Share a local app, file or folder
shareExpose a local file, directory, or HTTP port over Tailscale for access from other devices; optionally publish publicly through Funnel with explicit acknowledgement and time limits.
Instructions
Setting funnel true on this tool publishes the target to the entire public internet, so ask the user before doing that; with funnel false (the default) it exposes a local directory, one file, or an HTTP port only on the user's private Tailscale network. A directory target serves every file under it and is browsable; a regular-file target serves only that file and answers 404 for its siblings. New gateway apps admit the owner/admins and explicit grants; existing installations retain their mode. Human allow recipients use membership verification and necessary device invitations; incomplete setup returns an error with saved progress. A recipient allowed here has no expiry unless for or until limits it (people_add defaults to 24h); a binding that expires gets a 24h default, never a permanent grant. Use this after creating a local page or report that the user wants to open on another tailnet device. If status is needs_login, open auth_url in a browser and retry after authorization.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"target": "<target>"
},
"name": "share"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| for | No | Limit human allow recipients to this lifetime (descending unique units w,d,h,m,s,ms,us,ns) or until <RFC3339|YYYY-MM-DD|YYYY-MM-DDTHH:MM>. Local unless offset given; DST gaps/folds require an offset. Minimum 1h. Presets: 1h, 8h, 24h, 3d, 7d. Omitted: a recipient this call newly allows has no expiry and an existing grant keeps its deadline; a binding that expires or cannot create permanent grants gets 24h. Explicit never requires ack_never for members and device-invited guests; finite guest grants retain the configured maximum. | |
| name | No | Optional requested DNS-label service name. A matching target is reused only if it already has this name; unrelated name collisions receive a numeric suffix. | |
| tags | No | ACL tags applied to the tailnet node, each prefixed tag:. Defaults to the configured default tag. | |
| allow | No | Human recipients use the common access action: membership verification, app grants and necessary invitations. A recipient named here keeps access without an expiry unless for or until limits it (people_add defaults to 24h); an explicit never requires ack_never, and a binding that cannot create permanent grants gets the 24h default instead. tag: entries remain machine ACLs. New installations use the gateway; existing installs preserve their mode. Refused for TCP and public Funnel. | |
| until | No | Limit human allow recipients to this deadline; conflicts with for. | |
| funnel | No | Publish to the public internet through Tailscale Funnel. Requires public_ack true, an HTTP port target, and no allow entries. | |
| target | Yes | Existing file or directory path, bare port from 1 to 65535, or host:port HTTP target. A file path shares that one file; a directory path shares everything under it. The daemon will proxy to any address it can reach on its own network; link-local and cloud-metadata addresses are refused only as literal IP addresses (unspecified addresses too) or the metadata.google.internal hostname: hostnames are not resolved and nothing is checked at connect time, so a name that resolves to one of those addresses is accepted. | |
| ack_never | No | ||
| ephemeral | No | Keep true for temporary shares; set false only when the user wants durable tailnet node state. | |
| funnel_ttl | No | Relative lifetime (descending unique units w,d,h,m,s,ms,us,ns) or until <RFC3339|YYYY-MM-DD|YYYY-MM-DDTHH:MM>. Local unless offset given; DST gaps/folds require an offset. Minimum 1h. Presets: 1h, 8h, 24h, 3d, 7d. Default 24h; guest/public maximum defaults to 7d, configurable in durations.public_max. Never refused. Omission on add preserves an existing deadline. | |
| public_ack | No | Explicit acknowledgement that funnel exposes the target publicly. funnel true without it is rejected. | |
| print_links | No | ||
| preserve_host | No | Proxy only: forward this node's trusted canonical external name in Host and X-Forwarded-Host; fail closed if unavailable. Default false keeps upstream Host rewriting. | |
| request_limits | No | ||
| no_daemon_install | No | Require an already running TSLink service; do not automatically install its background service. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| name | Yes | Actually registered service name, always present on success, including needs_login. Use this name for url and unshare; never guess or fall back to the requested name. | |
| access | No | ||
| status | Yes | ||
| auth_url | No | ||
| exposure | Yes | ||
| warnings | No | ||
| preserve_host | No | Proxy only: forward this node's trusted canonical external name in Host and X-Forwarded-Host; fail closed if unavailable. Default false keeps upstream Host rewriting. | |
| funnel_rearmed | No | True when the reused share's Funnel deadline had already passed and this call re-armed it with the requested funnel_ttl. | |
| request_limits | No | ||
| daemon_installed | No | Present only when this call installed TSLink's background service, a persistent OS autostart entry; absent when the service already ran or no_daemon_install was true. | |
| funnel_expires_at | No | When the public Funnel of this share stops. Absent when exposure.kind is not public_funnel, and absent for a public_funnel share that never expires. A reused share keeps its own deadline, which can be sooner than the funnel_ttl this call asked for. |