tailscale-mcp-server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| TS_LOCAL_API | No | Reserved for the optional LocalAPI fast path (Phase 3). | 0 |
| TAILSCALE_API_KEY | No | Legacy static API access token (inherits the creator's full role). | |
| TAILSCALE_TAILNET | No | Tailnet for REST calls; - = the credential's own tailnet. | - |
| TAILSCALE_CLI_PATH | No | Path to tailscale/tailscale.exe if not in the default location or PATH. | |
| TAILSCALE_LOG_LEVEL | No | debug / info / warn / error (stderr only). | info |
| TAILSCALE_RISK_LEVEL | No | read (read-only), write (adds connect/disconnect/set), admin (adds destructive tools). | write |
| TAILSCALE_API_BASE_URL | No | Override (https or loopback only). | https://api.tailscale.com |
| TAILSCALE_AUTH_KEY_FILE | No | Path to a file holding a tailnet auth key for headless first-login (passed as file:<path>; never in argv). | |
| TAILSCALE_OAUTH_CLIENT_ID | No | Preferred REST credentials (OAuth client-credentials). Both or neither. | |
| TAILSCALE_OAUTH_CLIENT_SECRET | No | Preferred REST credentials (OAuth client-credentials). Both or neither. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
| prompts | {
"listChanged": true
} |
| resources | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| tailscale_statusA | Report this host's Tailscale connection state, read from Returns a normalized |
| tailscale_get_prefsA | Return this host's current effective Tailscale preferences via |
| tailscale_connectA | Bring this host online on its tailnet ( If already Running, returns immediately; if Stopped with a valid key, runs a flag-free |
| tailscale_disconnectA | Disconnect this host ( |
| tailscale_list_exit_nodesA | List tailnet nodes advertising as exit nodes ( |
| tailscale_pingB | Ping a peer at the Tailscale layer ( |
| tailscale_netcheckA | Analyze local network conditions ( |
| tailscale_versionA | Report client and daemon versions ( |
| tailscale_whoisA | Show the machine and user associated with a Tailscale IP ( |
| tailscale_whoamiB | Show the machine + user identity of this node ( |
| tailscale_dns_statusA | Report the internal DNS forwarder (100.100.100.100) / MagicDNS configuration: resolvers, split-DNS, cert domains ( |
| tailscale_get_syspolicyA | List the effective LOCAL system policy applied to Tailscale on this host (MDM/GPO/registry) via |
| tailscale_list_profilesA | List the Tailscale account/login profiles on this machine ( |
| tailscale_set_prefsA | Incrementally change one or more preferences via |
| tailscale_set_exit_nodeA | Route this host's internet traffic through a tailnet exit node ( |
| tailscale_set_routesA | Advertise subnet routes from this host and/or toggle accepting routes advertised by others ( |
| tailscale_switch_profileA | Switch the active Tailscale account/login profile on this machine ( |
| tailscale_server_infoA | Report this MCP server's version, live backends (CLI path, whether REST credentials are configured), the effective tailnet, the risk level, and a catalog of every tool: whether each is available now or, if not, WHY (risk_gated — raise TAILSCALE_RISK_LEVEL; or needs_credentials — set TAILSCALE_OAUTH_* / TAILSCALE_API_KEY). Use this when a tool you expected is missing. Read-only. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| diagnose_connectivity | Guide a step-by-step diagnosis of this host's Tailscale connectivity. |
| review_acl_change | Safely propose and apply a tailnet ACL policy change using validate + ETag concurrency. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
| tailscale-status | Normalized connection state of this host. |
| tailscale-prefs | Current effective preferences. |
TDQS
Scored across 18 tools
Each tool has a clearly distinct purpose: get/set pairs are separated (get_prefs vs set_prefs), exit-node selection (set_exit_node) is split from listing (list_exit_nodes), and set_prefs explicitly excludes exit-node/routes which have dedicated tools. The only near-overlap is whoami (this node's identity) vs whois (identity for an IP), but the descriptions disambiguate them cleanly.
Every tool uses the tailscale_ prefix with a predictable verb_noun or command-name pattern (list_profiles, set_prefs, get_prefs, set_exit_node, list_exit_nodes, dns_status). The few noun-only names (status, ping, netcheck, version, whoami) mirror the underlying CLI commands, so the convention remains consistent and readable.
18 tools is within a reasonable range and each one maps to a distinct CLI capability (status, prefs, exit nodes, routes, DNS, netcheck, ping, profile switching). It is slightly on the heavy side, but the broad surface of Tailscale's CLI justifies the count.
Strong lifecycle coverage: connect/disconnect, prefs get/set, exit-node and route management, profiles, syspolicy, DNS, netcheck, ping, whois. Minor gaps include the absence of a logout tool (explicitly referenced in tailscale_disconnect's description) and no serve/funnel or file-transfer operations.