Tailscale MCP by usefulapi
Read devices, users, keys, ACLs and DNS for a tailnet; manage devices, routes and auth keys.
Should I use this
Quality & Safety
Findings (1)
- LOWTool 'tailscale_expire_device_key' description lacks action verbin tailscale_expire_device_key
Based on automated analysis of tool definitions and protocol compliance.
Context Cost
This is the approximate number of tokens consumed each time the server's tools are loaded into a model's context. Higher counts reduce the attention available for other tasks.
Install
One-Click Install
Add this to your `claude_desktop_config.json` file:
{
"mcpServers": {
"tailscale": {
"url": "https://tailscale.usefulapi.io/mcp"
}
}
}Remote endpoints
https://tailscale.usefulapi.io/mcpstreamable-httpWhat it can do
Tool inventory
Tools (22)
🟢tailscale_list_devices(fields)
List all devices in the tailnet (name, addresses, OS, last seen, tags, etc.). Tailscale REST: GET /tailnet/{tailnet}/devices.
Input Schema
{
"type": "object",
"properties": {
"fields": {
"description": "Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset.",
"type": "string",
"enum": [
"default",
"all"
]
}
},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_device(deviceId, fields)
Get a single device by id. Tailscale REST: GET /device/{deviceId}.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
},
"fields": {
"description": "Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset.",
"type": "string",
"enum": [
"default",
"all"
]
}
},
"required": [
"deviceId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_list_device_routes(deviceId)
List the subnet routes a device advertises and which are enabled. Tailscale REST: GET /device/{deviceId}/routes.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
}
},
"required": [
"deviceId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_list_keys(all)
List auth keys and API access tokens for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/keys.
Input Schema
{
"type": "object",
"properties": {
"all": {
"description": "If true, returns all keys, tokens and OAuth clients in the tailnet, not just the caller's own (requires appropriate scope). Default false.",
"type": "boolean"
}
},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_key(keyId)
Get details of a single auth key / API access token by id (capabilities, expiry, usage). Tailscale REST: GET /tailnet/{tailnet}/keys/{keyId}.
Input Schema
{
"type": "object",
"properties": {
"keyId": {
"type": "string",
"description": "The key id."
}
},
"required": [
"keyId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_policy_file(details)
Get the tailnet's ACL / policy file (returned as JSON via the Accept header, not HuJSON). Tailscale REST: GET /tailnet/{tailnet}/acl.
Input Schema
{
"type": "object",
"properties": {
"details": {
"description": "If true, include metadata about the policy file (e.g. when and by whom it was last updated).",
"type": "boolean"
}
},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_list_dns_nameservers
List the global DNS nameservers configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/nameservers.
Input Schema
{
"type": "object",
"properties": {},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_dns_preferences
Get the tailnet's DNS preferences (e.g. whether MagicDNS is enabled). Tailscale REST: GET /tailnet/{tailnet}/dns/preferences.
Input Schema
{
"type": "object",
"properties": {},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_list_dns_searchpaths
List the DNS search paths (search domains) configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/searchpaths.
Input Schema
{
"type": "object",
"properties": {},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_split_dns
Get the tailnet's split-DNS configuration — a map of domain → nameservers. Tailscale REST: GET /tailnet/{tailnet}/dns/split-dns.
Input Schema
{
"type": "object",
"properties": {},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_list_users(type, role, status)
List users of the tailnet, optionally filtered by type, role or status. Tailscale REST: GET /tailnet/{tailnet}/users.
Input Schema
{
"type": "object",
"properties": {
"type": {
"description": "Filter by user type.",
"type": "string",
"enum": [
"all",
"member",
"shared",
"invited"
]
},
"role": {
"description": "Filter by role, e.g. owner, admin, member, it-admin, network-admin, billing-admin, auditor.",
"type": "string"
},
"status": {
"description": "Filter by user status.",
"type": "string",
"enum": [
"all",
"active",
"idle",
"suspended",
"needs-approval",
"over-billing-limit"
]
}
},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_user(userId)
Get a single user by id. Tailscale REST: GET /users/{userId}.
Input Schema
{
"type": "object",
"properties": {
"userId": {
"type": "string",
"description": "The user id."
}
},
"required": [
"userId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_list_webhooks
List the webhook endpoints configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/webhooks.
Input Schema
{
"type": "object",
"properties": {},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🟢tailscale_get_tailnet_settings
Get the tailnet's settings (device approval, key expiry, posture, etc.). Tailscale REST: GET /tailnet/{tailnet}/settings.
Input Schema
{
"type": "object",
"properties": {},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_authorize_device(deviceId, authorized)
Authorize or de-authorize a device (only relevant when device approval is enabled for the tailnet). Tailscale REST: POST /device/{deviceId}/authorized.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
},
"authorized": {
"type": "boolean",
"description": "True to authorize the device into the tailnet, false to de-authorize it."
}
},
"required": [
"deviceId",
"authorized"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_set_device_name(deviceId, name)
Set (rename) a device's name. Tailscale REST: POST /device/{deviceId}/name.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
},
"name": {
"type": "string",
"description": "The new device name."
}
},
"required": [
"deviceId",
"name"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_set_device_tags(deviceId, tags)
Set a device's ACL tags. REPLACES the device's existing tags. Tailscale REST: POST /device/{deviceId}/tags.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
},
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "ACL tags to apply, e.g. [\"tag:server\"]. REPLACES the device's existing tags."
}
},
"required": [
"deviceId",
"tags"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_expire_device_key(deviceId)
Expire a device's node key, forcing it to re-authenticate — a security response to a compromised or lost device. Tailscale REST: POST /device/{deviceId}/expire.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
}
},
"required": [
"deviceId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_set_device_routes(deviceId, routes)
Set the subnet routes ENABLED for a device (from the routes it advertises). REPLACES the enabled set. Tailscale REST: POST /device/{deviceId}/routes.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
},
"routes": {
"type": "array",
"items": {
"type": "string"
},
"description": "The set of subnet routes (CIDRs) to ENABLE for this device, e.g. [\"10.0.0.0/24\"]. REPLACES the enabled set."
}
},
"required": [
"deviceId",
"routes"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_create_auth_key(reusable, ephemeral, preauthorized, tags, expirySeconds, ...)
Create a new auth key for the tailnet (used to register new devices). Tailscale REST: POST /tailnet/{tailnet}/keys.
Input Schema
{
"type": "object",
"properties": {
"reusable": {
"description": "If true, the key can register multiple devices.",
"type": "boolean"
},
"ephemeral": {
"description": "If true, devices registered with this key are ephemeral (removed shortly after going offline).",
"type": "boolean"
},
"preauthorized": {
"description": "If true, devices registered with this key are pre-authorized (skip device approval).",
"type": "boolean"
},
"tags": {
"description": "ACL tags to apply to devices created with this key, e.g. [\"tag:ci\"].",
"type": "array",
"items": {
"type": "string"
}
},
"expirySeconds": {
"description": "Key lifetime in seconds; 0 means no expiry (if allowed by tailnet policy).",
"type": "number"
},
"description": {
"description": "A short description for the key.",
"type": "string"
}
},
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_delete_key(keyId)
Delete (revoke) an auth key or API access token by id — a security response. Tailscale REST: DELETE /tailnet/{tailnet}/keys/{keyId}.
Input Schema
{
"type": "object",
"properties": {
"keyId": {
"type": "string",
"description": "The key id to delete."
}
},
"required": [
"keyId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}🔴tailscale_delete_device(deviceId)
Delete a device, removing it from the tailnet. Tailscale REST: DELETE /device/{deviceId}.
Input Schema
{
"type": "object",
"properties": {
"deviceId": {
"type": "string",
"description": "The device id to delete."
}
},
"required": [
"deviceId"
],
"$schema": "https://json-schema.org/draft/2020-12/schema"
}Community
Evidence