Docs

WebFinder lists web interfaces across your tailnet without scanning peer machines. The recommended setup is web-finder start --auto-publish, but plain web-finder start remains the passive default.

Discovery Model

Each Mac or Linux publisher runs a small local manifest daemon. Remote WebFinder clients fetch that manifest over Tailscale Serve instead of probing random ports on the peer.

Default Mode

web-finder start advertises only web UIs already present in tailscale serve status. It does not expose detected local services for you.

Auto-Publish Mode

web-finder start --auto-publish is recommended for most setups. It lets WebFinder create Tailscale Serve mappings for detected local web UIs, but it is explicit and not the default. On Linux, it may prompt for local Tailscale operator permission.

Auto-publish is a start mode, not a toggle. To leave auto-publish mode, run web-finder stop, then restart with plain web-finder start.

Setup

Recommended setup

web-finder start --auto-publish

WebFinder publishes its manifest on port 9321, enables autostart, and creates Tailscale Serve mappings for detected local web UIs. On Linux, WebFinder may ask before running sudo tailscale set --operator=$USER; sudo may ask for your password the first time.

Passive/default setup

tailscale serve --bg --https=3000 http://127.0.0.1:3000
web-finder start

Use this when you want to manage Tailscale Serve mappings yourself. WebFinder only advertises mappings already present in tailscale serve status.

Autostart

web-finder start --auto-publish and plain web-finder start both enable autostart where supported, so the manifest daemon comes back after reboot.

macOS uses a LaunchAgent.
Most Linux systems use a systemd user service.
OpenWrt uses a native procd service.
Synology and other non-systemd systems use a cron fallback when available.

web-finder status
web-finder stop

Install Commands

macOS

brew install --cask zeulewan/tap/webfinder

Linux

curl -sSL https://raw.githubusercontent.com/zeulewan/web-finder/refs/heads/main/install.sh | bash

Uninstall

curl -sSL https://raw.githubusercontent.com/zeulewan/web-finder/refs/heads/main/uninstall.sh | bash

iPhone and iPad

The iOS app reads your Tailscale device list with a local OAuth credential, then fetches WebFinder manifests from your own tailnet. It does not send data to WebFinder servers.