TSLink
Gives each Tailscale-network app its own private address with expiry-based sharing for people, browser guests and AI agents (CLI/MCP). Submitted by the TSLink maintainer (anydoor7); this is my own project, not a third-party suggestion.
Documentation
v0.2.0 · Released Oct 14, 2026
Private app addresses. On your Tailscale network.
Open your computer’s apps on your phone, over your Tailscale network.
Homebrew · macOS / Linux
brew install --cask anydoor7/tap/tslink
Installs the current tap release on macOS or Linux.
One private address per app
Photo app Port 3000
photos.<tailnet>.ts.net
Media app Port 8090
media.<tailnet>.ts.net
Home dashboard Port 8123
home.<tailnet>.ts.net
Your devices
Phone, tablet and laptop
Example addresses. After enrollment, use the exact URL returned by TSLink.
How it works
From localhost to your phone.
Start with a running app and a Tailscale account with MagicDNS and HTTPS enabled.
-
Give the app a name
This example uses a photo app on port 3000. TSLink starts its background gateway as needed. -
Finish the first enrollment
Open the printed authorization URL and finish approval. If a different name is returned, use it in the next command. -
Open the returned address
Run the second command to get the live URL, then open it on your phone. Keep your app’s own login enabled.
Share an app
tslink share 3000 --name photos
tslink url photos --wait
https://photos.<tailnet>.ts.net
Example URL after enrollment. Always use the exact URL returned by TSLink.
Choose how they visit
Three ways to reach an app.
Your own devices
Open web apps, folders, single files and TCP ports through their own private addresses.
Plain share adds no per-person check. Other callers allowed by your network policy can also connect.
Named people
Grant a Tailscale login access to selected HTTP or file apps, until a deadline you choose.
People checks cover HTTP and files. Raw TCP and open public Funnel are not person-scoped.
Browser guest
Send a browser-only link to one HTTP proxy app, with an expiry and an optional PIN.
Requires public Funnel. Guest links are forwardable bearer links; a link or PIN does not prove identity.
Private visits need Tailscale, sign-in and network permission on the viewer’s device; outside your tailnet, an app-node invite may also be needed. Get Tailscale
For the apps you keep running
A little less to look after.
One home for your apps
A private portal lists the apps each visitor can open, with their health.
Know how they are doing
Health checks and alerts, with bounded local access history that includes denied requests.
CLI + MCP for your agent
An owner agent can publish its app, return the URL and remove the share. Reduced roles work within assigned apps and durations.
More about apps and agent permissions
TSLink does not install apps or replace their authentication. Recipes help with proxy settings. MCP offers viewer, app-operator, people-manager and owner roles; local owner is the default. Owner sessions expose 48 tools; live tools/list is authoritative. needs_login requires a person to finish enrollment. Scopes do not sandbox shell or filesystem access.
Agent UI on your phone Share a report until a date Share one running app
A few useful answers
A few things to know.
Is TSLink free?
Yes. TSLink is open source under Apache-2.0 and free for commercial use. Tailscale plans and terms apply separately.
Signed and notarized macOS build Checksums and attestations
When is TSLink useful alongside Tailscale?
Serve is enough for one web app on your own devices. Services already provides service names. TSLink brings per-app nodes, people deadlines, guest links and a private portal into one CLI/MCP workflow on a single host.
What does a separate app address mean?
With no separate host Tailscale connection, each embedded app node exposes its configured target without adding other host ports. This is a network entry point, not process isolation. The app may still expose powerful functions. TSLink manages one host; Tailscale supplies transport and HTTPS.
What happens when I revoke access?
Named access is blocked on the next request; accepted private streams may continue. Guest revocation also cancels tracked guest streams. Downloaded data cannot be recalled, and removing a share does not stop the underlying app.
Start small
Start with one private address.
Install TSLink. Open an app on your own devices. Share when you want to.
Useful? Star TSLink to find it again. For release notifications, Watch → Custom → Releases.