tsnet

Tailscale is a networking service for creating private WireGuard-based networks between a user's devices and servers. It can provide remote access over SSH and route traffic through an authorized device configured as an exit node, such as a local Mac, so external websites see that device's network address rather than the server's data-center address. The project includes the open-source `tailscaled` daemon and `tailscale` command-line tool, with the daemon running on Linux, Windows, macOS, and to varying degrees on FreeBSD and OpenBSD. The repository also supplies code used by Tailscale's mobile applications; platform-specific GUI wrappers and hosted-service components are separate. Packages are provided for several distributions, and the project uses WireGuard with authentication features including 2FA, OAuth, and SSO.

Tailcat is an open-source Go CLI and library from Tailscale that provides Netcat-style connections over Tailscale's encrypted data plane without using the Tailscale control plane or requiring a Tailscale account. A server generates a connection token containing WireGuard and relay metadata; a client uses the token to establish an end-to-end encrypted tunnel, initially through a DERP relay, while magicsock attempts NAT traversal and a direct peer-to-peer UDP connection. Its userspace networking stack does not alter routing tables, DNS settings, or require root access. The CLI can pipe standard input and output between machines, forward local TCP ports, provide an unauthenticated SSH server, run commands through a SOCKS5 proxy, act as an exit node, ping and inspect connection tokens, and publish tokens through DNS TXT records. The Go library exposes server and client APIs for dialing TCP ports through the tunnel. Tailcat can use Tailscale's public rate-limited DERP relays or user-operated relays, and an experimental WebAssembly browser demo supports file and text transfer. The project states that its CLI, API, and wire format have no stability guarantees.

Tailtab is a browser extension and native host that gives each browser profile its own Tailscale node, allowing profiles to use different tailnets and exit nodes simultaneously. The extension communicates with a Go host through native messaging; the host embeds Tailscale's tsnet, becomes a tailnet node, and exposes an authenticated HTTP/SOCKS5 loopback proxy. Chromium uses a PAC script and Firefox applies equivalent per-request proxy rules, so tailnet traffic—including MagicDNS, tailnet domains, and routed private ranges—uses Tailtab while ordinary browsing bypasses it. Each profile has separate node keys and state, and the proxy uses a per-process credential to prevent other programs from borrowing the profile's identity. Tailtab also supports multiple Tailscale accounts, custom Headscale-compatible coordination servers, per-profile exit nodes, and tailnet machine search. It is distributed from the GitHub repository with release binaries and browser extension packages for Chromium-based browsers and Firefox/Zen; installation is currently manual, and the project describes itself as experimental. It is licensed under BSD-3-Clause.

Aperture is Tailscale's private AI platform and gateway for teams. It sits between AI agents or interfaces and model, MCP-server, and API endpoints, using the Tailscale tailnet for identity rather than shared API keys. Aperture centralizes authentication for tools such as Cursor, Claude Code, and Codex, supports both LLM and MCP gateway use, sets budgets by model, and retains logs for diagnosing agent behavior and measuring AI usage.

StarNet is a local-first desktop harness for creating and running AI agents inside a pixel-art space station. The station layout represents the workflow: rooms define capability-scoped teams, hallways authorize handoffs, and placed objects grant capabilities. Each agent run uses its own workspace, transcript, memory, and bounded permissions, while the station reflects runtime state rather than simulating activity. The harness streams model calls through a local Node sidecar and applies explicit capability and consent checks to tool use. It supports OpenRouter and provider sign-ins for Anthropic, OpenAI, and Google, as well as local models through Ollama. Agents can run concurrently, connect to Telegram, Discord, Slack, Signal, and Matrix, use MCP servers and other connectors, launch recipes and reusable skills, run on schedules, and deliver files through an OUTBOX. Spend, budgets, tasks, schedules, transcripts, and memory persist in the local StarNet workspace; provider requests leave the machine when an agent runs, while secrets are held by the sidecar or operating-system keychain rather than the frontend. StarNet is distributed as a desktop application for Windows and macOS, with Windows identified as the most-tested target. It is also runnable from source with Node.js, and its code is available under the MIT License. The StarNet name, logo, artwork, sprites, and other brand identity are not covered by that license.