Tailscale releases Tailcat for ephemeral WireGuard-encrypted tunnels without control plane

Tailcat extracts Tailscale’s data-plane components, magicsock for WireGuard-encrypted tunnels and DERP for NAT traversal, and packages them as a standalone Go library and CLI. The tool removes the dependency on Tailscale’s control plane, meaning no account sign-up, no coordination server, and no persistent device registry. Instead, connection metadata is exchanged manually via short-lived tokens, which encode the server’s WireGuard public key and DERP relay information.

For engineers, this lowers the barrier to encrypted tunnels: no root privileges are needed, routing tables remain untouched, and the tool runs entirely in userspace. The trade-off is operational overhead, tokens must be shared out-of-band, and there is no built-in discovery or revocation mechanism. Ephemeral keys (the default) simplify key rotation but require re-sharing tokens for each new session, while persistent keys reduce churn at the cost of long-term key management.

The tool’s design favors ad-hoc use cases: piping stdin/stdout between machines, exposing local ports, or even running an auth-free SSH server. NAT traversal is automatic, falling back to DERP relays if direct UDP connections fail. However, the lack of a control plane means no centralized logging, no access controls beyond WireGuard keys, and no integration with identity providers. Teams that need these features will still rely on full Tailscale deployments.

Tailcat’s open-source nature allows self-hosting of DERP relays, which can be critical for compliance or latency-sensitive applications. The default DERP map is rate-limited, so high-volume use may require running private relays. The tool’s SOCKS5 proxy support also enables routing arbitrary traffic through the tunnel, though browsers may mishandle case-sensitive tokens. Overall, Tailcat is a lightweight alternative for scenarios where Tailscale’s full feature set is unnecessary overhead.