ChatGPT + Tailscale

Connect AI to your tailnet on your terms.

TetherBound Community is an open-source, self-hosted MCP layer for giving ChatGPT, Codex, and other MCP clients controlled access to private machines reachable over Tailscale.

Self-host on GitHub Read the security model

Tailscale

Private connectivity + identity

Tailscale supplies the private network path and machine identity. The current Linux implementation reaches admitted hosts through Tailscale SSH.

Bounded

Narrow by default

Seven fixed read-only tools independently enforce host/service policy and hard result limits. Caller text does not become arbitrary shell text.

Operator

Broad when you choose it

Experimental Operator mode deliberately grants arbitrary shell execution on admitted hosts as a selected OS account under a local time-bounded lease.

What works today

The Linux path works end to end: ChatGPT connects through an outbound Secure MCP Tunnel to TetherBound, which uses a dedicated Tailscale identity and Tailscale SSH to reach explicitly admitted Linux machines.

Bounded mode can list hosts, inspect a host, summarize system health, inspect disk usage and processes, check exact allowlisted services, and read bounded service logs. Operator mode adds a deliberately broad shell tool for users who want to delegate the whole task instead of tuning individual controls.

Why not just give ChatGPT SSH?

SSH solves secure remote transport; it does not define the blast radius an AI assistant should receive. TetherBound makes that delegation explicit. Most users can start with fixed read-only tools. Users who want broader autonomy can deliberately delegate one admitted host/account for a limited Operator session without handing the model a reusable human SSH key or automatically elevating it to root.

ChatGPT / Codex
      │ MCP
      ▼
  TetherBound
 host admission · Bounded / Operator · limits
      │
      ▼
   Tailscale
 private connectivity · machine identity
      │
      ▼
 admitted private machines

Is this a ChatGPT plugin?

The repository is intentionally named chatgpt-plugin-tailscale because that is a clear, discoverable description of the use case. **TetherBound** is the product and security model. The actual integration is MCP-based; in current ChatGPT terminology it is a custom MCP app connected through Secure MCP Tunnel.

Cross-platform direction

Linux keeps the zero-install Tailscale SSH target path. Windows and macOS are planned around a native TetherBound Agent that initiates an outbound tailnet session and exposes normalized capabilities without requiring reusable Windows passwords, WinRM credentials, or a permanently open generic PowerShell endpoint.

Independent project

TetherBound is an independent project and is not affiliated with or endorsed by Tailscale Inc. or OpenAI. Tailscale is a trademark of Tailscale Inc.

Status: Public Community source and Linux Bounded inspection are working. Operator mode is experimental. Windows/macOS Agent and TetherBound Cloud remain roadmap/validation items.