How do I install the tailscale mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `TAILSCALE_API_KEY`, `TAILSCALE_PROFILE`, `TAILSCALE_TOOLS`, `TAILSCALE_READONLY`, `TAILSCALE_OAUTH_CLIENT_ID`, `TAILSCALE_OAUTH_CLIENT_SECRET` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Tailscale MCP Server

Tailscale MCP server for managing your tailnet from AI assistants

Remote serverstreamable-http

What is the Tailscale MCP Server?

Tailscale MCP server for managing your tailnet from AI assistants

The short version

One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.

Typed tool surface, not string parsing. — Every tool has a Zod-validated input schema and a structured response. No brittle tailscale status --json | jq pipelines that break when the schema evolves
Safe-by-default writes. — Every tool declares readOnlyHint / destructiveHint / idempotentHint so clients can skip confirmation on reads and require it on mutations. A skill that shells out to the CLI can't express that

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
tailscale_status	Verify API connection, see tailnet info and device count
tailscale_list_devices	List all devices with status, IPs, OS, and last seen
tailscale_get_device	Get detailed info for a specific device
tailscale_authorize_device	Authorize a pending device
tailscale_deauthorize_device	Deauthorize a device
tailscale_set_devices_authorized	Authorize/deauthorize many devices in one call (parallel, per-id error reporting)
tailscale_delete_device	Remove a device from the tailnet
tailscale_rename_device	Rename a device
tailscale_expire_device	Expire a device's key, forcing re-authentication
tailscale_get_device_routes	Get advertised and enabled subnet routes
tailscale_set_device_routes	Enable or disable subnet routes
tailscale_get_device_posture_attributes	Get all posture attributes for a device
tailscale_set_device_posture_attribute	Set a custom posture attribute (with optional expiry)
tailscale_delete_device_posture_attribute	Delete a custom posture attribute

Configuration

Variable	Description	Required
TAILSCALE_API_KEY	Credential the server authenticates with.	Yes
TAILSCALE_PROFILE	Configuration value read at startup.	Optional
TAILSCALE_TOOLS	Configuration value read at startup.	Optional
TAILSCALE_READONLY	Configuration value read at startup.	Optional
TAILSCALE_OAUTH_CLIENT_ID	Configuration value read at startup.	Optional
TAILSCALE_OAUTH_CLIENT_SECRET	Credential the server authenticates with.	Yes

Example prompts to try

“Use Tailscale to tailscale status.”
“Use Tailscale to tailscale list devices.”
“Use Tailscale to tailscale get device.”

Frequently asked questions

Tailscale MCP server for managing your tailnet from AI assistants Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.