Tailscale Shipped a Tool That Works Without Tailscale and the Thread Found the Catch
Tailcat drops Tailscale's control plane entirely, and 675 points of Hacker News noticed it still depends on Tailscale's DERP relays, which Tailscale discourages self-hosting.
The WJS Desk
Sep 1, 2026 · updated 2 hours ago · 5 min read
Tailscale published a tool that uses Tailscale's data plane without Tailscale's control plane. No accounts, no users, no admins, no tailnet. The repo description says it plainly: "like netcat, but over Tailscale's data plane, without Tailscale's control plane."
It went to 675 points and 130 comments on Hacker News. The reaction was mostly delight, and underneath it two objections worth taking seriously: it is not as control-plane-free as the framing suggests, and it is the fifth entrant into a field that already had four.
What it actually is
Tailcat is a Go package and CLI, BSD-3-Clause, currently at 5,026 stars. One side listens, the other connects, and bytes move both ways. What it removes is everything Tailscale normally sells around that: there are no IP addresses to assign, no account, no admin console, and no OS-level networking involvement at all.
The addressing is the neat part. Instead of an IP, you get a string built as tc plus base64 of CBOR containing a public key and DERP bootstrap information. That blob is the address. Hand it to the other side and they can reach you.
tc + base64(CBOR(public key + DERP bootstrap info))Underneath it is the WireGuard data plane and Tailscale's NAT traversal, attempting a direct UDP connection and falling back to a DERP relay when the network will not cooperate. The claim that stood out to us: "Your operating system is never involved at the TCP layer." No tun device, no root, no interface to configure.
Why now, and it is the agents
Tailscale says it started as a novelty and got serious when customers found uses for it. The use case Brad Fitzpatrick named is connecting sandboxed AI agents and ephemeral VMs without system configuration.
That is the whole thing. A tailnet assumes durable identity: machines that get enrolled, appear in a console, and stay. An agent sandbox that lives for ninety seconds is the opposite. Enrolling it is absurd, and by the time an admin sees it in a list it is gone. Something that needs no enrolment because the key is the address fits that shape exactly, and nothing else in Tailscale's product line does.
Fitzpatrick also posted a Minecraft mod using tailcat as its transport, explicitly labelled a demo and not intended for maintenance, which tells you how small the integration surface is.
The objection worth reading
Commenter 1vuio0pswjnm7 made the sharpest point in the thread. "Without the control plane" still means depending on Tailscale's DERP relays for bootstrap and fallback, and running your own is something Tailscale actively discourages.
We checked the source. The DERP server README says, verbatim:
In general, you should not need to or want to run this code. The overwhelming majority of Tailscale users (both individuals and companies) do not.
It goes on to list caveats for anyone who does: cross-tailnet features stop working with custom DERP servers, DERP nodes only see encrypted WireGuard packets so they are useless for network-level debugging, and the Tailscale control plane handles geo-steering that you lose.
All of that is honest and defensible advice. It is also the tension. The advertised win is not needing Tailscale's control plane, while the practical path still routes your bootstrap through Tailscale's infrastructure, and the documentation for the alternative opens by telling you not to.
Worth being precise about what you are removing. Tailcat removes the account, the admin console and the enrolment step. It does not remove the dependency. If your reason for wanting this is that you do not want to depend on a third party's servers, read the derper README before you get attached.
It is a crowded field and the thread said so immediately
Four separate commenters named prior art within the first dozen replies: iroh, dumbpipe, magic-wormhole, wush, and bitbang-cli. Iroh in particular is not a curiosity. It is Rust, Apache 2.0, has been going since 2022, and sits at 12,411 stars, more than twice tailcat's. Magic Wormhole, the oldest of them, has 22,897.
| Project | Language | Stars | Since |
|---|---|---|---|
| iroh | Rust | 12,411 | 2022 |
| tailcat | Go | 5,026 | 2024 |
| magic-wormhole | Python | 22,897 | 2015 |
| dumbpipe | Rust | 752 | 2023 |
Thomas Ptacek gave the framing that explains the enthusiasm despite the crowd:
This is smart. It's Magic Wormhole but for generalized connectivity, not just file transfer.
That is the honest positioning. Magic Wormhole solved code-phrase-to-file-transfer a decade ago and everyone who used it wondered why the same trick did not work for arbitrary sockets. Tailcat is that, built on a NAT traversal implementation that has been hardened by a commercial product for years. Being fifth is fine when the differentiator is which battle-tested stack you are standing on.
Commenter spockz asked the question that follows: if the transport is WireGuard and the control plane is new, how much Tailscale is this? The answer is the NAT traversal and the relay network, and those are the parts that are genuinely hard.
The bigger problem underneath
Two comments got at why any of this exists. pbohun: "we really wouldn't need it if we had 100% ipv6 (no cgnat), but this is the next best thing." And mrsssnake, more pointedly, that everything here should be possible with plain netcat and an IP stack, and that NAT holepunching, encryption, static IDs and permissions being reinvented by every P2P app is a symptom of what the internet lacks.
Every generation of developers rebuilds NAT traversal because the addressing layer never got fixed, and each rebuild is better engineered than the last.
They are right, and it is a fair description of a thirty-year detour. Carrier-grade NAT made end-to-end connectivity a service rather than a property of the network, and so it gets sold, relayed and reinvented. Tailcat is a good implementation of a workaround that should not need to exist.
Should you use it
If you are wiring up ephemeral compute, agent sandboxes or CI runners that need to talk to each other without enrolment, this is worth an afternoon. No root, no tun device, no console, and the address is a string you can pass as an environment variable. That is a genuinely small integration for a genuinely annoying problem.
If you are choosing a P2P substrate for a product, the comparison with iroh is real and tailcat does not automatically win it. Iroh is older, larger and has an ecosystem. Pick on which relay network and licence you want to live with, not on which blog post you read most recently.
And if your motivation is independence from third-party infrastructure, this is the wrong tool, and Tailscale's own documentation is the thing that tells you so. That is to their credit, and it is also the sentence most people will not read.
