01
Bounded by default
The default surface exposes seven typed, read-only operations. Conversation text cannot become arbitrary shell text in Bounded mode.
Private infrastructure access for AI
Give AI access.
Keep it bounded.
TetherBound connects AI assistants to the systems you already run while keeping the delegated boundary explicit. Use typed, read-only tools by default—or deliberately grant time-bounded Operator access to a selected machine account.
Built on TailscaleOpen-source + self-hostedLocal policy stays authoritativeLinux path working
Built on Tailscale
Your private network stays your private network.
TetherBound uses Tailscale for private connectivity and machine identity, then adds the AI-specific control layer: host admission, access modes, hard bounds, and audit metadata.
TetherBound is an independent project and is not affiliated with or endorsed by Tailscale Inc.
AI client
ChatGPT / Codex
Uses MCP to inspect or operate infrastructure within the boundary you deliberately delegate.
→
AI control boundary
TetherBound
Resolves identity, admits hosts, selects Bounded or Operator access, limits execution and output, and records audit metadata.
→
Private network + machines
Tailscale → your infrastructure
LinuxWorking
WindowsPlanned
macOSPlanned
Why TetherBound
You choose the boundary.
The safe unit of delegation is not always one command. TetherBound lets you choose between narrow typed capabilities and broad access to a deliberately selected host/account.
02
Operator when you want it
Operator mode is a local opt-in that grants arbitrary shell execution only on admitted hosts, as the configured OS account, under a time-bounded lease.
03
Private by design
Tailscale policy and TetherBound host admission both remain in the path. The current ChatGPT connection uses an outbound Secure MCP Tunnel rather than a new public management port.
Useful from the start
Ask questions about real machines—or delegate the whole task.
Bounded mode is optimized for inspection. Experimental Operator mode is for users who explicitly want the AI to work freely inside a selected non-root account.
Fleet visibility
List only explicitly admitted hosts and inspect connectivity and capabilities.
System health
Summarize uptime, memory, kernel or OS details, and bounded host facts.
Disk usage
See filesystem or volume capacity without granting file-browser access.
Processes
Inspect a bounded process snapshot with filters handled as data, not shell text.
Services and logs
Check exact allowlisted services and bounded log sources.
Operator tasks
Explicitly grant a time-limited shell session for development, diagnosis, builds, edits, and other work allowed by the delegated OS account.
Open source + hosted
Self-hosting is the primary Community product.
The code that reaches your machines is public and independently usable. Cloud is optional convenience around that boundary—not a requirement to use TetherBound.
Community
The self-hosted Linux/Tailscale path is now public under the descriptive chatgpt-plugin-tailscale repository.
- Open-source gateway / Edge
- Tailscale SSH for Linux
- Seven Bounded read-only MCP tools
- Experimental Operator mode
- Idempotent setup
- No TetherBound account required
Cloud
Optional hosted authentication, connectivity, policy, health, and audit around the same customer-controlled edge.
- Hosted authenticated MCP endpoint
- Outbound customer Edge connector
- Central policy and audit metadata
- Connector and host health
- Windows and macOS agent path
Current status
Clear about what exists and what comes next.
| Capability | Status | Path |
|---|---|---|
| Linux Bounded inspection | Working | Tailscale SSH + local gateway |
| Linux Operator mode | Experimental | Local opt-in + time-bounded non-root shell |
| ChatGPT private connection | Working | OpenAI Secure MCP Tunnel |
| Self-hosted Community source | Public | chatgpt-plugin-tailscale |
| Windows inspection | Roadmap | Native TetherBound Agent over the tailnet |
| macOS inspection | Roadmap | Native TetherBound Agent over the tailnet |
| TetherBound Cloud | Validation | Hosted MCP + outbound Edge relay |
Run it on your own tailnet.
TetherBound Community is public and self-hosted. Start with a Linux machine, use Bounded mode first, and enable Operator only when you deliberately want broader account-level access.