Tailcat is Tailscale's open source tool that gives you encrypted point-to-point connections between machines without needing a Tailscale account or control plane. It strips away the account management layer and uses only the data plane—specifically the WireGuard encryption and NAT traversal components (magicsock and DERP relays). You run a server that outputs a short address, share that address however you want (email, Slack, carrier pigeon), and the client connects using it. All traffic stays encrypted end-to-end, and the tool tries to establish direct peer-to-peer connections when possible, falling back to relay servers if NAT traversal fails. The CLI works like netcat on steroids. You can pipe data through it, forward TCP ports, run an SSH server with key authentication from GitHub or local files, serve files via SFTP, or set up a drop box for receiving files. There's also an exit-node mode that lets you forward connections through a remote server to reach other machines on its network. The tool runs entirely in userspace—no root access needed, no routing table modifications, no DNS hijacking. It's available as static binaries, packages for Linux/macOS/Windows, Homebrew, Scoop, container images, and Nix, plus there's a WebAssembly version you can run in a browser. The free tier uses Tailscale's public DERP relays with rate limiting, or you can run your own. The security model is straightforward: the address itself is the credential, so treat it like a password. The no-auth SSH mode is particularly dangerous—anyone with the address gets shell access as the running user, so never publish it publicly. For actual deployments where you want DNS names and proper access control, you'd layer in SSH key authentication or use the allow flag at the tunnel level.