Tailscale's Tailcat is netcat over WireGuard: pipes, ports and files between two machines with no account and no root

Netcat’s job is to move bytes between two machines. Its problem is that the bytes go out in the clear, and getting two machines to find each other through firewalls and home routers is your problem.

Tailcat, per its README, is “a remix of Tailscale open source pieces to act like netcat, but over Tailscale’s data plane.” A server prints a short Tailcat address. The client connects with it. Tailscale’s magicsock layer supplies “point-to-point WireGuard-encrypted tunnels between two machines.”

The part that matters for the rest of us is what it doesn’t need. The README says “You don’t need a Tailscale account, root/admin access on the machine,” and calls it “just a userspace library and CLI tool.” The WireGuard code runs in userspace and “doesn’t use a kernel TUN/TAP device,” so it never has to change your routing tables or DNS.

Pipes look like the original. Start tailcat on one side, then run echo hello | tailcat <tc-addr> on the other. If you need a port, tailcat serve 8080,8443 on the server and tailcat forward tcXXXXXXXXX 18080:8080 3306 on the client do it. (Netcat with a seatbelt on.)

The drop box is the neat trick. Run tailcat recv ~/inbox on the receiving machine, and anyone with the address can run tailcat cp report.pdf tcXXXXXXXXX: to send a file. The README says “the drop box is write-only: senders can’t list the directory, read anything back, or touch existing files.”

And then there is SSH. Tailcat can run an SSH server that trusts keys it reads from GitHub: “A user@github source fetches https://github.com/user.keys once, before the server starts.” The README’s example is tailcat serve --ssh-authorized-keys=bradfitz@github,./contractor.pub ssh, which authorizes one GitHub user and one key file in a single command.

How do the two machines find each other without a login? The README says “all tailcat connection metadata is exchanged out of band, however you want”: you paste the address into chat, email or a text message. Tailscale’s relay network, called DERP, “is used as a rendezvous channel and as a fallback data path when direct connectivity isn’t possible.” When it can, magicsock punches through the NAT to get “a direct peer-to-peer UDP connection when possible (usually!).” The exclamation point is the README’s own.

There is fine print, and the maker puts it in writing. Tailcat “is free to use, but it comes with no API or CLI stability promises.” The public rate-limited relays “have no uptime SLAs or throughput targets.” Transfers aren’t compressed, so compress big files first. The browser demo is “experimental” and, for now, “browser traffic is relayed over DERP only, with no direct connections until WebRTC support.”

Here is the sharpest warning: “Never publish the address of a no-auth-ssh server (or any other server that trusts whoever connects).” The address works like a password. Anyone who has it can connect.

Tailscale open-sourced Tailcat in August 2026 at its TailscaleUp conference, under a BSD-3-Clause license. What is missing is any word on how long the public relays will stay up for free. The README says only that they come with no guarantees.

Direct, usually!