Tailcat exposes Tailscale’s WireGuard data plane without the Tailscale control plane

Tailscale released Tailcat on August 31 as an open-source Go package and CLI built from the same `magicsock` data-plane components used by Tailscale. Instead of enrolling devices in the Tailscale control plane, one side starts a Tailcat listener and shares a short connection token out of band; the other side uses that token to connect. Traffic is encrypted end-to-end with WireGuard, initial rendezvous can use DERP, and the library attempts NAT traversal to upgrade the connection to direct peer-to-peer UDP when possible. Tailcat does not change system routes or DNS and does not require a Tailscale account or administrator/root privileges.

Tailscale’s easiest path normally combines an open-source networking data plane with Tailscale’s managed identity and coordination layer. Tailcat separates those layers in a supported public project, giving developers a small primitive for applications that need encrypted peer connectivity but want to own identity, authorization and connection metadata themselves. That can be useful for self-hosted tools, temporary peer transfers, developer utilities and embedded networking features. The cost of that freedom is operational: Tailcat is not a replacement control plane, its connection metadata must be exchanged securely by the application, and Tailscale provides no API, wire-format or relay SLA guarantees.

A Tailcat server produces a short token containing the information a peer needs to establish the session. How that token reaches the client is intentionally outside Tailcat’s scope. That makes the library composable, but it also shifts authentication, authorization, expiry and token-delivery decisions into the surrounding application.

Tailcat uses WireGuard for end-to-end encryption and Tailscale’s `magicsock` code for NAT traversal. Connections bootstrap through DERP, then try to establish direct UDP where the network permits it. This preserves much of the difficult peer-connectivity engineering without requiring a machine to join a managed tailnet.

Tailcat does not modify routing tables or DNS and does not require root or administrator privileges. The CLI behaves more like an encrypted NAT-traversing netcat, while the Go package lets another application embed the same connection behavior directly.

The default setup can use Tailscale’s free rate-limited DERP relays, but the project also supports self-hosted DERP infrastructure. Tailscale explicitly describes the public relays as best-effort, with no uptime or throughput commitment, so production users that depend on relay availability need to make that trade-off explicit.