TAILSCALE_ALLOWED_TOOL_RISK is a single dial with three positions — read, write, admin — and it maps onto the operations people actually worry about: read answers questions, write changes ACLs, DNS, routes and tags, admin can delete devices and mint auth keys. The dual backend is the other thing to plan around: tailnet administration goes over the API with your OAuth credentials, while status, connect, disconnect and ping run the local CLI, so those five need the Tailscale binary present on the machine hosting the server.
A Tailscale operations server that works two ways at once: the Tailscale REST API for tailnet-wide administration, and the local Tailscale CLI for anything about the machine it runs on. It starts read-only and localhost-bound.
- list_devices across the tailnet, with offline devices and advertised routes included on request, and get_tailnet_info for the tailnet itself
- device_action authorizes, deauthorizes, deletes or expires a device key; manage_device_tags reads and rewrites a device's tags
- manage_routes enables or disables the routes a device advertises, and manage_exit_nodes lists exit nodes, sets the local one, or advertises routes
- manage_acl reads, validates or updates the ACL policy — validation before update is its own operation, not an afterthought
- manage_policy_file reads and updates the tailnet policy file, and manage_network_lock covers network lock status and changes
- manage_dns reads and updates nameservers, search paths and MagicDNS, and manage_file_sharing does the same for file sharing settings
- manage_keys lists, creates and deletes authentication keys, and manage_webhooks lists, creates, tests and deletes webhooks
- Local host operations through the CLI: get_network_status, connect_network with auth key, hostname, login server and route flags, disconnect_network, ping_peer and get_version
A Tailscale account and credentials for the tailnet: TAILSCALE_OAUTH_CLIENT_ID with TAILSCALE_OAUTH_CLIENT_SECRET is the preferred pair, and TAILSCALE_API_KEY is the fallback; TAILSCALE_TAILNET defaults to -, meaning the authenticated user's default tailnet. TAILSCALE_ALLOWED_TOOL_RISK is the ceiling and defaults to read — write enables ACL, DNS, route and tag changes, admin additionally enables device deletion, connect and disconnect, and auth key management. The CLI-backed tools need a local Tailscale binary, found at TAILSCALE_CLI_PATH. Default transport is stdio; MCP_TRANSPORT=http requires MCP_HTTP_BEARER_TOKEN of at least 32 characters and binds to 127.0.0.1 on port 3000 unless MCP_HTTP_BIND_HOST and MCP_HTTP_PORT say otherwise. Published as @hexsleeves/tailscale-mcp-server, with a Docker image as well. MIT.
One command plus a key — npx -y @hexsleeves/tailscale-mcp-server, then supply credentials