TetherBound Community

Own the whole boundary.

TetherBound Community is public, open source, and self-hosted. The current Linux path gives ChatGPT, Codex, and other MCP clients controlled access to private machines over Tailscale, with Bounded tools by default and an experimental Operator mode for broader delegation.

Open the repository ChatGPT + Tailscale overview

Working

Built on Tailscale

A dedicated Tailscale identity provides private connectivity and machine identity for the current Linux path.

Default

Bounded AI operations

Seven typed read-only tools add independent host/tool policy, strict host verification, exact service allowlists, and hard result limits above the network layer.

Experimental

Operator mode

Explicit local opt-in grants arbitrary shell execution on admitted Linux hosts as the configured OS account under a time-bounded lease.

Self-hosting is the product

The code that actually reaches your machines is the part you should be able to inspect. The public chatgpt-plugin-tailscale repository is the canonical Community distribution and is independently usable without TetherBound Cloud.

What stays open

TetherBound Edge / gateway, future TetherBound Agent, host adapters, protocol definitions, tool contracts, local policy, setup tooling, and security/conformance tests belong in the public Community trust boundary.

What works today

Embedded tsnet Tailscale identity.
Independent host and tag admission.
Strict Tailscale SSH host-key verification.
No stored SSH private key for the default Linux path.
Seven fixed read-only MCP tools in Bounded mode.
Experimental operator_exec for users who explicitly opt into broad account-level access.
Exact service allowlists plus time, row, line, and byte bounds.
Idempotent bootstrap for Tailscale and OpenAI Secure MCP Tunnel setup.

Get started

git clone https://github.com/fijimunkii/chatgpt-plugin-tailscale.git
cd chatgpt-plugin-tailscale
./bootstrap
make up

For a deliberately broad Operator session, read the Operator documentation first, then run make operator-up.

Why Tailscale?

Tailscale already solves private connectivity and machine identity well. TetherBound focuses on the layer above it: what boundary an AI assistant receives, how hosts are admitted, how execution and output are bounded, and how access can be audited and revoked.

The project remains independent; using Tailscale as the network and identity substrate does not imply an affiliation or partnership.

Status: Linux Bounded inspection is implemented and tested end to end. Operator mode is experimental. Windows/macOS Agent support and TetherBound Cloud remain roadmap/validation work.