manage_acl
Configure, validate, and retrieve Tailscale Access Control Lists (ACLs) to define network permissions, manage user groups, and assign tag ownership via structured operations.
Instructions
Manage Tailscale Access Control Lists (ACLs)
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| aclConfig | No | ACL configuration (required for update/validate operations) | |
| operation | Yes | ACL operation to perform |
Implementation Reference
- src/tools/acl-tools.ts:125-191 (handler)The main handler function for the manage_acl tool. Handles ACL operations: get, update, validate using Tailscale API.
async function manageACL( args: z.infer<typeof ACLSchema>, context: ToolContext, ): Promise<CallToolResult> { try { logger.debug("Managing ACL configuration:", args); switch (args.operation) { case "get": { const result = await context.api.getACL(); if (!result.success) { return returnToolError(result.error); } return returnToolSuccess( `Current ACL configuration:\n\n${ typeof result.data === "string" ? result.data : JSON.stringify(result.data, null, 2) }`, ); } case "update": { if (!args.aclConfig) { return returnToolError( "ACL configuration is required for update operation", ); } const aclString = JSON.stringify(args.aclConfig, null, 2); const result = await context.api.updateACL(aclString); if (!result.success) { return returnToolError(result.error); } return returnToolSuccess("ACL configuration updated successfully"); } case "validate": { if (!args.aclConfig) { return returnToolError( "ACL configuration is required for validation", ); } const aclString = JSON.stringify(args.aclConfig, null, 2); const result = await context.api.validateACL(aclString); if (!result.success) { return returnToolError(result.error); } return returnToolSuccess("ACL configuration is valid"); } default: return returnToolError( "Invalid ACL operation. Use: get, update, or validate", ); } } catch (error) { logger.error("Error managing ACL:", error); return returnToolError(error); } } - src/tools/acl-tools.ts:8-35 (schema)Zod input schema for the manage_acl tool, defining operation (get/update/validate) and optional aclConfig with acls, groups, tagOwners.
const ACLSchema = z.object({ operation: z .enum(["get", "update", "validate"]) .describe("ACL operation to perform"), aclConfig: z .object({ acls: z .array( z.object({ action: z.enum(["accept", "drop"]), src: z.array(z.string()), dst: z.array(z.string()), }), ) .optional() .describe("Access control rules"), groups: z .record(z.string(), z.array(z.string())) .optional() .describe("User groups definition"), tagOwners: z .record(z.string(), z.array(z.string())) .optional() .describe("Tag ownership mapping"), }) .optional() .describe("ACL configuration (required for update/validate operations)"), }); - src/tools/acl-tools.ts:519-523 (registration)Registration of the manage_acl tool within the aclTools ToolModule export.
name: "manage_acl", description: "Manage Tailscale Access Control Lists (ACLs)", inputSchema: ACLSchema, handler: manageACL, },