Tailcat

Tailcat is an open-source Go CLI and library from Tailscale that provides Netcat-style connections over Tailscale's encrypted data plane without using the Tailscale control plane or requiring a Tailscale account. A server generates a connection token containing WireGuard and relay metadata; a client uses the token to establish an end-to-end encrypted tunnel, initially through a DERP relay, while magicsock attempts NAT traversal and a direct peer-to-peer UDP connection. Its userspace networking stack does not alter routing tables, DNS settings, or require root access.

The CLI can pipe standard input and output between machines, forward local TCP ports, provide an unauthenticated SSH server, run commands through a SOCKS5 proxy, act as an exit node, ping and inspect connection tokens, and publish tokens through DNS TXT records. The Go library exposes server and client APIs for dialing TCP ports through the tunnel. Tailcat can use Tailscale's public rate-limited DERP relays or user-operated relays, and an experimental WebAssembly browser demo supports file and text transfer. The project states that its CLI, API, and wire format have no stability guarantees.