Tailscale Open Source Tailcat: No Login, No IP, Direct Peer-to-Peer Tunnel Between Two Machines

Dynam.AI Beat News: Tailscale has open-sourced Tailcat. Two machines can connect without registering accounts or joining the same Tailnet - just exchange an address to link up directly. It continues to leverage Tailscale's WireGuard encryption, NAT traversal, and DERP relay, but without requiring a Tailscale account or control plane.

When one machine runs Tailcat, it generates a connection address. Share this address with another machine to transfer files, forward ports, or SSH. The connection first goes through DERP to locate the peer, then attempts to establish a point-to-point UDP connection; if hole punching fails, traffic falls back to DERP relay. The entire process takes place in user space without modifying system routes or DNS.

Tailscale's Chief Engineer, Brad Fitzpatrick, originally prototyped Tailcat back in 2023 but later shelved it. Recently, with AI Agents making numerous connections to sandboxes, remote VMs, and test machines, he resurrected the project. He used Tailcat to enable Agents to temporarily link to Raspberry Pis, EC2 instances, and Windows hosts without preconfiguring accounts or networks for the Agents.

Tailcat is not a full replacement for Tailscale. It lacks user identities, permission policies, and device management; the connection address itself must be securely stored like a password. Tailscale's hosted Tailcat DERP relay logs metadata, imposes throttling, lacks an online SLA; for greater stability or privacy, self-hosted DERP deployment is an option.