LabscoMCP early access ↗
HexSleevesMCP SERVER

Tailscale MCP Server

Run a tailnet from your client — devices, routes, ACLs, DNS, auth keys, exit nodes — with a risk ceiling that decides how much of it is writable.

by HexSleeves ↗Network, Endpoint & Fleet ManagementCommunity

LABSCO SUMMARY

One risk setting decides whether this reads your network or reshapes it.

TAILSCALE_ALLOWED_TOOL_RISK is a single dial with three positions — read, write, admin — and it maps onto the operations people actually worry about: read answers questions, write changes ACLs, DNS, routes and tags, admin can delete devices and mint auth keys. The dual backend is the other thing to plan around: tailnet administration goes over the API with your OAuth credentials, while network status, connect, disconnect, ping, version and exit-node changes run the local CLI, so those six need the Tailscale binary present on the machine hosting the server.

What it is

A Tailscale operations server that works two ways at once: the Tailscale REST API for tailnet-wide administration, and the local Tailscale CLI for anything about the machine it runs on. It starts read-only and localhost-bound.

What you get

  • list_devices across the tailnet, with offline devices and advertised routes included on request, and get_tailnet_info for the tailnet itself
  • device_action authorizes, deauthorizes, deletes or expires a device key; manage_device_tags reads and rewrites a device's tags
  • manage_routes enables or disables the routes a device advertises, and manage_exit_nodes lists exit nodes, sets the local one, or advertises routes
  • manage_acl reads, validates or updates the ACL policy — validation before update is its own operation, not an afterthought
  • manage_policy_file reads and updates the tailnet policy file, and manage_network_lock covers network lock status and changes
  • manage_dns reads and updates nameservers, search paths and MagicDNS, and manage_file_sharing does the same for file sharing settings
  • manage_keys lists, creates and deletes authentication keys, and manage_webhooks lists, creates, tests and deletes webhooks
  • Local host operations through the CLI: get_network_status, connect_network with auth key, hostname, login server and route flags, disconnect_network, ping_peer and get_version

Requirements

A Tailscale account and credentials for the tailnet: TAILSCALE_OAUTH_CLIENT_ID with TAILSCALE_OAUTH_CLIENT_SECRET is the preferred pair, and TAILSCALE_API_KEY is the fallback; TAILSCALE_TAILNET defaults to -, meaning the authenticated user's default tailnet. TAILSCALE_ALLOWED_TOOL_RISK is the ceiling and defaults to read — write enables ACL, DNS, route and tag changes, admin additionally enables device deletion, connect and disconnect, and auth key management. The CLI-backed tools need a local Tailscale binary, found at TAILSCALE_CLI_PATH. Default transport is stdio; MCP_TRANSPORT=http requires MCP_HTTP_BEARER_TOKEN of at least 32 characters and binds to 127.0.0.1 on port 3000 unless MCP_HTTP_BIND_HOST and MCP_HTTP_PORT say otherwise. Published as @hexsleeves/tailscale-mcp-server, with a Docker image as well. MIT.

Setup effort

One command plus a key — npx -y @hexsleeves/tailscale-mcp-server, then supply credentials

See installation options