuard public key. No Tailscale account, login flow, tailnet, or static IP address needed on either side. Share the token and the other machine connects.
All tunnel traffic is encrypted with WireGuard. Tailcat uses Tailscale's userspace WireGuard implementation, which does not require a kernel TUN/TAP device or root access on either side. No OS routing tables or DNS settings are modified.
Tailcat attempts direct peer-to-peer UDP connections via STUN-based endpoint discovery and UDP hole-punching. When a direct path is not possible, traffic falls back to a DERP relay. The `tailcat ping --until-direct` command confirms which path is active.
Run `tailcat --serve=no-auth-ssh` to start an SSH server over the tunnel on Linux and macOS. Forward any local TCP port with `--serve=8080`, or route traffic through a SOCKS5 proxy with `tailcat socks`. All modes run over the same WireGuard tunnel.
By default, each `tailcat` server run generates a fresh ephemeral WireGuard key, and the address dies when the process exits. For stable addresses published in DNS, `tailcat genkey` saves a long-lived key to disk. The startup message tells you which mode is active.
The `github.com/tailscale/tailcat` Go package can be imported directly into programs. The zero-value `Server` struct picks safe defaults (ephemeral key, nearest DERP region) and the tunnel is established lazily on the first dial. Useful for embedding ephemeral connectivity into CLI tools or test harnesses.
Tailcat and Tailscale share the same underlying data plane: WireGuard, magicsock transport, and DERP relay infrastructure. The difference is the control plane. Tailscale adds a managed coordination layer with accounts, device inventory, ACL policies, and audit logs. Tailcat removes that layer entirely.
| Feature | tailcat | Tailscale |
|---|---|---|
| License | BSD-3-Clause | Open-source client; proprietary coordination |
| Accounts required | No | Yes |
| Persistent network | No | Yes |
| Access governance | None | Full (ACLs, groups, audit logs) |
| Rate-limited relays | Yes (public hosted) | No (managed infrastructure) |
Tailcat is the better choice for one-off connections: a developer SSH session, a file transfer, or an AI agent task. Tailscale is the better choice when you need persistent, governable access across multiple devices and users, or when compliance requires an audit trail.
Twingate is a zero-trust network access product targeting enterprise teams. It requires connectors deployed in your infrastructure and users managed through an identity provider. It is a commercial product with no self-hosting option.
| Feature | tailcat | Twingate |
|---|---|---|
| License | BSD-3-Clause | Proprietary |
| Accounts required | No | Yes (SSO/IdP) |
| Self-hosting | N/A (relay only) | No |
| Access policies | None | Fine-grained per resource |
| Pricing | Free | Per-user SaaS pricing |
Tailcat wins for short-lived, account-free connections. Twingate is the better fit for enterprise teams replacing a legacy VPN with identity-linked, policy-controlled access to internal resources.
ZeroTier creates a virtual Ethernet layer across machines. It has an open-source network controller you can self-host, a free tier for up to 25 devices, and commercial plans above that.
| Feature | tailcat | ZeroTier |
|---|---|---|
| License | BSD-3-Clause | Business Source License |
| Network model | Point-to-point tunnel | Virtual Ethernet (Layer 2) |
| Accounts required | No | Yes (for managed service) |
| Self-hosted controller | No | Yes |
| Persistent membership | No | Yes |
Tailcat is faster to set up for a single connection and requires no account. ZeroTier is the better choice for persistent multi-device virtual networks, especially when you need Ethernet-layer features or want to self-host the network controller.
Install tailcat with Go; no system setup or root access required.
```bash
go install github.com/tailscale/tailcat/cmd/tailcat@latest
```No. Tailcat does not require a Tailscale account, login, or any form of user identity. Access is granted by possession of the connection token. The token encodes the server's WireGuard public key and DERP relay info, which is everything a client needs to connect.
The connection traffic is encrypted end-to-end with WireGuard. However, the hosted tailcat DERP relays keep metadata logs and are not intended for privacy-sensitive use. If privacy is a hard requirement, run your own DERP relay using Tailscale's open-source derper project, specifying its hostname with tailcat genkey --region=your.derp.host.
Tailscale is designed for ongoing, auditable, governable network access across devices and users. Tailcat is designed for narrow, short-lived connections between two machines with no account, identity, or persistent network membership. Use Tailscale when you need a managed network; use tailcat when you need one quick encrypted connection.
A tailcat connection token (starting with tc) encodes the server's WireGuard public key and DERP relay info. Anyone who has the token can connect to that server session, so treat it like a password. Do not log it, commit it to source control, or share it publicly. Ephemeral tokens (the default) expire when the server process stops.
Yes. The github.com/tailscale/tailcat Go package is importable as a library. The zero-value Server struct starts a listener, and ConnBlob() returns the connection token for sharing. Note that the Go API has no stability promises and may change between releases.
Alternative to
Tailscale
Connect devices seamlessly without relying on the cloud.
Android app updates direct from GitHub and F-Droid
Alternative to
Astrill VPN
Fast and censorship-resistant proxy solution
Alternative to
Kong Konnect
Unified API keys, gateways, and observability for developers.
Alternative to
Unraid
Browser desktop for your self-hosted home server
Alternative to
iCloud Drive
Your GitHub repos as a native drive in macOS Finder
Featured
Alternative to
Grok Bot
AI teammates you own: your keys, your model, your machine.
Alternative toClaude Managed Agents
Open-source agent deployment API. Self-host or use Omnara Cloud.
Alternative to
Superhuman
AI email assistant that drafts replies and clears your inbox
The projects we add and every new guide. Free, unsubscribe any time.
Claude Code to 
OpenCode
Jira to 
Windshift
Notion to 
AppFlowy
Slack to 
Mattermost
Linear to 
GitLab
Wispr Flow to 
Handy
CapCut to 
Concat
Grok Bot to 
rakazo
Superhuman to 
Inbox Zero
Airtable to 
AITable
Muse to 
OpenClaw
GitHub Copilot to 
Cline
Datadog to 
Netdata
Microsoft Teams to 
Rocket.ChatConfluence to 
Docmost
Pinecone to 
Qdrant
Zapier to 
n8n
Devin AI to 
OpenHands
Firebase to 
Supabase
1Password to 
KeePassXC
Contentful to 
Strapi
Adobe Premiere Pro to 
Shotcut
ChatGPT to 
AnythingLLM
LangSmith to 
Langfuse
