Configure a service
addRegister a named proxy, file, or TCP service on your private Tailscale network, then configure access or publish it publicly via Funnel after confirmation.
Instructions
Setting funnel true on this tool publishes the service to the entire public internet, so ask the user before doing that; otherwise it writes a registry entry for a proxy, file, or TCP service reachable on the user's private Tailscale network. New gateway apps admit the owner/admins and explicit grants; existing installations retain their mode. Human allow recipients use membership verification and necessary device invitations; incomplete setup returns an error with saved progress. A recipient allowed here has no expiry unless for or until limits it (people_add defaults to 24h); a binding that expires gets a 24h default, never a permanent grant. Use this instead of share when the user wants a named, configured service rather than a one-shot share; it installs the background service when absent unless no_daemon_install is true. Installation announcements go to stderr. After setup it returns current URL/enrollment evidence without an additional URL wait; use url to poll pending endpoints.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"name": "<name>",
"type": "<type>"
},
"name": "add"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| dir | No | Absolute directory path for file. Rejected for proxy and tcp. | |
| for | No | Limit human allow recipients to this lifetime (descending unique units w,d,h,m,s,ms,us,ns) or until <RFC3339|YYYY-MM-DD|YYYY-MM-DDTHH:MM>. Local unless offset given; DST gaps/folds require an offset. Minimum 1h. Presets: 1h, 8h, 24h, 3d, 7d. Omitted: a recipient this call newly allows has no expiry and an existing grant keeps its deadline; a binding that expires or cannot create permanent grants gets 24h. Explicit never requires ack_never for members and device-invited guests; finite guest grants retain the configured maximum. | |
| name | Yes | Registry service name (DNS label). An existing entry with this name is replaced. | |
| tags | No | ACL tags applied to the tailnet node, each prefixed tag:. Defaults to the configured default tag. | |
| type | Yes | proxy forwards HTTP to target; file serves the directory dir; tcp forwards a raw stream to target. | |
| allow | No | Human recipients use the common access action: membership verification, app grants and necessary invitations. A recipient named here keeps access without an expiry unless for or until limits it (people_add defaults to 24h); an explicit never requires ack_never, and a binding that cannot create permanent grants gets the 24h default instead. tag: entries remain machine ACLs. New installations use the gateway; existing installs preserve their mode. Refused for TCP and public Funnel. | |
| until | No | Limit human allow recipients to this deadline; conflicts with for. | |
| funnel | No | Publish to the public internet through Tailscale Funnel. Requires type proxy, public_ack true, no allow entries, and no control_url. | |
| health | No | ||
| remote | No | HTTPS MagicDNS upstream in the gateway tailnet. Replaces target for type proxy and implies portal_only; requires an observed tagged gateway. | |
| target | No | host:port or URL for proxy, host:port for tcp. Rejected for file. The daemon will proxy to any address it can reach on its own network; link-local and cloud-metadata addresses are refused only as literal IP addresses (unspecified addresses too) or the metadata.google.internal hostname: hostnames are not resolved and nothing is checked at connect time, so a name that resolves to one of those addresses is accepted. | |
| ack_never | No | ||
| ephemeral | No | Register an ephemeral tailnet node that disappears on disconnect. | |
| funnel_ttl | No | Relative lifetime (descending unique units w,d,h,m,s,ms,us,ns) or until <RFC3339|YYYY-MM-DD|YYYY-MM-DDTHH:MM>. Local unless offset given; DST gaps/folds require an offset. Minimum 1h. Presets: 1h, 8h, 24h, 3d, 7d. Default 24h; guest/public maximum defaults to 7d, configurable in durations.public_max. Never refused. Omission on add preserves an existing deadline. | |
| public_ack | No | Explicit acknowledgement that funnel exposes the service publicly. funnel true without it is rejected. | |
| control_url | No | Per-service custom control server URL, for example a Headscale deployment. A custom control server never receives the stored Tailscale credential or an auth key minted with it: while a credential is stored the daemon does not start such a service (credential_control_url_mismatch), and without one the node enrolls interactively on that server. Rejected together with funnel. | |
| portal_only | No | Create no app node; assign a route on the enabled gateway. App becomes people-scoped. | |
| portal_port | No | Stable port for portal_only or remote. | |
| print_links | No | ||
| requestable | No | Disclose this private HTTP/file app in the portal request form; default off. | |
| preserve_host | No | Proxy only: forward this node's trusted canonical external name in Host and X-Forwarded-Host; fail closed if unavailable. Default false keeps upstream Host rewriting. | |
| request_limits | No | ||
| no_auto_provision | No | Disable automatic Funnel policy provisioning. Only valid with funnel true. | |
| no_daemon_install | No | Save configuration without installing the background service. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| name | Yes | ||
| next | No | ||
| type | Yes | ||
| access | No | ||
| created | Yes | True when this call created the registry entry; false when it replaced an existing entry with the same name. | |
| auth_url | No | ||
| endpoint | Yes | ||
| exposure | Yes | ||
| warnings | No | ||
| requestable | No | ||
| url_pending | Yes | ||
| preserve_host | No | Proxy only: forward this node's trusted canonical external name in Host and X-Forwarded-Host; fail closed if unavailable. Default false keeps upstream Host rewriting. | |
| daemon_running | No | ||
| funnel_rearmed | Yes | ||
| request_limits | No | ||
| replaced_fields | Yes | registry.json fields the replace changed or dropped, sorted; empty when created is true. add sets every field from this call, so a field not given again is dropped. | |
| daemon_installed | No | Present only when this call installed TSLink's background service, a persistent OS autostart entry; absent when the service already ran or no_daemon_install was true. | |
| funnel_expires_at | No |