Tailscale MCP server

tailscale-mcp

An MCP server for Tailscale. The node it runs on is driven through the tailscale command-line interface; the tailnet behind it is driven through the control-plane REST API.

186 tools, one per verb, with real parameters and honest annotations. Tailscale's own JSON comes back unmodified, so anything you learned from Tailscale's documentation still applies. When something fails you get a fixed error code and a hint, not a wall of standard error.

Both surfaces are optional and neither is fatal. No tailscale binary means the tools that drive this node are not offered; no control-plane credential means the tools that drive the tailnet are not. tailscale-mcp diagnose says which of the two this machine has.

On macOS that binary is the tailscale shim the Tailscale application installs into /usr/local/bin. The executable inside the application bundle is not a substitute and is not accepted as one: run outside a login shell it starts the GUI rather than answering, so the local tools would be offered and then fail on every call.

Install

Release archives are on the releases page with a SHA256SUMS beside them: macOS and Linux on x8664 and arm64, and Windows on x8664.

Point a client at it

tailscale-mcp setup claude-code

prints the snippet for your client — claude-code, claude-desktop, vscode, cursor or zed — and says where it goes. It writes nothing: the snippet is yours to paste, and it leaves the credential out, for the reason in the next section.

Installed through npm there is nothing to install first, and the client can carry the settings:

{
  "mcpServers": {
    "tailscale": {
      "command": "npx",
      "args": ["-y", "@tailscale-mcp/tailscale-mcp"],
      "env": {
        "TAILSCALE_MCP_ALLOW_WRITE": "true"
      }
    }
  }
}

That much is enough to start it. Without a credential it offers the tools that drive this node and hides the ones that act on the tailnet, and tailscale-mcp diagnose says which of the two you have.

Authenticate

setup prints no credential of its own, because the file it prints into is one people paste into issues and chats without rereading. Adding one is a separate, deliberate step. Two shapes go in the env block above — an API access token:

"env": {
  "TAILSCALE_API_KEY": "tskey-api-…",
  "TAILSCALE_MCP_ALLOW_WRITE": "true"
}

or an OAuth client:

"env": {
  "TAILSCALE_OAUTH_CLIENT_ID": "k123456CNTRL",
  "TAILSCALE_OAUTH_CLIENT_SECRET": "tskey-client-…",
  "TAILSCALE_MCP_ALLOW_WRITE": "true"
}

The credentials table has the other shapes, including the JWT file for federated identity. Every tool is offered with either of these: the choice is not about what you can do with the server, which is why it is worth making on other grounds.

Prefer the OAuth client for anything you keep. The reason is what a client configuration is: a file somebody writes once and then forgets, holding a secret for as long as the tool is installed.

Shortened. The full README is on GitHub.