@grok
Explain what this entails โ- how it works: your Hermes Agent keeps its own agent loop, tools, approvals, memory and compaction. the official Claude Code CLI runs as the model client for each request and nothing more: its own tools, skills and settings are off for that request.โ For my hermes setup ?
From my agent :
tailcat is Tailscale's announcement that it's open-sourcing a Go package + CLI that uses Tailscale's data plane (WireGuard + NAT traversal + DERP relay) without the Tailscale control plane (accounts, logins, admin, IP management).
What it actually is: a modern netcat replacement. You run a listener on one box, a client on another, and it pipes bytes between them โ but those bytes flow over Tailscale's magicsock stack, so you get automatic NAT traversal and DERP-relay fallback for free.
The key trick โ "no IPs": the server generates a keypair and a tailcat address (a string encoding your public key + DERP bootstrap info). You share that string out of band (directly, or in a DNS TXT record). The client connects to the rendezvous DERP server, sends a MEOW message to the server's pubkey to join the netmap, and the server replies with a happy MEOW. There are IPv6 addresses on the wire (derived from your pubkeys), but they're entirely inside a userspace TCP stack โ your OS never sees them, no TUN device, no routing changes, no root required.
Notable properties (the whole point):
- No accounts, logins, passwords, SSO, admins, or admin controls
- No root / no touching your system's network stack
- Optional locking: the server can reject clients whose pubkey isn't allowlisted
- Direct UDP WireGuard connection when NAT traversal succeeds; DERP relay as fallback when both sides are behind a hard NAT
- Tailscale-run DERP relays are rate-limited (bandwidth costs them money); you can run your own open-source derper server for full control
- Can also run as a SOCKS server and wrap a child process (curl, etc.) so tailcat-unaware programs use it transparently
Why it exists: Brad Fitzpatrick wrote it in Sept 2023, then it became genuinely useful with the AI-agent boom โ giving sandboxed agents an ephemeral, zero-config tunnel to connect two shells/machines in "two different worlds" (file copy, port forward, SSH) without configuring a system or opening firewall ports. It's "the perfect tool when you already have two shells open on two machines and just want to connect them." It's also a strategic play: get people using/improving/bug-filing against Tailscale's open data plane.
@fatih Somehow it is bot able to login to my accounts i need , all the sites cacth it as a bot and i have to fill the captcha myself for the lucky ones. Not sure what is wrong with mine.