tailscale/tailcat
like netcat, but over Tailscale's data plane, without Tailscale's control plane
Read original source
Source record
Recorded metrics
daily_stars · 256 stars today
2026-11-14 09:32:26.677Z
GitHub daily Trending window; attention only
Project analysis
Problem & scenario
Tailcat lets users connect two machines without a Tailscale account, administrator access or changes to routing and DNS. Example scenario: a developer needs a colleague to inspect a local web service. An existing workflow could require arranging network access and configuring forwarding; with Tailcat, the developer runs `tailcat serve 8080`, privately shares the printed address, and the colleague forwards that port locally. This makes temporary access practical without enrolling machines in a managed network. The trade-off is that users must exchange connection metadata themselves and protect access credentials. The supplied evidence describes Tailcat, not a separate WeWorkBuddy product.
Features & advantages
Compared with Tailscale, Tailcat retains its encrypted data plane but replaces the control plane with user-managed address exchange. For temporary port sharing, this removes the account requirement while leaving users responsible for distributing addresses and managing their lifetime. Tailcat also offers scoped port mappings: the documented Android adb example exposes one LAN endpoint, whereas its exit-node mode allows broader network access. This supports choosing the narrowest access needed. The README positions it as netcat-like and adds file, SSH and forwarding commands, but supplies no measured performance or usability comparison with netcat or Tailscale.
Technical approach
The README documents a Go CLI built on an importable Go library, using magicsock, WireGuard and DERP. One connection path starts when a listener generates an address containing connection metadata. The client receives that address out of band, bootstraps through DERP, and magicsock attempts NAT traversal to establish direct UDP transport; DERP remains the fallback. Application traffic travels through the end-to-end encrypted tunnel. Operationally, blocked direct connectivity creates relay dependence, and public relays are rate-limited; operators can run their own. The browser WebAssembly demo is relay-only. This is a documented flow, not a commit-pinned code audit.
Business model & buyers
The documented economic offer is open-source software with free, rate-limited public DERP relays and an option to run a relay yourself. The supplied material states no paid plan, billing model or support contract. Developers and operations teams needing temporary file transfer, service access or remote troubleshooting are plausible users; recurring access needs or relay constraints could trigger evaluation of supported or hosted services. Those are buyer and purchase-trigger hypotheses, not an existing commercial offer. Self-hosting provides infrastructure control but transfers relay operation to the user. No revenue or paying-customer conclusion is supported.
Growth & distribution
Tailcat has several documented entry points: platform package options, a browser demo and a Bluesky profile link. The source record also places it on GitHub Trending, but gives no observation date or adoption figures. First value can come from sending text or a file between two endpoints; the browser demo can let one participant try this without installing the CLI. A plausible adoption path is a successful transfer followed by recurring forwarding or SSH use. Address exchange, CLI setup and relay-only browser traffic can impede activation. These distribution surfaces do not establish acquisition rates, retention or growth.