A Model Context Protocol (MCP) server that provides seamless integration with Tailscale's CLI commands and REST API, enabling automated network
A Model Context Protocol (MCP) server that provides seamless integration with Tailscale's CLI commands and REST API, enabling automated network management and
A Model Context Protocol (MCP) server for operating Tailscale from any MCP client. Supports local stdio for desktop clients and an authenticated HTTP transport for private tailnet deployments. Defaults to read-only access, localhost binding, and short-lived OAuth credentials where available.
One of: - Node.js 20+ — run via npx or install globally (no extra runtime needed). - Bun 1.3+ — used for development; also works as a production runtime. - Docker — use the pre-built image (no local runtime required). Plus one auth method: - OAuth client credentials: TAILSCALE_OAUTH_CLIENT_ID + TAILSCALE_OAUTH_CLIENT_SECRET (preferred). - Legacy API key: TAILSCALE_API_KEY. The
Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| list_devices | List all devices in the configured tailnet |
| device_action | Authorize or expire a device key (write); deauthorize or delete (admin) |
| manage_routes | Enable or disable advertised routes for a device |
| get_network_status | Get current Tailscale network status via local CLI |
| connect_network | Connect this host to Tailscale with optional CLI flags |
| disconnect_network | Disconnect this host from Tailscale |
| ping_peer | Ping a Tailscale peer through the local CLI |
| get_version | Get local Tailscale CLI version information |
| get_tailnet_info | Get detailed information about the configured tailnet |
| manage_file_sharing | Read (read) or update (write) tailnet file sharing settings |
| manage_exit_nodes | List exit nodes (read); set, clear, advertise, or stop advertising (admin) |
| manage_webhooks | List webhooks (read); create, delete, or test webhooks (write) |
| manage_device_tags | Read (read) or update (write) tags for a device |
| get_version_info | Return server version identifier |
| manage_acl | Read (read), validate, or update (write) the tailnet ACL policy |
| manage_dns | Read (read) or update (write) Tailscale DNS settings |
| manage_keys | List auth keys (read); create or delete (admin) |
| manage_policy_file | Read (read) or update (write) the tailnet policy file |
| manage_network_lock | Network lock status (read) and mutation operations (admin) |
{
"mcpServers": {
"tailscale": {
"command": "npx",
"args": [
"-y",
"@hexsleeves/tailscale-mcp-server"
],
"env": {
"TAILSCALE_OAUTH_CLIENT_ID": "your-client-id",
"TAILSCALE_OAUTH_CLIENT_SECRET": "YOUR_TAILSCALE_OAUTH_CLIENT_SECRET",
"TAILSCALE_TAILNET": "-"
}
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
One of: - Node.js 20+ — run via npx or install globally (no extra runtime needed). - Bun 1.3+ — used for development; also works as a production runtime. - Docker — use the pre-built image (no local runtime required). Plus one auth method: - OAuth client credentials: TAILSCALE_OAUTH_CLIENT_ID + TAILSCALE_OAUTH_CLIENT_SECRET (preferred). - Legacy API key: TAILSCALE_API_KEY. The
| Variable | Description | Required |
|---|---|---|
| TAILSCALE_OAUTH_CLIENT_ID | Declared in the maintainer’s client configuration. | Check documentation |
| TAILSCALE_OAUTH_CLIENT_SECRET | Declared in the maintainer’s client configuration. | Yes |
| TAILSCALE_TAILNET | Declared in the maintainer’s client configuration. | Check documentation |
Give your coding agent the full DevTools toolbox: traces, network, console, heap snapshots and Lighthouse.
Workers, KV, R2 and D1 by conversation — Cloudflare's official remote servers for building and observability.
Check updown.io uptime checks, downtimes, response metrics and status pages, and create checks.
Enables real-time WebSocket monitoring of all MCP interactions for enhanced debugging and observation.
If your AI answers from memory instead of using the tool, try: "Use the check_endpoint MCP tool right now with url=https://example.com"
Public PulseWatch offers and monitoring guides. No private customer data or monitor controls.