The missing Tailscale VNC client
Tailscale users can already reach port 5900 on their Mac — what's missing is a VNC client. iPads, Chromebooks, Windows PCs and phones don't ship one that speaks Apple's Screen Sharing dialect. Direct mode fills exactly that gap:
node mrc.mjs --listen 5800 --no-relayThe connector now serves the viewer at http://<tailscale-ip>:5800 and bridges the browser's WebSocket straight into localhost:5900. Open that URL from any device on your tailnet and sign in with the Mac's credentials.
Zero third parties
With --no-relay, our relay is never contacted — not for signaling, not for assets, not at all. Every byte travels inside your tailnet's WireGuard encryption. It works with no public internet whatsoever: same-LAN, offline lab, airplane-mode router.
Belt and suspenders
Even inside a private network the session still runs Apple's ARD authentication — your macOS password is required and verified by macOS. A housemate on your LAN sees a login prompt, not your desktop.
Mix and match
Run --listen without --no-relay and you get both roads at once: tailnet-local when you're near, pairing code when you're away.
Also useful: From an iPhone · From Windows · From a Chromebook · How it all works