TSLink

Private addresses for your apps, on your Tailscale network.

Open them from your own devices. Share one with a person or a link, until a date you pick.

Docs and guides: tslink.md

English · 简体中文 · 日本語 · 한국어 · Español · More languages

tslink share 3000 --name notes       # a web app → https://notes.<your-tailnet>.ts.net
tslink share ./photos                # a folder or a single file
tslink add db --tcp localhost:5432   # any TCP port

Install

macOS hosts require macOS 13 Ventura or later (platform support).

brew install --cask anydoor7/tap/tslink

On Windows, install with Scoop:

scoop bucket add anydoor7 https://github.com/anydoor7/scoop-bucket
scoop install anydoor7/tslink

To upgrade, run brew upgrade --cask tslink or scoop update; scoop update tslink. If TSLink runs as a background service, run tslink install again afterwards.

Linux .deb and .rpm packages and Windows builds are on the latest release. The first time you share an app, TSLink prints a Tailscale sign-in link for it. Getting started

When you need TSLink

Serve is enough for one app on your own devices. TSLink puts app addresses, deadlines and access changes in one workflow.

Job	Tailscale alone	TSLink
One web app on your phone	tailscale serve 3000 is enough	tslink share 3000
Several apps, separate names	Services setup, or separate nodes	One share/add per app; enroll each node
One person, one app, seven days	Policy rules, then a JIT tool or manual removal	tslink people add alice@example.com --apps photos --for 7d (HTTP/files)
Browser link, three days	Public Funnel; add a gate and scheduled shutdown	tslink guest create photos --for 3d --public --print-link (HTTP only)

Private recipients need Tailscale. Guest links are public, forwardable bearer links.

Full comparison

Your apps, on your own devices

• An address for each app. Web apps, folders, single files and TCP ports each get their own name in your tailnet, so you use names instead of IP addresses.
• Private by default. Nothing is public until you create a guest link or publish through Funnel.
• One app, not the whole machine. Each app you publish gets its own node that forwards to that app only. Without the Tailscale app on the host, TSLink adds no other host ports to your tailnet.
• A home page that lists your apps with their health. Portal
• Health checks and alerts by command or webhook, and an access log that includes denied requests. Health and alerts · Access history
• Recipes for 15 self-hosted apps, including Home Assistant, Jellyfin, Immich and Ollama. tslink apps detect finds the ones already running. App recipes

Share when you want to

tslink people add alice@example.com --apps notes --for 7d   # a tailnet member, for 7 days
tslink guest create notes --for 3d --public --print-link    # a browser link, no Tailscale needed
tslink add launch --proxy localhost:4000 --funnel --public --funnel-ttl 1h   # anyone, for one hour

Guest links and new public URLs expire and work for web apps only; folders, files and TCP ports stay private. People · Guest links · Public access

For AI agents

A dev server an agent starts on localhost is out of reach from your phone. TSLink lets the agent give it a private address, report the exact URL and remove it when done.

For Claude Code, install the CLI first, then run:

/plugin marketplace add anydoor7/tslink
/plugin install tslink@tslink

The plugin includes a preview skill and the MCP connection below. The marketplace stays in this repository and fetches the plugin from anydoor7/tslink-claude-plugin. The canonical skill stays here; the plugin carries a CI-checked copy. Other agents can use the same skill or connect MCP directly. This integration requires the local CLI and does not run in claude.ai chat. Setup and enrollment

{"mcpServers":{"tslink":{"command":"tslink","args":["mcp"]}}}

• CLI or MCP. Management commands take --json and return versioned results; tslink mcp offers app and access operations over MCP.
• One file, not the folder. An agent can share just its HTML report with tslink share ./report.html; other files in that folder stay unreachable.
• Limited roles. viewer, app-operator or people-manager, scoped to the apps you name. tslink mcp-audit shows what an agent changed. Roles limit TSLink's tools, not the agent's own shell.

Agent quickstart · MCP scopes · Remote MCP

How it works

One background process runs a separate Tailscale node for each app. Tailscale provides the tailnet transport and HTTPS certificates. Private web and file access can be limited by Tailscale identity with --allow and people grants; raw TCP relies on your tailnet policy and the app's own login. Architecture

Requirements

Who	Needs
You	A Tailscale account with MagicDNS and HTTPS turned on
The machine running your apps	TSLink, which embeds Tailscale (on Linux, a systemd user session)
Your devices, and people you share with	The Tailscale app
Guests	A browser

Names of HTTPS apps appear in public certificate logs, so pick names you are happy for others to see.

Privacy Policy

This section covers the local TSLink CLI, MCP server and agent plugin. Its HTTPS policy URL is separate from the website privacy policy, which covers the website.

• Data and use. TSLink processes the app traffic you choose to proxy or serve, plus service configuration, Tailscale identities and access rules, to route requests and enforce access. Optional people, invitation, guest and access-request features store their associated records locally. Enabled access history records identities, timestamps, app names, methods, statuses, byte counts, durations and access decisions, plus coarse IP prefixes for unidentified tailnet callers, node names and tags, and MCP/guest audit receipts (including guest link IDs, not bearer tokens). The default path mode retains the first path segment with token-shaped segments redacted; full-path and no-path modes are configurable. Access history excludes query strings, request headers and bodies. Diagnostic logs are a separate surface and can contain sensitive details, including enrollment links.
• Local storage. Configuration, registry, runtime state, node keys and logs live in TSLink's configuration directory, normally ~/.config/tslink on macOS/Linux or %AppData%\tslink on Windows (platform details). TSLINK_CONFIG_DIR can override it. Optional administrative credentials use the system credential store; macOS/Linux have a conditional file fallback, while Windows has none. See credential storage.
• Third parties. Embedded Tailscale contacts the coordination service, uses encrypted peer or relay transport and obtains HTTPS certificates. Its SDK uploads diagnostic logs to Tailscale by default. HTTPS names appear in public certificate transparency logs. Administrative operations can send device, policy and invitation data to the Tailscale API. Custom coordination servers and configured alert webhooks or commands receive the data needed for those features. TSLink has no separate maintainer analytics collector. Your MCP client receives tool arguments and results, which may include identities, URLs and requested logs; the client's model provider and retention policy also apply. Publishing through Funnel or guest links exposes the selected app through public infrastructure.
• Retention and deletion. Local access history defaults to 30 UTC calendar days including today and a 64 MiB data cap, configurable or disableable; oldest segments are evicted while the daemon runs. The mutation journal is separately bounded to 1,024 entries or 1 MiB. The daemon's stderr log (tslink.err.log) rotates at 8 MiB and keeps one previous file when TSLink can confirm the descriptor is append-only. tslink.out.log and supervisor-managed copies have no TSLink retention limit; supervisor policies may differ. Configuration and node state persist until removed. tslink remove <name> removes a service and performs ownership-safe cleanup; it does not erase historical logs. tslink logout clears credentials and node authentication state, not all configuration or logs. See access history and access-request retention. Third-party retention is governed by those providers, including Tailscale.
• Contact. Use the issue tracker for non-sensitive privacy questions. Never post credentials, private links, logs or personal data in public issues. For sensitive security reports, follow SECURITY.md.

More

All docs · CLI reference · Compared with Serve, ngrok and Cloudflare · Contributing · Security

Apache 2.0. TSLink is an independent project, not made or endorsed by Tailscale.