tailcat: netcat across NAT, without a tailnet

tailcat gives netcat a point-to-point encrypted path between two machines. One side prints a short connection address; the other side uses that address to stream bytes, expose a port, forward a local port, copy files, or open SSH. The project uses Tailscale's userspace networking pieces while skipping the Tailscale control plane, so a quick trial needs no tailnet account and leaves the host's routing table and DNS alone. 1

The timing is unusually strong for a small utility: #3 on GitHub Trending's Go list for this week, 6,206 stars in the current snapshot, and +3,940 stars in the weekly window. 23

Imagine a service listening on port 8080 on a colleague's laptop. Both laptops sit behind separate home or hotel networks, and neither laptop belongs to a shared tailnet. The colleague can publish only that port:

tailcat serve 8080

tailcat prints a short tc... address. The other laptop uses that address to map the remote port to a local one:

tailcat forward <tc-address> 18080:8080
curl http://127.0.0.1:18080/health

The local curl request reaches the service on the colleague's laptop. The forward command can also bind a chosen local address, expose more than one port, and print verbose connection logs. 1

The connection starts through a DERP relay so the two peers can find each other. tailcat then attempts UDP hole punching and moves traffic onto a direct peer-to-peer path when the networks allow it. DERP remains the fallback when a direct path fails. The tunnel uses WireGuard in userspace, and the application terminates TCP inside the process instead of changing the operating system's network configuration. 1

The same pattern works for a one-off file drop. The receiver runs:

tailcat recv ~/inbox

The sender copies a file to the printed address:

tailcat cp report.pdf <tc-address>:

The receiver's drop box is write-only: the sender cannot list, read, or overwrite existing files. The README also documents read-only file serving, SFTP-backed listing, SOCKS5 proxying, and SSH with either public-key authentication or the tunnel identity alone. 1

The quickest first test is the package manager already present on the machine:

Linux users can also install the amd64 Debian package from the v0.5.0 release:

curl -LO https://github.com/tailscale/tailcat/releases/download/v0.5.0/tailcat_0.5.0_linux_amd64.deb
sudo apt install ./tailcat_0.5.0_linux_amd64.deb

The same release provides Linux arm64 and armv7 packages, RPM files, and tarballs. The release page lists no macOS or Windows binary for v0.5.0, so macOS users should use Homebrew and Windows users should check the README's current installation routes before standardizing on a release artifact. 4

GitHub Trending puts tailcat at #3 in the weekly Go snapshot, with 3,940 stars gained during the displayed week. The repository page reports 6.2k stars in rounded form; the structured Trending snapshot supplies the more precise 6,206 count used here. The Trending page records the current weekly view, so these figures describe this observation rather than a historical first appearance. 23

The Hacker News launch thread was posted on August 26, 2026 at 09:42 in the channel's display timezone. The thread had 687 points and 134 comments when its native item record was retrieved. 5

The project also shipped v0.5.0 on September 2, 2026. That release fixed a security bug in tailcat recv, added the forward subcommand, stopped drop boxes from leaking file existence, added SECURITY.md, and hardened validation for arguments passed to SSH and SCP child processes. 4

The public discussion focused on boundaries that matter in daily use. One commenter asked whether Tailscale's public DERP relays are intended for people who never log in; the README answers that question with a free, rate-limited public DERP map and an option to run a private DERP server. 16

Another commenter pointed out that a Tailscale-specific tool creates a dependency on Tailscale's protocol, even when the code is open source. That concern is fair: tailcat is a focused transport utility, not a drop-in extension for every program that speaks ordinary netcat. 7

Treat the connection address as a password. A default address carries the server's public key, path-discovery key, DERP information, and a pre-shared key. Anyone who receives the address can attempt to connect. The README recommends the pre-shared-key mode and documents saved keys, client restrictions with --allow, and --full-address for a self-contained address. 1

Public DERP is best-effort infrastructure. The README describes the public relays as rate-limited and gives them no uptime or throughput SLA. That makes tailcat a good fit for a temporary connection, a small file, or a diagnostic session. A sustained transfer or a team-wide service deserves a private relay and a measured test on the intended networks. 1

File transfers are uncompressed. Compress a large archive before sending it if bandwidth matters. The file service confines paths through Go's os.Root, and the drop-box mode prevents senders from browsing the destination, but neither property replaces a backup or an access review. 1

The command line is still young. v0.5.0 is active and recently fixed security-sensitive behavior, while the README gives no API, CLI-flag, output, or wire-format stability promise. Pin the release in automation and keep a normal SSH or VPN path available while evaluating it. 14

Try tailcat when the problem is a short-lived link between two terminal users: reach a development server behind NAT, copy a build artifact, open an SSH session, or expose one local port for a collaborator. Install it with the package manager already on the machine, run the serve and forward commands above, and verify the path with tailcat ping --until-direct <tc-address>.

Wait when a workflow needs stable cross-team APIs, a guaranteed relay service, compressed bulk transfer, or a vendor-neutral protocol. Tailcat's current strength is narrower: it turns a two-machine connection into a short-lived CLI action with an encrypted fallback path.

The verdict is try. Tailcat has a strong current discovery signal, a small install surface, and enough commands to replace several awkward one-off workarounds. Start with a disposable port-forwarding test, keep the printed address private, and move to a managed network path when the connection becomes permanent.