The Tailscale SSH client, files and agent layer.

01  /  two different layers

The network, and the client that runs over it.

Tailscale is the network: a mesh VPN where devices reach each other over WireGuard, and Tailscale SSH authenticates by tailnet identity — the server accepts the connection without the client proving a key. That's the layer Termalin runs on top of. Point Termalin's desktop app at your 100.x addresses or MagicDNS names and you get browser-style tabs, an SFTP editor, recordings and a live stats bar over the tailnet you already trust.

• ▸Termalin as the client over your tailnet. Tabs, SFTP, recordings and the stats bar for your 100.x or MagicDNS hosts.
• ▸Add a Connector where agents or the browser need in. For the hosted MCP and the browser cabinet, enrol a server with a Connector — honestly, that's a separate outbound path, not something that rides the tailnet.
• ▸Keep what Tailscale is good at. Its ACLs, grants and check mode still govern who can connect; Termalin is the window you connect through.

02  /  the parts a network doesn't include

A real client, and recordings Tailscale stepped back from.

A network gets you connected; it doesn't give you a terminal app, an SFTP file browser, a host vault or server dashboards. Termalin does. It also records sessions on every tier — output only, never keystrokes, with agent actions marked — which matters more now that Tailscale no longer offers tsrecorder session recording (support for existing users ends August 2027). Its PAM replacement, with video replay and transcripts, is in beta and listed under Enterprise. How recording works →

• ▸SSH over Tailscale with recording. Scrub back through what happened on a box — on Free (local) or synced end-to-end encrypted on paid plans.
• ▸No host cap. Basic Tailscale SSH tops out at 5 hosts on Personal and Standard; Termalin has no host limits on any tier.
• ▸Monitoring and alerts for every server with a Connector — CPU, memory, disk, failed services and expiring certificates, with alerts to email, push, Telegram or a webhook.

03  /  agents on your servers

An AI layer that works without a tailnet device.

Tailscale has a real AI story: Aperture went GA in August 2026 and added "Tailscale" and "Tailscale SSH" MCP endpoints, so an agent can add nodes and reach them over the tailnet, with its actions logged. Termalin's layer is complementary and sits off the network: a hosted MCP endpoint where Claude, ChatGPT, Claude Code, Codex or Cursor sign in and run commands on the servers you enrol — keylessly, through a Connector, with no tailnet device on the AI side. Each app gets a scope and a policy (full, allowlist or read-only), and every command lands in the audit log.

04  /  switching — honestly

Why you'd keep Tailscale — and run Termalin over it.

This isn't a replacement story. Tailscale is a whole private network — any port, any protocol, not just SSH — with a free Personal plan for up to six users, identity-based ACLs and grants, check mode, and clients on every OS. We already recommend a mesh VPN like Tailscale for home labs, because it scales well and exposes nothing. Keep it. Add Termalin as the client: the terminal, SFTP, vault, recordings and monitoring the network layer doesn't try to be, plus a hosted MCP for your agents. Termalin imports hosts from an ~/.ssh/config, a CSV, PuTTY or MobaXterm, and exports back any time — no lock-in, either direction. One honest note: Termalin's Connector is its own outbound path with its own CA, not something that rides your tailnet.