Tailscale without Tailscale: tailcat open-sources peer-to-peer connectivity with no accounts and no admins
tailcat is an open-source Go package and CLI that offers Tailscale's encryption and NAT traversal without the control plane. No accounts, no logins, no IPs; generate keys, share an address, connect.
On day four of its launch week, Tailscale, networking's most liked company, announced something it describes as odd but sweet: "Tailscale without Tailscale, by Tailscale." tailcat is an open-source Go package and CLI tool that lets you use the company's encryption and NAT traversal without ever touching its control plane. There are no accounts to manage, no logins, no admin panel and no IP addresses.
The way it works is disarmingly simple: server and client each generate a keypair and meet through a DERP relay server. The server produces a shareable address string containing its public key and relay info; clients establish the connection by exchanging "MEOW" messages (that is where the cat comes in). From there it is WireGuard encryption with automatic NAT traversal: direct UDP when possible, DERP relay when not. The whole thing runs in userspace and never touches OS configuration; the DERP server code is open too, so anyone can host their own relay.
The tool's creator is Brad Fitzpatrick, one of networking's legendary names. He lists quick file transfers, port forwarding and machine-to-machine connectivity as everyday uses, and the sharpest scenario fits the moment: giving connectivity to untrusted or ephemeral environments, like sandboxed AI agents, without touching the system.
The post collected over 66,000 views and close to 800 bookmarks within hours. The reason is plain: in an era when everyone is walling their product into a garden, Tailscale handed the core of its business to open source, no accounts attached. The open-source wave we tracked this week (Kimi, LingBot, KATIR) just gained a link at the network layer.
