Report the state of the local tailnet: this node plus all peers with hostname, MagicDNS name, Tailscale IPv4/IPv6, OS, online flag, last seen, exit-node flags, and tags. Returns a structured error with the exact fix command when the tailscale binary is missing, the daemon is stopped, or the device needs login.

Generate ssh-config Host blocks for tailnet nodes (MagicDNS name preferred, Tailscale IP fallback). Dry-run by default: returns the generated config text only and writes nothing. With write=true it writes a dedicated file (~/.ssh/tailscale_dev_config) and returns instructions for adding an Include line to ~/.ssh/config (never applied automatically). Direct editing of ~/.ssh/config itself additionally requires target="user_ssh_config" and is idempotent between managed markers, never touching content outside them.

Report the active Tailscale Serve/Funnel sessions on this node: one entry per endpoint with its URL, serve port, mount path, proxied target, and a public flag that is true when Funnel exposes it to the open internet. publicExposure is true when anything is public.

Share a local port over the tailnet via Tailscale Serve (tailnet-only by default). WARNING: setting public=true switches to Funnel and exposes the port to the OPEN INTERNET — anyone with the URL can reach it. Only set public=true when internet exposure is explicitly intended. Funnel is DISABLED on this server: public=true returns FUNNEL_DISABLED unless the user sets TAILSCALE_MCP_ALLOW_FUNNEL=1. Returns the resulting URL(s).

Stop Serve/Funnel shares: one mount, the shares this server created, or all of them, reporting what was removed. Name exactly one target: httpsPort and/or path turns off that one mount (httpsPort is the serve port shown in share_status, typically 443, not the proxied local port; path is the mount path given to share_port, default "/"); mine=true stops only the shares this server created in this session; all=true clears the entire serve/funnel configuration, including shares set up outside this server. With no arguments nothing is stopped and the active endpoints are listed. Returns what was removed and what remains.

Ping tailnet peers concurrently (bounded to 5 at a time, with a per-ping timeout) and return a latency matrix: node, latency ms of the settled path, path (direct, DERP relay, or peer relay), or unreachable. Defaults to online peers only. The whole call is capped at 45s; peers not answered by then are reported with an error and timedOut is true.