# Tailcat

> BSD-3 WireGuard+DERP netcat without Tailscale control plane

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://tailcat.dev  
**GitHub:** https://github.com/tailscale/tailcat  
**Added:** 2026-09-07

---

## The Hook

Tailcat is netcat over Tailscale's data plane — WireGuard + magicsock + DERP — with no Tailscale account or control plane.

## What's Good

BSD-3-Clause. CLI and Go library. Userspace tunnels, SOCKS child mode, bring-your-own DERP. Out-of-band tokens instead of a tailnet.

## The Catch

CLI/API unstable — no stability promises. Public Tailscale DERP may be rate-limited or revoked; run your own derper for real bandwidth. Not Headscale control plane or full Tailscale VPN. Distinct from Headscale/Netbird.

## Verdict

BSD-3 WireGuard netcat without Tailscale Inc coordination. Bring your own DERP.