Across machines

Sharing a stream beyond its machine is built on MoQ (Media over QUIC), a protocol made for live data. The runtime runs a MoQ relay on each machine, and that relay gives every exposed output a URL. A browser, a tool, or a stream on another of your machines reads an output by its URL, and it reaches only as far as the output’s exposure allows.

The runtime's MoQ relay gives an exposed output a URL, and a browser, a laptop and an agent all read it there.

How it works

• Every exposed output gets a URL. The relay serves each exposed output on its own path, and the path is the output’s address, such as door-box/door_camera/camera/video. A private output’s URL works on its own machine. A public output’s URL works from other machines too.
• Live data travels over MoQ. MoQ runs on QUIC, which suits live data: a lost packet doesn’t hold up everything behind it, the way it does over TCP. A browser, or a computer-use agent, plays an output on its own viewer page, and a stream on another machine reads it with remote_output, by the same address.
• Your tailnet connects your machines. On a Tailscale tailnet, the relay serves public outputs on the machine’s tailnet address. Tailscale does what it already does: reaching machines, naming them, encrypting traffic between them and deciding who may connect. Tatolab doesn’t build its own versions.
• A relay on the internet, when you want one. To share beyond your tailnet, a machine joins a MoQ relay on the internet, given the relay’s address and a credential, and offers its public outputs there. That relay’s access rules decide who can read them. You can run an open-source relay yourself, or use a hosted one. Until end-to-end encryption is added, whoever operates a hosted relay can see the streams that pass through it, so a relay you run yourself is the private choice.
• Pull, never push. Nothing is sent for an output nobody reads. A reader pulls from an exposed output, just as streams on one machine pull from each other.
• Plain HTTP for what isn’t live. A machine lists its exposed outputs, and serves snapshots, small samples and a read-only MCP over HTTPS, set up through tailscale serve.

Control another machine

Control any machine you can reach over ssh. Every tatolab command works on another machine’s runtime when you run it there:

ssh door-box .local/bin/tatolab streams
ssh door-box .local/bin/tatolab logs --stream door_camera -f

.local/bin/tatolab is where the Linux installer puts it, relative to your home folder on that machine; a command run over ssh doesn’t get ~/.local/bin on its PATH on Debian and Ubuntu. An agent works the same way, through ssh:

claude mcp add door-box -- ssh door-box .local/bin/tatolab mcp

Use your tailnet’s names. A runtime names its machine after the machine’s Tailscale name, or its hostname when it isn’t on a tailnet. That name is the first part of a full address, door-box/door_camera/camera/video, and tatolab graph | jq -r .machine prints it. With Tailscale, ssh door-box works from any of your machines, wherever they are.

Get files and frames off a machine. Record to a file and copy it off, save frames as PNGs with tatolab exchange, or ship each stream’s JSON Lines log to your own tools.

Set up for sharing

• Expose as public what you want to share. Public outputs are the ones your other machines, and a relay the machine joins, can read.
• Name your nodes. An address like door-box/door_camera/camera/video is what people and agents on other machines type, and the path of the output’s URL.
• Put your machines on a tailnet. It’s what sharing between your own machines runs over.