--- title: Tailcat: An open-source CLI for Tailscale’s WireGuard®,... description: Tailscale released tailcat, an open-source CLI and Go package that exposes just the data-plane pieces of Tailscale (WireGuard encryption, NAT traversal, and... canonical: https://daily.dev/posts/tailcat-an-open-source-cli-for-tailscale-s-wireguard-nat-traversal-and-derp-vuljfp5ww twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP | daily.dev og:description: Tailscale released tailcat, an open-source CLI and Go package that exposes just the data-plane pieces of Tailscale (WireGuard encryption, NAT traversal, and... og:url: https://daily.dev/posts/tailcat-an-open-source-cli-for-tailscale-s-wireguard-nat-traversal-and-derp-vuljfp5ww og:image: https://api.daily.dev/og/posts/vUljFP5Ww.png og:image:alt: Tailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP og:image:width: 1200 og:image:height: 630 og:locale: en --- [Tailscale](https://daily.dev/sources/tailscale) [Read post](https://api.daily.dev/r/vUljFP5Ww) # [Tailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP](https://api.daily.dev/r/vUljFP5Ww "Go to post") Tailscale released tailcat, an open-source CLI and Go package that exposes just the data-plane pieces of Tailscale (WireGuard encryption, NAT traversal, and DERP relay fallback) without requiring the Tailscale control plane, accounts, or admin OS access. It works like netcat over Tailscale's magicsock: a server generates a keypair and a shareable tailcat address encoding a public key and DERP bootstrap info, and a client connects via that address to establish a direct or DERP-relayed connection. Written originally by Brad Fitzpatrick in 2023 as a personal tool, it has since been used internally for ad hoc connections between sandboxed AI agents, ephemeral VMs, and exotic hardware setups, and is now open sourced for broader use, with Tailscale offering to run custom DERP relay fleets for paying customers. [#golang](/tags/golang "Check all #golang posts")[#networking](/tags/networking "Check all #networking posts")[#tailscale](/tags/tailscale "Check all #tailscale posts") Aug 31 • 8m read time • From [tailscale.com](https://api.daily.dev/r/vUljFP5Ww "tailscale.com") [](https://api.daily.dev/r/vUljFP5Ww "Go to post") Table of contents [What does “Tailscale” even mean?](https://api.daily.dev/r/vUljFP5Ww "What does “Tailscale” even mean?")[ How it works](https://api.daily.dev/r/vUljFP5Ww "How it works")[ Why?](https://api.daily.dev/r/vUljFP5Ww "Why?") Questions this post answers What is tailcat and how does it differ from using Tailscale normally? Tailcat is an open-source Go package and CLI released by Tailscale that lets two machines connect over Tailscale's WireGuard, NAT traversal, and DERP relay data plane without needing the Tailscale control plane, accounts, logins, or admin OS access. It works like netcat: a server generates a keypair and shareable address, and a client connects to establish a direct or DERP-relayed TCP connection with no IP addresses or root access required. Developers weighing lightweight peer-to-peer networking options can track tool releases like tailcat on daily.dev. How does a tailcat client connect to a tailcat server without a control plane? The client picks a key, connects to the rendezvous DERP server specified in the tailcat address string, and sends a MEOW message to the server's public key over DERP to add itself to the netmap; the server replies with a MEOW reply if it accepts the client's public key. The connection then uses NAT traversal to attempt a direct WireGuard UDP link, falling back to DERP relay if both sides are behind hard NATs. Engineers debugging NAT traversal and relay fallback setups can follow tooling deep dives like this on daily.dev. Why did Tailscale build and open source tailcat instead of just using Tailscale directly? Tailscale's Brad Fitzpatrick originally wrote tailcat in September 2023 as a personal tool for quickly connecting two untrusted or ephemeral machines without touching their network configuration, later using it to let sandboxed AI agents wire up nested VMs, control EC2 instances, and debug Hyper-V VMs. It was open sourced because customers found real use cases for it and Tailscale wants more usage and bug reports against its underlying data plane. Teams evaluating minimal, control-plane-free networking tools for agentic or ephemeral workloads can find releases like this on daily.dev. Comment Bookmark Copy Share your thoughts Post Share this post [](https://daily.dev/sources/tailscale) [Tailscale](https://daily.dev/sources/tailscale "https://daily.dev/sources/tailscale") Tailscale is a platform providing secure networking solutions for teams and businesses. Readers can ... Read more 118 Followers • 793 Upvotes #### Would you recommend this post? Copy link Slack WhatsApp Facebook X New Squad Copy linkShare with your friends ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP","url":"https://daily.dev/posts/tailcat-an-open-source-cli-for-tailscale-s-wireguard-nat-traversal-and-derp-vuljfp5ww","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tailcat-an-open-source-cli-for-tailscale-s-wireguard-nat-traversal-and-derp-vuljfp5ww"},"datePublished":"2026-08-31T14:01:48.451Z","dateModified":"2026-08-31T14:02:16.010Z","description":"Tailscale released tailcat, an open-source CLI and Go package that exposes just the data-plane pieces of Tailscale (WireGuard encryption, NAT traversal, and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/afe424f1073a5d1bff66f5ca8e0f7a27?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/afe424f1073a5d1bff66f5ca8e0f7a27?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tailscale","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tailscale","logo":"https://media.daily.dev/image/upload/s--QeDb_zoC--/f_auto/v1711188591/logos/tailscale","url":"https://daily.dev/sources/tailscale"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tailcat-an-open-source-cli-for-tailscale-s-wireguard-nat-traversal-and-derp-vuljfp5ww","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"golang,networking,tailscale","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tailscale","item":"https://daily.dev/sources/tailscale"},{"@type":"ListItem","position":3,"name":"Tailcat: An open-source CLI for Tailscale’s WireGuard®, NAT traversal, and DERP"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/tailcat-an-open-source-cli-for-tailscale-s-wireguard-nat-traversal-and-derp-vuljfp5ww#faq","mainEntity":[{"@type":"Question","name":"What is tailcat and how does it differ from using Tailscale normally?","acceptedAnswer":{"@type":"Answer","text":"Tailcat is an open-source Go package and CLI released by Tailscale that lets two machines connect over Tailscale's WireGuard, NAT traversal, and DERP relay data plane without needing the Tailscale control plane, accounts, logins, or admin OS access. It works like netcat: a server generates a keypair and shareable address, and a client connects to establish a direct or DERP-relayed TCP connection with no IP addresses or root access required. Developers weighing lightweight peer-to-peer networking options can track tool releases like tailcat on daily.dev."}},{"@type":"Question","name":"How does a tailcat client connect to a tailcat server without a control plane?","acceptedAnswer":{"@type":"Answer","text":"The client picks a key, connects to the rendezvous DERP server specified in the tailcat address string, and sends a MEOW message to the server's public key over DERP to add itself to the netmap; the server replies with a MEOW reply if it accepts the client's public key. The connection then uses NAT traversal to attempt a direct WireGuard UDP link, falling back to DERP relay if both sides are behind hard NATs. Engineers debugging NAT traversal and relay fallback setups can follow tooling deep dives like this on daily.dev."}},{"@type":"Question","name":"Why did Tailscale build and open source tailcat instead of just using Tailscale directly?","acceptedAnswer":{"@type":"Answer","text":"Tailscale's Brad Fitzpatrick originally wrote tailcat in September 2023 as a personal tool for quickly connecting two untrusted or ephemeral machines without touching their network configuration, later using it to let sandboxed AI agents wire up nested VMs, control EC2 instances, and debug Hyper-V VMs. It was open sourced because customers found real use cases for it and Tailscale wants more usage and bug reports against its underlying data plane. Teams evaluating minimal, control-plane-free networking tools for agentic or ephemeral workloads can find releases like this on daily.dev."}}]} ```