GOAT ConnectComing soon
Reach your machines from anywhere.
GOAT Connect is in an invite-only beta. In public builds, goat connect prints that it is coming soon and changes nothing. Pair directly or over Tailscale today.
In builds with Connect enabled, you sign in with MFA, run goat connect on the host, and open that machine from any screen you have paired. The host's tunnel only connects out.
Where it lives in the app
Settings → Connections is where GOAT shows how this app reaches your environments. In public builds the GOAT Connect card says it is coming soon and points to Tailscale.
The real Settings screen from GOAT with Liquid Glass on. The machine name is an example.
One connection, four parts
A GOAT Connect connection goes through these four parts, in this order. When one fails, GOAT names it.
This device
Reaches GOAT Connect over the internet.
GOAT Connect
Checks your sign-in and the host's link.
The host's tunnel
cloudflared on the host carries the request. It connects out on port 7844.
GOAT on the host
Answers the request.
How it behaves
- Sign-in with MFA
- Connect requires MFA. If GOAT asks for recent verification, verify both factors and retry.
- Outbound tunnel
- The host's tunnel makes the connection out to Cloudflare on port 7844, so GOAT Connect needs no port opened on the host for it.
- Diagnosis on both sides
- On the host, goat connect status checks the host's own Connect address. On a device that cannot connect, Settings → Connections → Details shows which part failed.
goat connectSign in in a local browser and link this host.
goat connect statusCheck this host's GOAT Connect address from the host.
goat connect logoutRemove local authorization. Retry if it reports remote revocation pending.
Today in public builds: goat pair --tailscale connects a device over Tailscale.