Two machines need to exchange a file. One is behind carrier-grade NAT, the other is a temporary cloud VM. You could open a port, configure a VPN, or copy a public IP and hope the firewall cooperates. Each option adds setup that can outlive the task.
Tailscale's Tailcat takes a smaller approach: it gives you a netcat-style pipe over Tailscale's encrypted networking data plane, without asking either machine to join a managed tailnet or create a Tailscale account.
It is worth looking at now because a third-party daily GitHub Trending tracker placed Tailcat at position 10 on November 14, 2026, with 256 stars gained in that day's window. Tailscale also published a dedicated walkthrough on November 11. That is a current attention signal, not proof that Tailcat is a replacement for a VPN.
What Tailcat actually does
Tailcat is an open-source Go command-line tool and Go library. Its repository describes it as netcat over Tailscale's data plane, without Tailscale's control plane. The repository is BSD-3-Clause licensed; that permissive license does not remove the need to review external service terms or protect connection addresses.
That distinction matters. A normal Tailscale deployment combines two broad layers:
- The control plane handles device identity, network membership, policy and coordination.
- The data plane moves encrypted traffic between peers, using WireGuard, NAT traversal and DERP relays when a direct path is not possible.
Tailcat uses the second layer without requiring the first. It does not create a persistent VPN interface or rewrite the host's routing table. The connection stays in user space, which is useful on short-lived machines where installing a full network client is undesirable.
A simplified flow looks like this:
Machine A runs tailcat | | creates an ephemeral connection address v Machine B receives that address out of band | v WireGuard-encrypted stream | +---- DERP bootstrap/relay | +---- direct UDP path when the relay map and network allow it The README is careful about this detail: Tailcat bootstraps through DERP, and magicsock can try to upgrade to direct peer-to-peer UDP. The default public relay map is currently relay-only, so do not assume every default connection will become direct.
The address is a connection capability, not a public IP; the client supplies it to establish a temporary encrypted stream.
Try the smallest example
Tailcat publishes prebuilt binaries and packages. The official install guide documents Homebrew for macOS and Scoop for Windows:
# macOS brew install tailcat # Windows, with Scoop installed scoop install tailcat Linux users can download the static binaries or distribution packages from the official releases page. The project also documents Snap, containers, Nix and source builds in its installation guide.
Open two terminals on separate machines.
On machine A, start a server:
tailcat Tailcat prints an ephemeral address and waits for a client. Copy that address to machine B through a channel you trust.
On machine B, send a line through the tunnel:
echo "hello from machine B" | tailcat <address-from-machine-A> The server receives the bytes on standard input. This is the useful part of the netcat mental model: programs can be connected with pipes instead of building a custom HTTP endpoint or manually opening a port.
The example is deliberately small. For real work, read the README's service examples before using file transfer, port forwarding, SOCKS or SSH modes. The project has more than one way to expose a service, and each mode has different security implications.
Where it fits in a developer workflow
Tailcat is especially interesting for temporary infrastructure:
- CI debugging: connect to a short-lived runner without registering it in a permanent private network.
- Homelabs: move a file or inspect a service between machines when you do not want to change firewall rules.
- Remote development: create a temporary pipe between a workstation and a VPS.
- Agent sandboxes: let a disposable worker reach one explicitly shared service instead of giving it a broad network route.
- Quick transfers: use a stream for a one-time copy or command pipeline.
The use case is simple: secure communication without provisioning a network.
Security: treat the address like a capability
The convenience comes with a responsibility. The connection address is effectively a capability: anyone who obtains it may be able to attempt the connection while the server is listening.
Do not paste it into a public issue, a shared log, or a channel that includes people who should not have access. Use the project's peer-allowing and SSH authentication options when the service requires stronger identity checks. Be especially careful with unauthenticated SSH modes. A temporary address is not a substitute for a user account, an authorization policy or a hardened bastion.
Tailcat also does not provide the full device inventory, centralized ACL management, identity lifecycle or persistent network policy of a managed tailnet. If you need those controls, use a full mesh VPN rather than trying to stretch a one-off transport tool into one.
It remains pre-1.0; v0.7.0 was the latest tag reviewed (September 20, 2026). That release added UDP forwarding through exit-node servers, improved Windows local-port handling and fixed compatibility with older OpenSSH scp clients. The release notes are worth reading before depending on a particular mode.
Tailcat versus the alternatives
| Tool | Best fit | What you still manage |
|---|---|---|
netcat | Simple streams on an already reachable network | Reachability, encryption and access control |
| Magic Wormhole | One-off file transfer | A transfer workflow rather than general service access |
| Tailscale | Persistent private networking across devices | Tailnet identity, policy and device lifecycle |
| Tailcat | Temporary encrypted streams and forwarded services | Secure handling of the ephemeral address and service permissions |
Tailcat is a building block, not a persistent VPN or a public tunnel with a stable hostname.
What to watch next
The most useful signal is whether the project continues to improve the developer experience around ephemeral connections: better service modes, stable library APIs and clearer authorization patterns. Because it is pre-1.0, pin versions and test exact workflows before production.
For the launch discussion, see the Hacker News thread and the Tailscale community announcement.
The video above is Tailscale's own Tailcat walkthrough from November 11, 2026.
If you regularly connect temporary machines, try Tailcat with a harmless pipe first. What would you use it for: CI debugging, homelab transfers or short-lived agent environments?
Sources and further reading
AI disclosure: This article was prepared with AI assistance; technical claims and commands were checked against the linked primary sources.
