August 26, the repository tailscale/tailcat gathered more than five hundred votes on Hacker News in a day, and this is that rare case when a one-line project description is exhaustive: “like netcat, only on top of Tailscale’s data plane and without its control plane.” The company took its own open components — WireGuard in user space, magicsock for NAT traversal, the netstack network stack from gVisor and DERP relays — and built from them a single binary that does not require an account, root privileges, or a continuously up network. In the README it’s phrased even more succinctly: “Tailscale without Tailscale, from Tailscale.”
The reason to take a careful look at the tool is utterly mundane. A person (or a CI job, or an AI agent in a sandbox) needs half an hour to access a machine that sits at home behind NAT. Next come three ways to do it, and what each one costs.
Comparison by tailcat README and Tailscale documentation, August 2026
Method 1. Reverse tunnel via your own VPS
ssh -R 2222:localhost:22 user@vps -N
Classic setup with no external dependencies. The price is the surrounding infrastructure: you need a VPS, in its sshd_config — GatewayPorts yes, keys, a systemd unit to restart the tunnel after a drop, and a firewall rule on 2222. The entry point sits on a public address permanently, and removing access means editing keys and config. There is a separate discussion on the forum about when you can’t do without it: Gray IP and CGNAT: five routes to a home server.
Method 2. Set up a full tailnet
tailscale up --ssh
The correct answer when access is needed for a long time and not just for one person: devices, access policies, logs, revoking rights from the admin panel. But the requirements are also correspondingly strict — an account with the vendor or your own Headscale, a machine that’s always online, and a well-thought-out ACL. For half an hour, this is overkill.
Method 3. A token that dies with the process
# on the home machine
tailcat --serve=no-auth-ssh
# prints an address like tcXXXXXXXX…
# on the other side
tailcat ssh tcXXXXXXXX
That’s it. The token is about 50 bytes if it contains a numeric region identifier. It is installed via go install github.com/tailscale/tailcat/cmd/tailcat@latest or nix run github:tailscale/tailcat, BSD-3-Clause license. Connection is as direct as possible, point-to-point; if NAT traversal fails, traffic goes through a DERP relay. Close the terminal — no more access, nothing to revoke.
--serve=no-auth-ssh — this is literally SSH without authentication: all protection boils down to the token being known by only two people. The official project page states this directly — treat the address like a password, do not log, do not commit, and do not forward to those who shouldn’t have access. The circle of clients narrows with the node key:
tailcat --serve=22 --allow=nodekey:cfb6bf…ddfd16
What else fits into a single binary
--serve=8080,8443(or--serve=all) — port forwarding of TCP ports, on the clienttailcat <token> 8080;tailcat socks <token>— SOCKS5 over the same tunnel; alternatives without Tailscale were discussed in the topic Socks5 on a bare server;--serve=exit-node— exit to the internet via a remote machine;tailcat genkeywith flags--region=nyc,--fixed-region,--client— a stable key instead of the ephemeral--key=new, so the address doesn’t change from run to run;- publishing the token in DNS:
my-server.example.com. 300 IN TXT "tailcat=tcXXXXXXXXX"— the name works everywhere the command line accepts the token; - your own relay instead of the public one:
tailcat genkey --region=derp.example.com.
Three limitations the authors mention themselves. Interface stability is not promised — neither the CLI nor the exchange format, so hardening tailcat in scripts for years is premature. Public relays have no SLA. And the main point: a hosted relay “keeps metadata logs and isn’t intended for privacy” — metadata of connections are logged, privacy not claimed. If you need a private scenario — run your own DERP.
What this is not: a replacement for Tailscale. There’s no device management, no policies, no admin console or auditing — deliberately. A persistent multi-user network is still built with Tailnet or Headscale, and tailcat solves a narrow task: “let this person in here, right now.”
Sources
- github.com/tailscale/tailcat — repository, README, flags and license
- tailscale.com/tailcat — official project page, scenarios and notes about relays
Are you currently granting one-time access to your home machine — via reverse tunnel to your VPS, tailnet, Cloudflare Tunnel, or something else? And are you willing to allow SSH at home where all authentication is just knowing one line?