tl;dr: Tailcat is a netcat-like tool from Tailscale that uses Tailscale's data plane (WireGuard + magicsock + DERP relays) for encrypted point-to-point tunnels between machines, but without the Tailscale control plane—connection metadata is exchanged out-of-band via short tokens. It requires no Tailscale account or root access, runs entirely in userspace, and supports piping stdio, port forwarding, SOCKS proxying, auth-free SSH, and exit-node behavior. You can use Tailscale's free rate-limited DERP relays or bring your own, and tokens can even be published as DNS TXT records.