tailcat

tailcat [options]tailcat [options] token [port]tailcat ping [--until-direct] [--timeout=duration] tokentailcat ssh [user@]token [command ...]tailcat socks [token] command [args ...]tailcat parse tokentailcat resolve tokentailcat genkey [options]tailcat printpub

tailcat is a userspace CLI from Tailscale that behaves like nc (netcat) over Tailscale's data plane (WireGuard encryption, magicsock NAT traversal, and DERP relays) without using Tailscale's control plane. No Tailscale account, tailnet, IP address, or root is required: it does not change routing tables or DNS.One side runs a server and prints a short connection token (prefix tc plus base64-encoded CBOR). The other side passes that token to connect. The handshake bootstraps through a DERP relay, then magicsock tries to upgrade to a direct peer-to-peer UDP path. All payload traffic is end-to-end WireGuard-encrypted.With no --serve list, a server accepts one connection and copies it to stdout (netcat style). With --serve, inbound TCP ports are forwarded to localhost, or the process can act as an auth-free SSH server or an exit node. Tokens can also be published as a DNS TXT record `tailcat=tc...` and used as a hostname anywhere the CLI takes a token.A Go library is importable as github.com/tailscale/tailcat. An experimental in-browser WASM demo at https://tailscale.github.io/tailcat/ interoperates with the CLI over DERP only.

--serve=list

Comma-separated ports, ranges, or service names to accept. Empty (the default) listens on a single connection and writes it to stdout. Named services: all (every TCP port), no-auth-ssh (auth-free SSH server, Linux/macOS), exit-node (clients can reach the server's network).

Key to use. new forces an ephemeral key. Empty uses the saved default key in server mode (or client-default in client modes) if it exists, otherwise an ephemeral key. Otherwise a name under $XDG_CONFIG_HOME/tailcat/keys/ or a path to a **\*.private.json** file.

Comma-separated client public keys (or none) allowed to connect. Empty allows every client.

In server mode, print a longer token with DERP server details embedded so clients need not fetch the DERP map.

In server mode, write `{"listenAddr": ...}` JSON to stdout.

JSON DERP map used to resolve or auto-select a relay region. Default https://tailcat.dev/derpmap.json.

Verbose logging.

Print the project README and exit.

Probe connectivity. Each pong reports latency and whether it arrived via a DERP relay or a direct path.

Open an SSH session through the tunnel (to no-auth-ssh or to a forwarded port 22).

Start an ephemeral SOCKS5 proxy and run command with all_proxy set. Destination hostnames that are themselves tokens are dialed as Tailcat servers; server.tailcat names the server from the optional token argument.

Decode a token to JSON (WireGuard public key and DERP info) without connecting.

Expand a short region-ID token into a self-contained token with DERP details embedded.

Generate and save a persistent key. --client writes a client identity and prints its public key for --allow. --fixed-region bakes the nearest DERP region in at generation time. --region=name pins a region, hostname, or auto. --list / --delete manage saved keys.

Print the public key of the client key that would be used.

Saved keys live under $XDG_CONFIG_HOME/tailcat/keys/ (typically ~/.config/tailcat/keys/) as _name_.private.json. The magic names default (server) and client-default (client) are used automatically once they exist.DERP maps are cached under $XDG_CACHE_HOME/tailcat/.TAILCAT_ADDR_FILE

In server mode, write the token to this path, or with a tcp: prefix send it to that TCP address.

A connection token is a capability: treat it like a password. Ephemeral keys (the default) die when the process exits; a saved default key keeps the same address across restarts, so anyone who ever received it can reconnect unless --allow restricts clients.The CLI, Go API, and wire format have no stability promises. Public Tailcat DERP relays are rate-limited, have no uptime SLA, and keep metadata logs — they are not a privacy service. Run your own derper (or pass --region=hostname / --derpmap-url) for private relays. --serve=no-auth-ssh really has no authentication; restrict it with --allow or proxy to system sshd instead (--serve=22). Browser WASM traffic stays on DERP until WebRTC is added.

Tailcat started in September 2023 as derpcat (first working commit on a long-haul flight) inside a fork of the Tailscale repo. It was later extracted as a regular Go module and open sourced in August 2026 at the TailscaleUp conference. BSD-3-Clause.

nc(1), ncat(1), socat(1), ssh(1), tailscale(1), wg(8)

Source code · Homepage · Documentation