Most people searching for a tailscale ai gateway want the same thing: a way to reach the AI system running on their own computer from their phone, without pushing anything onto the public internet. That is exactly what Julian Goldie built with the setup he calls Pocket Mission Control — using Tailscale as a private gateway to the locally running Agent OS on his Mac, so he can check on his agents from the gym, a coffee shop or another country. It is free, it stays private, and it takes roughly ten minutes to set up.
Below: what Tailscale actually is, how the gateway works, the exact steps Julian used, and the two gotchas that catch almost everyone.
What is Tailscale, in plain English?
Tailscale is a free app that connects your devices into one private, encrypted network called a tailnet. Your Mac, your phone and your laptop all join it, and from that moment they can talk to each other directly, end-to-end encrypted, no matter what network each one is physically sitting on.
The important part is what does not happen. Nothing is published to the public internet. There are no router settings to change, no ports to open, and no domain to buy. Your devices simply behave as if they were plugged into the same private network, wherever they actually are.
That makes it a natural fit for locally run AI agents: your system stays on your machine, and your other devices get a private line to it.
How the tailscale ai gateway setup works
Here is the trick at the heart of Pocket Mission Control. Your Agent OS normally runs on localhost — an address only the machine it runs on can see. Through Tailscale, that same dashboard appears at a private HTTPS address that only your signed-in devices can reach.
Certificates are handled automatically, it works from any network, and you can switch it off whenever you like. Your agents and keys never leave your machine; the gateway simply lets your phone look in. Julian describes it as three layers.
Layer one: the station
This is your Agent OS running on the Mac or laptop, exactly as it always has. Nothing about the system itself changes. It keeps working on localhost, doing whatever your agents were already doing.
Layer two: the wire
Tailscale joins the Mac and the phone into one tailnet, then serves the Agent OS at that private HTTPS address. This is the gateway itself: one encrypted tunnel that follows you around, rather than a public URL anyone could stumble across.
Layer three: the phone
Open the private address in any browser on the phone, then add it to your home screen. It now opens with one tap and feels like a native app, even though it is your own machine answering.
Why this beats a VPS or remote desktop
Without Tailscale, mobile access means either moving your whole system and keys onto a cloud server or VPS, or fighting with messy remote-desktop tools. Neither is pleasant.
| Approach | Where your system lives | Privacy | Setup effort | Phone experience |
|---|---|---|---|---|
| Tailscale gateway (this setup) | Stays on your own machine | Private tailnet, end-to-end encrypted, nothing public | Roughly ten minutes, free | Feels like a native app from the home screen |
| Cloud or VPS | Moved to someone else's server, keys included | Depends entirely on how you secure the server | Migration project, ongoing hosting to manage | Fine once running, but your system no longer lives locally |
| Remote desktop | Stays local, but you stream the whole screen | Depends on the tool | Often fiddly to configure and keep stable | Desktop interface squeezed onto a phone |
The Tailscale route keeps everything local and private, with one tunnel that follows you. That is the whole appeal.
The ten-minute setup walkthrough
Julian did not wire this up by hand. He told Claude: "set up a separate mission control we can test on my mobile, run it with Tailscale". Here is the full sequence.
- Start with the station. Make sure your Agent OS is running locally on the Mac or laptop, as normal.
- Give your agent that instruction and let it handle the wiring.
- Sign in at login.tailscale.com when prompted, which creates your account and your tailnet.
- Let Tailscale serve the Agent OS. You get back a private HTTPS address that only devices on your tailnet can reach.
- Copy that address somewhere handy. This is your Pocket Mission Control URL.
- Install the Tailscale app on your phone.
- Log in on the phone with the same account you used on the Mac. Same account on both devices — this is what puts them on the same tailnet.
- Switch the Tailscale toggle on inside the phone app.
- Open the private address in your phone browser, typing the https:// prefix in full.
- Add the page to your home screen, then test it away from your home network to prove the tunnel follows you.
That is the entire job. No port forwarding, no domain purchase, no server rental.
📺 Watch: Agent OS + Tailscale: FREE AI Everywhere!
The two gotchas that stop it working
Julian stresses two mistakes, because both make people think the setup is broken when it is fine.
Gotcha one: you must type https:// on the phone
If you enter the address without the https:// prefix, the page simply will not load. Type the prefix in full the first time. Once it is saved to your home screen, you never think about it again.
Gotcha two: the Tailscale toggle must be on
The phone app has a toggle, and it must be switched on before anything connects. Miss it and nothing works. If your mission control ever seems dead, check the toggle first.
What you can actually do from your phone
Once the gateway is live, the phone is not a cut-down viewer. It is the same Agent OS, served over your private tunnel.
- Check on agents that are working around the clock, from wherever you happen to be.
- Kick off new builds while you are away from the desk.
- Run the Kanban board on the go, moving tasks between columns from a queue or a taxi.
- Carry the memory system in your pocket, so context from earlier sessions is always with you.
- Use any agent in the OS — Claude, Hermes, Antigravity or Codex — the same line-up Julian Goldie puts through Goldie Bench, his own hands-on testing of which agents actually deliver on real tasks.
If you want your money-making agents in your pocket, check out the AI Profit Boardroom — the full Agent OS setup and the step-by-step Tailscale SOP are inside, alongside members running the same system on a VPS. → Get the Pocket Mission Control SOP
An honest note before you set this up
Julian is upfront about something most tutorials skip: he still prefers using the Agent OS at his desk, and he does not think you need your local setup on your phone. The tutorial exists because people ask him about it daily. If you are curious, it costs nothing and takes ten minutes; if you never leave your desk, skip it and lose nothing.
The security objection deserves a straight answer too. The private address lives inside your tailnet. Only devices logged into your account can reach it. It is not exposed to the open internet, there is no public URL to guess, and you can turn the tunnel off at any time.
FAQ
Does this cost anything?
No. Tailscale is a free app, the Agent OS is your existing local setup, and the whole configuration Julian shows costs nothing to run.
Do I need to change my router or open ports?
No. That is the entire point of the tailnet approach. No router settings, no opened ports, no domain to buy — the devices connect to each other privately.
Can other people find my Agent OS address?
No. The HTTPS address only resolves for devices signed into your tailnet. To the public internet, there is nothing there to find.
Why will the page not load on my phone?
Almost always one of the two gotchas: you skipped the https:// prefix, or the Tailscale toggle in the phone app is switched off. Fix those two and it connects.
Does it work away from my home Wi-Fi?
Yes. The tunnel works from any network — mobile data, hotel Wi-Fi, a coffee shop abroad — because the tailnet follows your signed-in devices rather than your location.
What if I would rather host it in the cloud?
Some people run the Agent OS on a VPS instead, including members inside the AI Profit Boardroom, where a full SOP covers both routes. Julian's default remains local-first: your system and keys stay on hardware you control.
The Bottom Line
A tailscale-based gateway is the cleanest way to put a locally running AI system in your pocket. Your Agent OS stays on your machine, Tailscale wraps it in a private encrypted tailnet, and your phone reaches it at an HTTPS address nobody else can see. No ports, no domain, no server rental — and it switches off whenever you want.
Set up the station, let Tailscale run the wire, put the address on your home screen, and remember the two gotchas: type https:// in full, and switch the toggle on. Ten minutes of setup, and mission control follows you anywhere.
