TetherBound
GitHubEarly access
Documentation

Self-host today. Build toward mixed fleets.

The public Community repository contains the working Linux/Tailscale path, Bounded tools, experimental Operator mode, bootstrap, security docs, and the cross-platform roadmap.

Browse source + docs
Start here

Understand the product boundary

ChatGPT + Tailscale MCPHow TetherBound gives ChatGPT, Codex, and other MCP clients controlled access to machines on a tailnet.Security modelHow Tailscale identity and policy combine with TetherBound host admission, Bounded mode, Operator mode, time/output limits, and local authority.CommunityHow to self-host the public project, what already works, and what stays open source.CloudThe proposed optional hosted MCP, outbound customer Edge, policy, audit, and early-access validation.Self-hosting guideThe complete bootstrap and troubleshooting guide in the public repository.Operator modeBroad account-level delegation, lease semantics, privilege boundary, and prompt-injection risk.

Architecture at a glance

Community today
ChatGPT → Secure MCP Tunnel → TetherBound → Tailscale SSH → Linux

Bounded mode
AI → seven typed read-only tools → admitted hosts

Operator mode
AI → explicit time-bounded operator_exec → admitted host + delegated OS account

Cross-platform roadmap
AI client → TetherBound Edge ← tailnet + mTLS ← TetherBound Agent → Windows/macOS/Linux

What Tailscale provides

Tailscale is the private connectivity and machine-identity substrate in the current architecture. TetherBound deliberately builds above it instead of reimplementing a VPN or overlay network.

What TetherBound adds

TetherBound adds the AI-specific control boundary: host admission, stable typed operations, optional Operator delegation, hard time/result bounds, normalized responses, and audit metadata.

A Tailscale network rule alone does not grant an AI capability. TetherBound must independently admit the target and access mode.

Repository boundary

The customer-side trust boundary is public and auditable in chatgpt-plugin-tailscale. Edge/gateway, future Agent, host adapters, public protocols, tool contracts, local policy, setup tooling, and conformance/security tests stay open. Hosted OAuth, relay backend, dashboard, billing, and internal SaaS operations remain separate.

Community code must not depend on private Cloud packages or require Cloud connectivity to function.

Roadmap sequence

  1. Validate the public self-hosted Linux alpha with external installs.
  2. Harden Operator session semantics and packaging.
  3. Introduce the HostTransport / HostAdapter abstraction and outbound Agent protocol.
  4. Ship the Windows read-only Agent MVP.
  5. Add Linux/macOS Agent parity where useful.
  6. Validate optional hosted Cloud around the same customer-controlled Edge.

Current MCP surface

Bounded mode exposes seven read-only tools: host listing, host inspection, system summary, disk usage, process listing, service status, and bounded service logs. Experimental Operator mode adds operator_exec(host, command, cwd?) only after explicit local opt-in.

Primary references

Claims discipline: Linux Bounded mode is working. Operator mode is experimental. Windows/macOS Agents and Cloud are not currently shipped.