io.github.YawLabs/tailscale-mcp

Accept a device share invitation using the invite URL or code.

Approve a pending user, granting them access to the tailnet.

Authorize a device that is pending authorization.

Batch update custom posture attributes across multiple devices. Each attribute key must start with 'custom:'. Uses JSON Merge Patch semantics — pass null as the attribute config to delete.

Create or get an AWS external ID for your tailnet. Used when configuring log streaming to S3 — the external ID is included in the IAM role trust policy.

Create a device share invitation that allows an external user to access a specific device in your tailnet.

Create a new key in your tailnet. Supports auth keys (for adding devices), OAuth clients (for programmatic API access), and federated identities (for OIDC-based CI/CD access). Returns the key value — save it immediately, as it cannot be retrieved again. SECURITY: the response body contains a long-lived credential verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive (do not commit it, avoid re-sharing it in unrelated chat history). Examples: - Auth key: {keyType:'auth', reusable:true, tags:['tag:ci']} - OAuth client: {keyType:'client', scopes:['devices:read','dns']} - Federated (GitHub Actions): {keyType:'federated', scopes:['devices:read'], issuer:'https://token.actions.githubusercontent.com', subject:'repo:my-org/my-repo:*'}

Create a new device posture integration.

Create a new user invite that allows someone to join your tailnet.

Create a new webhook. The response includes the webhook's signing secret -- this is the only opportunity to capture it; save it immediately. SECURITY: the response body contains the secret verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive.

Deauthorize a device, immediately removing its access to the tailnet. The device will need to be re-authorized to reconnect.

Permanently remove a device from the tailnet. This is irreversible — the device must re-authenticate to rejoin.

Delete a device invite. This is irreversible — the invite link will stop working.

Delete a custom posture attribute from a device. This is irreversible.

Delete a key (auth key, OAuth client, or federated identity). This is irreversible. For auth keys, devices already authenticated are unaffected but no new devices can use it. For OAuth clients and federated identities, any integrations using them lose access immediately.

Delete a log streaming configuration. Logs will stop being sent to the configured destination.

Delete a posture integration. This is irreversible.

Delete a Tailscale Service. This is irreversible — the service's MagicDNS name and virtual IP will be released.

Delete a user from the tailnet. This is irreversible — the user and all their devices will be removed.

Delete a user invite. This is irreversible — the invite link will stop working.

Delete a webhook. This is irreversible — the webhook secret cannot be recovered.

Expire a device's key, forcing it to re-authenticate.

Get the current ACL policy for your tailnet. Returns the raw policy text with original formatting preserved, including comments and trailing commas (HuJSON). Also returns an ETag — you must pass it to tailscale_update_acl to safely update the policy.

Get the tailnet audit/configuration log. Shows who changed what and when — useful for troubleshooting and compliance.

Get the tailnet contact information (security, support, admin emails).

Get detailed information about a specific device by its ID.

Get details for a specific device invite.

Get all posture attributes for a device, including custom and system-managed attributes.

Get the subnet routes a device advertises and which are enabled.

Get the unified DNS configuration for your tailnet, including nameservers, search paths, split DNS, and MagicDNS preference in a single call.

Get DNS preferences for your tailnet, including whether MagicDNS is enabled.

Get details for a specific key (auth key, OAuth client, or federated identity).

Get the log streaming configuration for a specific log type.

Get the status of log streaming for a specific log type. Shows whether logs are being delivered successfully.

Get the DNS nameservers configured for your tailnet.

Get network traffic flow logs showing connections between devices. Shows source/destination nodes, timestamps, and traffic metadata — useful for security monitoring and debugging connectivity.

Get details for a specific device posture integration.

Get the DNS search paths configured for your tailnet.

Get details for a specific Tailscale Service, including its MagicDNS name, virtual IP, and configuration.

Get the approval status of a specific device for a Tailscale Service.

Get the split DNS configuration for your tailnet.

Get your tailnet settings (device approval, key expiry, HTTPS certificates, etc.).

Get details for a specific user.

Get details for a specific user invite.

Get details for a specific webhook.

List all device invites for a specific device.

List all devices in your tailnet with their status, IP addresses, OS, and last seen time.

List keys in your tailnet. By default lists auth keys only. Set 'all' to true to include OAuth clients and federated identities.

List all log streaming configurations for your tailnet. Fetches both 'configuration' (audit) and 'network' (flow) log stream configs. Log streaming sends logs to external destinations like Axiom, Datadog, Splunk, Elasticsearch, or S3.

List all device posture integrations configured for your tailnet.