# Tried `tailscale/tailcat`: A Small Tool with Big Private-Network Potential

> Source: <https://dev.to/james_lin/tried-tailscaletailcat-a-small-tool-with-big-private-network-potential-1mja>
> Published: 2026-08-29 19:41:09+00:00

`tailscale/tailcat`

: A Small Tool with Big Private-Network Potential
`tailscale/tailcat`

is essentially `netcat`

over Tailscale’s data plane—without depending on Tailscale’s control plane. That makes it interesting for teams building private AI infrastructure: you can move TCP traffic between trusted nodes without exposing an inference gateway publicly or introducing another VPN control dependency.

The project is currently seeing strong momentum, with **+790 GitHub stars today**. The appeal is easy to understand: it is small, composable, and fits the way infrastructure engineers already think about `nc`

, port forwarding, and service probes.

A practical architecture is to keep the AI gateway on a private Docker network, then expose only the required listener through Tailcat:

```
# docker-compose.yml
services:
  ai-gateway:
    image: your-openai-compatible-gateway:latest
    environment:
      OPENAI_BASE_URL: https://b-lost.com/v1
      OPENAI_API_KEY: ${BLOST_API_KEY}
      DEFAULT_MODEL: claude-fable-5
      REQUEST_LOGGING: "false"
    ports:
      - "127.0.0.1:8080:8080"
```

From a trusted build runner or developer workstation, the gateway can then be reached over the Tailcat transport according to the repository’s listener/connect syntax:

```
curl http://private-gateway.internal:8080/v1/chat/completions \
  -H "Authorization: Bearer $TEAM_GATEWAY_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-fable-5",
    "messages": [{"role":"user","content":"Review this deployment plan."}]
  }'
```

For enterprise use, I would place quota enforcement, key rotation, and model allowlists in the gateway—not in Tailcat. Tailcat should stay focused on private transport. Keep local access logs disabled or redacted, and avoid sending sensitive payloads through unnecessary observability layers.

If using B-Lost as the upstream relay, its OpenAI-compatible base URL is `https://b-lost.com/v1`

. Native Anthropic `/v1/messages`

prompt caching can also reduce repeated-context costs, with cache hits discounted by 90%. That combination—private routing plus caching—helps keep both latency and token spend predictable without weakening team-level governance.