TSLink

v0.3.1 · Released Oct 27, 2026

Your agent's dev server. On your phone.

TSLink by anydoor7 is an open-source CLI that gives each local app or dev server its own private HTTPS address on your Tailscale network. Your coding agent can share it, hand you the exact URL and remove it when you're done.

Your phone needs the Tailscale app, signed in to the same tailnet. Independent project, not made or endorsed by Tailscale.

Homebrew Linux Windows Source

Homebrew · macOS / Linux

brew install --cask anydoor7/tap/tslink

Installs the current tap release on macOS or Linux.

Installation guide

See how it works

One private name per dev server

Your coding agent

Shares each server over MCP

Front end Port 5173

web.<tailnet>.ts.net

API server Port 8000

api.<tailnet>.ts.net

Your phone

Tailscale app, same tailnet

Example names. If a name is taken, TSLink adds a number, so use the URL it returns.

For coding agents

Your agent starts it. You open it on your phone.

Your coding agent shares the running dev server over MCP or the Claude Code plugin, hands you the exact private URL and removes it when you're done. Each app gets its own private ts.net name.

Your phone needs the Tailscale app, signed in to the same tailnet.

Set up your agent

Agent UI from your phone

• Finish gateway enrollment if prompted New installations default to the home gateway; existing installations keep their mode. A needs_login result is a successful handoff: open its login URL and complete Tailscale approval, then ask for the exact URL with --wait. App-node enrollment proceeds independently.
• Who can open it New gateway apps allow the owner/admins and explicitly granted people. MCP add/share allow and CLI add --allow keep permanent defaults; invite device also keeps its permanent default. People grants default to 24h. Scoped MCP limits still apply. Gateway and direct entry paths use the same person/app keys, with documented exceptions for gateway-only security checks. Names appear in public certificate logs.
• Clean up when you are done The agent calls unshare with the name that share returned, or you run tslink remove with that returned name. The name is web only if share returned web. Removal unregisters the share and stops serving it; TSLink only tries to clean up the remote node when it can verify ownership, so deletion is not guaranteed. Your dev server keeps running.

MCP configuration for local clients that use mcpServers JSON

{"mcpServers":{"tslink":{"command":"tslink","args":["mcp"]}}}

Other clients use a different format; the setup guide covers each one.

Ask your agent: share the dev server so I can open it on my phone

Safari on an iPhone showing a Vite page that reads Updated by your agent, opened over a private ts.net address

The phone after the agent saved a change. Cropped from a real iPhone 15 Pro capture.Tested on 2026-10-22 with Vite 8.3.5 and an iPhone 15 Pro: the agent shared the dev server over MCP, the phone opened the private URL, and the page updated on save without a manual refresh.Your app's own Host and Origin rules can still block requests. Vite needed no allowedHosts change through TSLink in our test; Next.js was not tested and still needs allowedDevOrigins.

How it works

From your agent's dev server to your phone.

Start with a running dev server or app and a Tailscale account with MagicDNS and HTTPS enabled. Your phone needs the Tailscale app, signed in to the same tailnet.

1. Give the dev server a name

   This example uses a dev server on port 5173. Your agent can run the same steps over MCP. TSLink starts its background gateway as needed.

2. Enroll the home gateway

   New installations default to the home gateway; existing installations keep their mode. Open the printed Tailscale login URL if prompted. App-node enrollment runs independently and does not hold up a ready gateway route.

3. Open the returned address

   Run the second command to get the live URL, then open it on your phone. Keep your app’s own login enabled.

Share an app

tslink share 5173 --name web
tslink url web --wait

https://web.<tailnet>.ts.net

Example URL after enrollment. Always use the exact URL returned by TSLink.

Follow the quick start

Choose how they visit

Three ways to reach an app.

Your own devices

Open web apps, folders, single files and TCP ports through their own private addresses.

New gateway apps allow the owner/admins and explicitly granted people. Existing installations keep their configured access rules.

Make a private share

Named people

Grant access in one action: TSLink checks membership, preserves existing permissions, prepares routes and completes needed invitations.

People checks cover HTTP and files. Raw TCP and open public Funnel are not person-scoped.

Share with a person

Browser guest

Send a browser-only link to one HTTP proxy app, with an expiry and an optional PIN.

Requires public Funnel. Guest links are forwardable bearer links; a link or PIN does not prove identity.

Create a guest link

Private visits need Tailscale, sign-in and network permission on the viewer’s device; outside your tailnet, an app-node invite may also be needed. Get Tailscale

For the apps you keep running

A little less to look after.

One home for your apps

A private portal lists the apps each visitor can open, with their health.

Know how they are doing

Health checks and alerts, with bounded local access history that includes denied requests.

CLI + MCP for your agent

An owner agent can publish its app, return the URL and remove the share. Reduced roles work within assigned apps and durations.

More about apps and agent permissions

TSLink does not install apps or replace their authentication. Recipes help with proxy settings. MCP offers viewer, app-operator, people-manager and owner roles; local owner is the default. Owner sessions expose 48 tools; live tools/list is authoritative. needs_login requires a person to finish enrollment. Scopes do not sandbox shell or filesystem access.

App configuration guides

Agent UI on your phone Share a report until a date Share one running app

A few useful answers

A few things to know.

Read the full FAQ

Is TSLink free?

Yes. TSLink is open source under Apache-2.0 and free for commercial use. Tailscale plans and terms apply separately.

Signed and notarized macOS build Checksums and attestations

When is TSLink useful alongside Tailscale?

Serve is enough for one app you start yourself on your own devices, and Services gives stable service names. TSLink differs in structure: each app gets its own node and ts.net name instead of a port or path under one device name, and its MCP server and versioned CLI output return the exact URL and remove it when done. That suits the several dev servers a coding agent starts. People deadlines, guest links and a private portal sit on top.

Compare the options

What does a separate app address mean?

With no separate host Tailscale connection, each embedded app node exposes its configured target without adding other host ports. This is a network entry point, not process isolation. The app may still expose powerful functions. TSLink manages one host; Tailscale supplies transport and HTTPS.

How app nodes work

What happens when I revoke access?

Named access is blocked on the next request; accepted private streams may continue. Guest revocation also cancels tracked guest streams. Downloaded data cannot be recalled, and removing a share does not stop the underlying app.

Access and revocation guide

Start small

Start with one private address.

Install TSLink. Open an app on your own devices. Share when you want to.

Useful? Star TSLink to find it again. For release notifications, Watch → Custom → Releases.

Install TSLink