Documentation

From working prototype to cross-platform product.

The Linux proof of concept is working over Tailscale. The public Community repository is being prepared separately from the private incubation and Cloud codebases.

Start here

Understand the product boundary

ChatGPT + Tailscale MCPHow TetherBound gives ChatGPT, Codex, and other MCP clients bounded access to machines on a tailnet without handing them a shell.Security modelHow Tailscale identity and policy combine with TetherBound local policy, typed operations, output bounds, and the future write-action model.CommunityWhat already works, what stays open source, and why the public runtime repository is being extracted cleanly.CloudThe proposed hosted MCP, outbound customer Edge, Tailscale custody model, policy, audit, and early-access validation.Tailscale SSHThe underlying private SSH and machine-identity capability used by the current Linux path.

Architecture at a glance

Community today
ChatGPT → Secure MCP Tunnel → TetherBound → Tailscale SSH → Linux

Cross-platform roadmap
AI client → TetherBound Edge ← tailnet + mTLS ← TetherBound Agent → Windows/macOS/Linux

Cloud roadmap
AI client → TetherBound Cloud → outbound customer Edge → Tailscale → approved hosts

What Tailscale provides

Tailscale is the private connectivity and machine-identity substrate in the current architecture. TetherBound deliberately builds above it instead of reimplementing a VPN or overlay network.

What TetherBound adds

TetherBound adds the AI-specific control boundary: stable typed operations, local host/tool policy, exact allowlists, hard result and time bounds, normalized cross-platform responses, audit metadata, and eventually explicit approval semantics for narrow write actions.

A Tailscale network rule alone does not grant an AI tool. The TetherBound Edge must independently allow the host and capability.

Repository boundary

The customer-side trust boundary is designed to be public and auditable. Edge, Agent, host adapters, protocol definitions, tool contracts, local policy, setup tooling, and conformance/security tests belong in the Community repository. Hosted OAuth, public MCP infrastructure, relay backend, dashboard, billing, and internal SaaS operations remain separate.

Public Community code must not depend on private Cloud packages or require Cloud connectivity to function.

Roadmap sequence

Cross-platform build and installation foundation.
Host abstraction and outbound Agent protocol.
Windows read-only Agent MVP.
Linux/macOS Agent parity.
Clean public Community release with signed packages.
Hosted Cloud alpha and public MCP/app distribution path.
Read-only GA before narrowly typed, approval-gated write actions.

Current tool surface

The working Linux proof of concept exposes seven read-only MCP tools: host listing, host inspection, system summary, disk usage, process listing, service status, and bounded service logs. There is no arbitrary shell tool.

Primary Tailscale references

Claims discipline: this site distinguishes implemented functionality from roadmap and validation concepts. Windows/macOS Agents, Cloud, and write actions are not currently shipped.