TetherBound Community

Own the whole boundary.

The customer-side runtime is being prepared for a clean public open-source release: a security-first MCP layer for giving ChatGPT, Codex, and other compatible clients bounded access to private machines over Tailscale. The Linux proof of concept already works end to end.

ChatGPT + Tailscale overview

Working

Built on Tailscale

A dedicated Tailscale identity provides private connectivity and machine identity for the current Linux path.

Working

Bounded AI operations

TetherBound adds independent host/tool policy, strict host verification, typed read-only tools, and hard result limits above the network layer.

Public Community release

Edge, Agent, protocol, adapters, local policy, setup tooling, and conformance tests move into a clean public tetherbound repository with signed releases.

What stays open

The code that actually reaches customer machines is the part users should be able to inspect. TetherBound Edge, TetherBound Agent, host adapters, protocol definitions, tool contracts, local policy, setup tooling, and security/conformance tests are intended to remain open source and independently usable.

Current proof of concept

Embedded tsnet Tailscale identity.
Independent host and tag allowlists.
Strict Tailscale SSH host-key verification.
No stored SSH private key for the default Linux path.
Seven fixed read-only MCP tools.
Exact service allowlists plus time, row, line, and byte bounds.
Idempotent bootstrap for Tailscale and OpenAI tunnel setup.

Why Tailscale?

Tailscale already solves private connectivity and machine identity well. TetherBound focuses on the layer above it: what an AI assistant is allowed to inspect, how that operation is expressed, how output is bounded, and how the decision can be audited.

The project remains independent; using Tailscale as the network and identity substrate does not imply an affiliation or partnership.

Why isn't the source public yet?

The working prototype lives in the private chatgpt-plugin-tailscale incubation repository. We are intentionally retaining that descriptive historical name while extracting the customer-side runtime into a clean public TetherBound Community repository after a secret/history review and naming migration.

Status: Linux read-only inspection is implemented and tested. The public Community repository, Windows/macOS Agent, Cloud, and write actions are not yet generally available.