@yawlabs/tailscale-mcp
This MCP server provides a comprehensive interface to manage and monitor your Tailscale tailnet via the v2 Admin API, offering 89 tools (+4 optional local CLI diagnostics). You can:
Manage Devices: List, get, authorize/deauthorize (individually or bulk), rename, delete, expire keys, configure key expiry, set/delete subnet routes and posture attributes (custom and batch), assign ACL tags and IPv4 addresses.
Administer ACLs & Policies: Get, update (with ETag for safe concurrent edits), validate, and preview ACL rules, preserving HuJSON formatting.
Configure DNS: Manage nameservers, search paths, split DNS, MagicDNS preferences, and unified DNS settings, with partial split-DNS updates.
Handle Keys & Trust: Create/list/update/delete auth keys (reusable/ephemeral), OAuth clients, and federated identities.
Manage Users: List, get, approve, suspend, restore, update roles, delete users, filter by role/type.
Set Tailnet‑wide Parameters: Control device/user approval, HTTPS certs, auto‑updates, key duration, network flow logging, regional routing, posture collection, external ACL management, and contacts (with verification).
Integrate Webhooks: CRUD for webhooks, rotate secrets, send test events.
Integrate Posture Providers: Manage integrations with Falcon, Intune, Jamf Pro, Kandji, and others.
Manage Tailscale Services: CRUD for services, list hosts, approve/reject devices for hosting.
Stream Logs: Configure audit/network log streaming to Axiom, Datadog, Splunk, Elasticsearch, S3; manage AWS external IDs and trust policies; check delivery status.
Handle Invites: Create, list, get, delete, accept, and resend device and user invitations.
Retrieve Logs: Access configuration audit logs and network traffic flow logs.
Run Local Diagnostics (opt‑in): Execute
tailscale status,ping,netcheck, and version checks on the host running the server.Browse Resources: Read‑only views of tailnet status, devices, ACL policy, and DNS configuration.
Support CI/CD: Validate and deploy ACLs from Git repositories with ETag safety to avoid concurrent edit conflicts.
Customize & Harden: Filter tools by profile or explicit list, restrict to read‑only operations, and rely on built‑in retries, concurrent request capping, and request budget controls for robustness.
Integrates with the Tailscale v2 API to manage a tailnet, including tools for devices, ACLs, DNS, keys, users, webhooks, audit logs, and other administrative functions.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@@yawlabs/tailscale-mcplist devices that haven't checked in for 30 days"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@yawlabs/tailscale-mcp
Ask your agent questions about your tailnet and have it act on the answers. 96 admin-API tools + 6 optional local-CLI diagnostics + 4 resources spanning the Tailscale v2 API — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
Built and maintained by Yaw Labs.
One click adds this to your local Yaw MCP config so it's available in every Yaw Terminal session. Or install manually below.
What's the point if the API already exists?
You could curl the Tailscale API. The point isn't replacing curl — it's letting an agent compose multi-endpoint workflows in one turn without writing a script:
"Which devices haven't checked in for 30 days and have key expiry disabled?" — lists devices, filters by
lastSeen, filters bykeyExpiryDisabled, returns a table. Three endpoints, one question."Someone broke DNS at 2am — who changed what in the last 24 hours?" — pulls the audit log, filters by DNS-related actors and endpoints, reads each change's before/after, summarizes in English.
"Draft an ACL change that lets
tag:mobilereachtag:dashboardbut nottag:db, preserving my comments" — reads the current HuJSON, proposes a minimal diff, validates it against the API, returns the diff for you to apply."Rotate every auth key older than 90 days and print the new ones" — iterates, creates new keys with matching tags, revokes the old ones.
"Create an OAuth client for our CI pipeline scoped to
devices:readanddns" — creates a trust credential viatailscale_create_keywithkeyType=client, returns the credentials once (save them immediately).
A curl can do each step. The agent composes them. That's where the lift is, and that's what the tool surface is designed for — every read endpoint is first-class so the agent can synthesize, and every write endpoint is tagged destructiveHint or idempotentHint so your MCP client can gate mutations the way you configured it.
If all you need is one endpoint in a CI job, use curl — we even have a CLI subcommand for the common ACL-from-git case. The MCP is for the interactive, exploratory, "I don't know what I need yet" work.
Related MCP server: mcp-tailscale
Why MCP vs. a skill or the tailscale CLI?
Reasonable question. Both have their place. Where this MCP is better:
Broad admin API coverage. The
tailscaleCLI is scoped to the node it runs on. Admin concerns — ACLs, users, invites, webhooks, log streaming, posture integrations, auth keys, OAuth clients, and federated identities — live in the v2 HTTP API. You'd be shelling out tocurlanyway.Typed tool surface, not string parsing. Every tool has a Zod-validated input schema and a structured response. No brittle
tailscale status --json | jqpipelines that break when the schema evolves.Cross-client, no user rewriting. A Claude Code skill only loads in Claude Code. An MCP server works in Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, and anything else that speaks MCP. Version bumps ship through
npx— users don't re-author their skill when Tailscale adds an endpoint.Safe-by-default writes. Every tool declares
readOnlyHint/destructiveHint/idempotentHintso clients can skip confirmation on reads and require it on mutations. A skill that shells out to the CLI can't express that.Real tests. 700+ unit tests covering every tool's input validation, API shape, and error handling. Plus an opt-in live-tailnet integration suite (
RUN_INTEGRATION_TESTS=1+ a tailnet API key) for shape-drift detection. Most skills are short markdown prompts without their own test layer — if the vendor changes output format, nothing catches it for you.
If you already have a skill that covers your 10% of Tailscale workflows, great — keep it. The MCP is for the other 90%.
Trust signals
Fair critique from Reddit: a new repo claiming "actively maintained" with no visible tests is worth exactly zero trust. Here's what's actually verifiable:
700+ tests (
node --test) covering every tool's input validation, API shape, and error handling. Runnpm testto see them pass locally.Local release flow via
release.sh: lint + test + bump + tag + push + npm publish + MCP Registry publish, all from the workstation. No CI workflow to babysit.Dependabot alerts surface on this repo and get fixed, not ignored.
Every tool verified against the live API. If it's in the tool list, it calls a real endpoint that exists in the current v2 API. No placeholder 404 tools.
Issues and PRs are triaged. File one if something is off — github.com/YawLabs/tailscale-mcp/issues.
Quick start
1. Set your API key
Get an API key from Tailscale Admin Console > Settings > Keys and add it to your shell profile (~/.bashrc, ~/.zshrc, or Windows system environment variables):
export TAILSCALE_API_KEY="tskey-api-..."2. Create .mcp.json in your project root
macOS / Linux / WSL:
{
"mcpServers": {
"tailscale": {
"command": "npx",
"args": ["-y", "@yawlabs/tailscale-mcp@latest"]
}
}
}Windows:
{
"mcpServers": {
"tailscale": {
"command": "cmd",
"args": ["/c", "npx", "-y", "@yawlabs/tailscale-mcp@latest"]
}
}
}Why the extra step on Windows? On Windows,
npxis a.cmdfile, and Node 20+ refuses to spawn.cmdfiles directly. Wrapping withcmd /cis the standard workaround.
3. Restart and approve
Restart Claude Code (or your MCP client) and approve the Tailscale MCP server when prompted.
That's it. Now ask your agent:
"List my Tailscale devices that haven't been seen in the last 7 days"
"Summarize every ACL change in the audit log from yesterday"
"Draft an ACL rule that lets
tag:cireachtag:registryon port 5000 only"
Too many tools? Subset them.
96 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
Option 1: TAILSCALE_PROFILE (preset, easiest)
{
"env": {
"TAILSCALE_API_KEY": "tskey-api-...",
"TAILSCALE_PROFILE": "core"
}
}minimal(20 tools) —status,devices,audit. Observe the tailnet, read the audit log.core(51 tools) — addsacl,dns,keys,users. The day-to-day admin surface.full(96 tools, default) — everything. Same as omitting the env var.
Option 2: TAILSCALE_TOOLS (explicit group list)
{
"env": {
"TAILSCALE_API_KEY": "tskey-api-...",
"TAILSCALE_TOOLS": "devices,acl,dns,audit"
}
}Comma-separated group names. Overrides TAILSCALE_PROFILE when both are set — use this when the presets aren't quite right.
Valid group names: status, devices, acl, dns, keys, users, tailnet, webhooks, posture, audit, invites, services, log-streaming. The local-cli group is also available, but only when TAILSCALE_LOCAL_CLI=1 is set — see Local CLI integration.
Option 3: TAILSCALE_READONLY (drop mutations)
{
"env": {
"TAILSCALE_API_KEY": "tskey-api-...",
"TAILSCALE_PROFILE": "core",
"TAILSCALE_READONLY": "1"
}
}Set to 1 or true to drop every tool without readOnlyHint: true. Stacks with TAILSCALE_PROFILE or TAILSCALE_TOOLS as an intersection — combine for maximum minimalism.
Confirming what loaded
The server logs the active filter to stderr on startup:
@yawlabs/tailscale-mcp v0.12.0 ready (20 tools, profile=minimal, readonly)When both TAILSCALE_PROFILE and TAILSCALE_TOOLS are set, TAILSCALE_TOOLS wins. The banner marks the profile as overridden so the precedence is obvious at a glance — no need to guess which filter actually applied:
@yawlabs/tailscale-mcp v0.12.0 ready (21 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)The "(overridden)" marker only fires for substantive profiles (minimal / core); profile=full is a no-op preset, so it's shown without the marker when TAILSCALE_TOOLS is also set.
If you don't set any filter, startup prints a tip pointing you at the profiles.
Using with mcp.hosting / mcph
If you run this server through mcp.hosting (via the @yawlabs/mcph local agent), the two filtering layers compose cleanly:
Server-side —
TAILSCALE_PROFILE/TAILSCALE_TOOLS/TAILSCALE_READONLYreduce the tool surface before mcph sees it. The unloaded tools aren't registered at all.Client-side — mcph's
mcp_connect_activate({ tools: [...] })filters further for what appears intools/list. Tools not in that list stay reachable viamcp_connect_dispatch, so you don't lose capability.
Recommended pattern for mcph users: set TAILSCALE_PROFILE=core (or narrower) in your mcp.hosting server config, then let mcph handle per-conversation activation on top. The server stays lean by default, and mcp_connect_dispatch covers the long-tail tools for ad-hoc needs.
Authentication
API key (simplest): Set TAILSCALE_API_KEY in your shell or MCP config.
OAuth (scoped access): For fine-grained permissions, set TAILSCALE_OAUTH_CLIENT_ID and TAILSCALE_OAUTH_CLIENT_SECRET instead. Create an OAuth client at Tailscale Admin Console > Settings > OAuth.
The server checks for an API key first, then falls back to OAuth. If neither is set, tools return a clear error telling you what to configure — the server still starts, so your MCP client doesn't loop restarting.
Tailnet: Uses your default tailnet automatically. Set TAILSCALE_TAILNET to specify one explicitly.
TAILSCALE_OAUTH_TAILNET — target an API-only tailnet (one created by tailscale_create_org_tailnet). Those tailnets are not reachable with a plain client-credentials exchange: you authenticate with an OAuth client belonging to the creating tailnet (all scope) and the target rides on the token request. Set this to the new tailnet's id. Deliberately separate from TAILSCALE_TAILNET so the default token exchange is unchanged for everyone else. If you set this, leave TAILSCALE_TAILNET unset (or -) so tool requests follow the token — pointing the two at different tailnets makes every tailnet-scoped tool return 403, and the server warns about it at startup.
Reliability and debugging
429 retry (built-in). API responses with HTTP 429 are retried up to 3 times, honoring the Retry-After header (both seconds-integer and HTTP-date forms). Falls back to exponential backoff with jitter, capped at 30s per wait. No env var needed — this is on by default. Workflows like "rotate every key older than 90 days" no longer fail mid-loop on Tailscale's per-tenant rate limits.
TAILSCALE_DEBUG=1 — log every HTTP method, URL, status, and elapsed time to stderr. Authorization headers are never logged. Use this when a tool returns an unexpected error and you want to see the actual request that went out. Example:
[tailscale-mcp] GET https://api.tailscale.com/api/v2/tailnet/-/devices
[tailscale-mcp] <- 200 (148ms)TAILSCALE_MAX_CONCURRENT=N — cap in-flight API requests at N. Default is unlimited (no behavior change for users who don't opt in). Useful when an agent fans out aggressively against a tailnet that has stricter limits than the per-call retry can absorb.
TAILSCALE_REQUEST_BUDGET_MS=N — total wall-clock budget per request, including 429 retries and their sleeps. Default 90000 (90s). When the next retry's predicted wall time would exceed the budget, the call surfaces the 429 immediately instead of holding the line. Tune lower if your MCP client has a tighter outer timeout. 429s on non-idempotent methods (POST, PATCH) are never retried — those return immediately regardless of budget.
TAILSCALE_RETRY_BASE_DELAY_MS=N — base delay for the exponential backoff between retries; attempt N waits base * 2^N (capped at 30s, plus jitter). Default 1000 (1s), so a fully-exhausted retry chain spends roughly 1s + 2s + 4s sleeping. Pairs with TAILSCALE_REQUEST_BUDGET_MS: lowering the budget on its own doesn't get you more retries, it just makes the default backoff exhaust the budget sooner and give up. Shrink both if you want "retry hard, fail fast". A server-supplied Retry-After header always wins over this value.
TAILSCALE_EXTRA_WEBHOOK_EVENTS=eventA,eventB — opt-in escape hatch for webhook event types Tailscale ships after the latest release of this package. The webhook tools validate subscriptions against a strict static catalog so typos and stale event names fail fast with a clear error; if you need a brand-new event before the catalog catches up, list it here (comma-separated) and the schema will accept it. Please also open an issue so the static list catches up.
TAILSCALE_EXTRA_POSTURE_PROVIDERS=providerA,providerB — the same escape hatch for device-posture integration providers. tailscale_create_posture_integration validates provider against a static list (falcon, fleet, huntress, intune, jamfpro, kandji, kolide, sentinelone); if Tailscale adds one before this package catches up, list it here rather than waiting for a release. This field used to be a closed enum, which made a newly-supported provider uncreatable rather than merely unvalidated.
Friendlier error messages. JSON error bodies of the form {"message":"..."} or {"error":"..."} are unwrapped before display, so you see the prose explanation instead of raw JSON. 401s still get the full multi-line auth-error formatter (with the Windows env-var hint when applicable).
Local CLI integration (opt-in)
Most tools talk to the Tailscale v2 admin API — they describe the tailnet. Sometimes you want to ask about this machine's view: is it actually connected? What DERP region is it on? How far is my-laptop from here? Those answers come from the local tailscale binary, not the admin API.
Set TAILSCALE_LOCAL_CLI=1 (in your shell or .mcp.json env block) to add six read-only diagnostic tools:
Tool | Equivalent CLI command | Use it for |
|
| This machine's connection state + peers it can see |
|
| Latency probe to another tailnet node (direct vs DERP-relayed) |
|
| NAT type, DERP latency map, IPv4/IPv6 support |
|
| Which client version is actually running |
Requirements: the tailscale binary must be in PATH. If it's installed somewhere unusual, set TAILSCALE_BINARY to its absolute path. The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (tailscale up, set --advertise-routes, lock sign) are deliberately not exposed.
When opt-in is on, the startup banner reflects it: @yawlabs/tailscale-mcp v0.13.3 ready (102 tools, local-cli=on) — the 6 local CLI tools are additive on top of the default 96.
Resources (4)
MCP Resources expose read-only data clients can browse without a tool call.
Resource | URI | Description |
Tailnet Status |
| Device count and tailnet settings |
Devices |
| All devices with status and IPs |
ACL Policy |
| Full ACL policy (HuJSON preserved) |
DNS Config |
| Nameservers, search paths, split DNS, MagicDNS |
Tools (96 + 6 opt-in)
Tool | Description |
| Verify API connection, see tailnet info and device count |
Tool | Description |
| List all devices with status, IPs, OS, and last seen |
| Get detailed info for a specific device |
| Authorize a pending device |
| Deauthorize a device |
| Authorize/deauthorize many devices in one call (parallel, per-id error reporting) |
| Remove a device from the tailnet |
| Rename a device |
| Expire a device's key, forcing re-authentication |
| Get advertised and enabled subnet routes |
| Enable or disable subnet routes |
| Get all posture attributes for a device |
| Set a custom posture attribute (with optional expiry) |
| Delete a custom posture attribute |
| Set ACL tags on a device |
| Set a device's Tailscale IPv4 address |
| Update device key settings (e.g. disable key expiry) |
| Batch update custom posture attributes across devices |
Tool | Description |
| Get ACL policy with formatting preserved (HuJSON) + ETag |
| Update ACL policy (requires ETag for safe concurrent edits) |
| Validate a policy without applying it |
| Preview rules that would apply to a user or IP |
Tool | Description |
| Get DNS nameservers |
| Set DNS nameservers |
| Get DNS search paths |
| Set DNS search paths |
| Get split DNS configuration |
| Set split DNS configuration (full replace) |
| Update split DNS configuration (partial merge) |
| Get DNS preferences (MagicDNS) |
| Set DNS preferences (MagicDNS) |
| Get unified DNS configuration (all settings in one call) |
| Set unified DNS configuration (all settings in one call) |
Tool | Description |
| List keys (auth keys; pass |
| Get details for a key |
| Create an auth key, OAuth client ( |
| Delete a key |
| Update a key's description, scopes, tags, or federated claim settings |
| Create an OAuth App for third-party device provisioning (Tailscale alpha) |
| Get an OAuth App's name, redirect URIs, and scopes |
| List every OAuth App registered in the tailnet |
| Delete an OAuth App, revoking its ability to provision devices |
Tool | Description |
| List all users in the tailnet |
| Get details for a specific user |
| Approve a pending user |
| Suspend a user, revoking access |
| Restore a suspended user |
| Update a user's role (owner, admin, member, etc.) |
| Delete a user and all their devices |
Tool | Description |
| Get tailnet settings (HTTPS, device approval, key expiry, etc.) |
| Update tailnet settings (HTTPS certificates, approval, auto-updates, key expiry, posture, regional routing, network flow logging, external ACL management) |
| Get tailnet contacts |
| Set tailnet contacts |
| Resend verification email for a contact |
Tool | Description |
| List webhooks |
| Get a specific webhook |
| Create a webhook |
| Update a webhook's endpoint URL and/or subscriptions |
| Delete a webhook |
| Rotate a webhook's secret |
| Send a test event to verify webhook delivery |
Tool | Description |
| List posture integrations |
| Get a posture integration |
| Create a posture integration |
| Update a posture integration |
| Delete a posture integration |
Tool | Description |
| List all Tailscale Services in your tailnet |
| Get details for a specific service |
| Update a service's configuration |
| Delete a service |
| List devices hosting a service |
| Get approval status of a device for a service |
| Approve or reject a device to host a service |
Create and tear down whole tailnets programmatically — useful for per-agent sandboxes,
per-tenant isolation, and ephemeral CI environments. Unlike every other group here these
endpoints live under /organizations, authenticate only with an OAuth client (the
tailnets scope to create, all to then reach the tailnet), and produce tailnets that are
not managed in the admin console. Set TAILSCALE_OAUTH_TAILNET to operate on one.
Tool | Description |
| List the organization's tailnets (paginated via |
| Create an API-only tailnet; returns its OAuth client secret once |
| Delete a tailnet (the configured one, or an explicit |
Tool | Description |
| List log streaming configurations (both audit and network) |
| Get log streaming config for a log type |
| Set where logs are sent (Axiom, Datadog, Splunk, etc.) |
| Delete a log streaming configuration |
| Check if log streaming is delivering successfully |
| Create/get AWS external ID for S3 log streaming |
| Validate AWS IAM role trust policy for S3 log streaming |
Tool | Description |
| List device invites for a specific device |
| Create a device invite |
| Get a device invite |
| Delete a device invite |
| Accept a device share invitation |
| Resend a device invite email |
Tool | Description |
| List user invites |
| Create a user invite |
| Get a user invite |
| Delete a user invite |
| Resend a user invite email |
Tool | Description |
| Get configuration audit log (who changed what, when) |
| Get network traffic flow logs between devices |
Tool | Description |
| This machine's view of the tailnet (own connection state, peers, DERP region) |
| Latency probe to another tailnet node from this machine |
| NAT type, DERP latency map, IPv4/IPv6 support diagnostics |
| Local |
| Which user and device this machine is authenticated as (needs tailscale >= 1.102.1) |
| Tailscale Services visible to this node (needs tailscale >= 1.102.1) |
GitOps: deploy ACLs from CI
For the simple "deploy ACL from git on merge" workflow, you don't need an MCP server or an agent — use the built-in CLI:
# PR check: validate the proposed policy without touching the tailnet
npx -y @yawlabs/tailscale-mcp@latest validate-acl tailscale/acl.json
# On merge: ETag fetch + validate + deploy with If-Match, fail-closed at every step
npx -y @yawlabs/tailscale-mcp@latest deploy-acl tailscale/acl.jsonWorks in any CI system. Set TAILSCALE_API_KEY and TAILSCALE_TAILNET as env vars. Both commands exit non-zero on any failure; deploy-acl refuses to deploy without an ETag (so a concurrent Admin Console edit can never be silently clobbered) and reports a 412 as a concurrent-edit conflict you resolve by re-running.
A complete GitHub Actions workflow — validate on PR, deploy on merge:
name: tailscale-acl
on:
pull_request:
paths: ["tailscale/acl.json"]
push:
branches: [main]
paths: ["tailscale/acl.json"]
jobs:
acl:
runs-on: ubuntu-latest
env:
TAILSCALE_API_KEY: ${{ secrets.TAILSCALE_API_KEY }}
TAILSCALE_TAILNET: your-tailnet.ts.net # or omit: defaults to the key's tailnet
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: 22 }
- name: Validate ACL
if: github.event_name == 'pull_request'
run: npx -y @yawlabs/tailscale-mcp@latest validate-acl tailscale/acl.json
- name: Deploy ACL
if: github.event_name == 'push'
run: npx -y @yawlabs/tailscale-mcp@latest deploy-acl tailscale/acl.jsonFor reproducible deploys, replace @latest with a pinned version.
If you hand-roll this with
curlinstead: Tailscale's ACL endpoint only returns theETagheader on GET, not HEAD. Acurl -I(HEAD) ETag fetch silently yields an empty value — and an emptyIf-Matcheither deploys unguarded (clobbering concurrent edits) or trips your guard and fails the deploy. Fetch the ETag with a GET (curl -fsS -D - -o /dev/null ...), and fail the job if it comes back empty. The CLI above does all of this for you.
Optional: Lock the Admin Console to prevent manual edits that drift from git. Ask your agent:
"Set aclsExternallyManagedOn to true and aclsExternalLink to our repo URL"
This shows a read-only banner in the Tailscale Admin Console pointing to your repo. Use the MCP for reads and investigations, and let CI handle the deploy.
Requirements
Node.js 20.11+ to run the server (22+ to develop — the test script passes a glob to
node --test, supported from Node 21)A Tailscale API key or OAuth client credentials
Running on oam.js (optional)
oam.js runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 96 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle and straight from the TypeScript source with no build step.
oam 0.9.0 is the minimum. Older releases ran child_process.execFile arguments through a shell, re-splitting them on whitespace and executing shell metacharacters inside an argument. This server shells out to the tailscale binary across its local-CLI tools, so that was a reachable bug rather than a theoretical one. The launcher enforces the floor: given an older oam it falls back to Node and says so on stderr, and TAILSCALE_MCP_RUNTIME=oam turns that into a hard error.
Sandboxing (opt-in)
Set TAILSCALE_MCP_SANDBOX=1 to run under oam's --permission model: network restricted to api.tailscale.com -- the only host the bundle contacts, including the OAuth token exchange -- and filesystem denied. Child-process stays granted because the local-CLI tools shell out to the tailscale binary, which is also why PATH remains in the environment allow-list.
It is opt-in rather than default because a wrong grant does not fail loudly. oam denies a non-granted environment variable by making it absent from process.env rather than throwing, so an under-granted TAILSCALE_API_KEY reads as "unauthenticated" rather than "denied". The env allow-list in the launcher is derived from what the shipped bundle actually reads -- if you add a new process.env lookup, extend that list with it.
{
"mcpServers": {
"tailscale": {
"command": "oam",
"args": ["run", "/path/to/tailscale-mcp/dist/index.js"],
"env": { "TAILSCALE_API_KEY": "tskey-api-..." }
}
}
}Node stays the default, deliberately. An MCP client cold-starts this server once per session, so startup is the cost that actually gets paid, and on the machine this was measured on node won it — 437ms vs 1554ms for oam run over 10 warmed runs (an earlier 5-run round showed 326ms vs 427ms; the box was busy, so treat the magnitude as noisy and the direction as the finding). Preferring oam automatically would mean either a launcher that probes for it on every start — a cost paid by everyone, including the majority who do not have oam — or making oam a hard requirement. Neither is worth it to reach a runtime that is not faster here. Measure on your own hardware before concluding anything; if oam wins on yours, the config above is all you need.
Two places oam does win for this repo, both opt-in and neither touching the npm package:
npm run check:oam— type-checks viaoam check(tsgo, TypeScript 7 native). Measured 4015ms against 7680ms fortsc --noEmit, same clean result.npx tsc --noEmitremains the portable default.npm run build:binary:oam— builds the standalone binary viaoam compileinstead of Node SEA. Measured ~57.7 MB against ~73.6 MB for the Node SEA carrier before its blob is injected. Writes to the samebin/<platform>-<arch>/path asnpm run build:binary, so the release staging script consumes either unchanged — run one or the other. If you redistribute that binary it embeds oam's runtime, so ship oam'sLICENSE,NOTICEandTHIRD_PARTY_LICENSES.mdwith it.
The source stays runtime-agnostic on purpose: no oam: imports anywhere, and tests stay on node:test. That is what keeps the Node fallback real rather than nominal. Note that any oam invocation writes a bytecode cache to oam/ in the working directory — already in .gitignore.
Contributing
Contributions welcome. See CONTRIBUTING.md for the PR workflow and AI-agent guidelines. Please open an issue to discuss before a PR for anything beyond a typo fix.
git clone https://github.com/YawLabs/tailscale-mcp.git
cd tailscale-mcp
npm install
npm run lint # Biome check
npm run lint:fix # Auto-fix
npm run build # tsc + esbuild bundle
npm test # node --test (full suite)For integration testing against your own tailnet: set TAILSCALE_API_KEY and run node dist/index.js.
Security
Found a vulnerability? See SECURITY.md — please use GitHub's private vulnerability reporting, not a public issue.
License
MIT
Available Tools
96 toolstailscale_accept_device_inviteBIdempotent
Accept a device share invitation using the invite URL or code.
| Name | Required | Description | Default |
|---|---|---|---|
| invite | Yes | The device invite URL or invite code |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide idempotentHint=true and destructiveHint=false, but the description adds no behavioral context beyond 'accept'. It does not explain what happens upon acceptance (e.g., device added to tailnet) or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no unnecessary words, directly conveys the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and annotations indicating safety, the description is mostly adequate. However, it lacks any mention of the result or confirmation after acceptance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter description in the schema is clear (URL or code). The tool description does not add additional semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (accept), the resource (device share invitation), and the input (invite URL or code). It distinguishes this tool from sibling tools that list, create, or delete invites.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. It does not mention prerequisites, such as needing an existing invite, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_approve_userAIdempotent
Approve a pending user, granting them access to the tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes | The user ID to approve |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral details beyond what annotations already indicate (readOnlyHint=false, destructiveHint=false). It does not mention idempotency even though idempotentHint=true is present, nor does it describe side effects or prerequisites.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no wasted words, effectively front-loading the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple operation with one parameter and no output schema, the description is largely sufficient, but could benefit from noting idempotency or any prerequisites.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter (userId) is already described in the schema with 100% coverage. The description adds no additional semantic meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Approve a pending user') and the resource ('user'), differentiating it from sibling tools like suspend, restore, or delete users.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this versus alternatives. While the context implies it's for approving pending users, there is no mention of when not to use it or contrasting with related tools like tailscale_authorize_device.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_authorize_deviceAIdempotent
Authorize a device that is pending authorization.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID to authorize |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false and destructiveHint=false, so the description adds context about pending authorization but does not elaborate on side effects or idempotency beyond annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words. It is tightly focused on the core action and resource, fitting the 5-star standard for conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no output schema, no nested objects), the description is complete. It accurately communicates the function without requiring additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameter descriptions (deviceId: 'The device ID to authorize'), so the description adds no additional semantics. Baseline 3 applies as the schema provides adequate meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (authorize) and the target (device that is pending authorization). It distinguishes itself from siblings like tailscale_deauthorize_device and tailscale_delete_device. The verb is specific and the resource is well-defined.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a device is pending authorization but does not explicitly state when to use this tool versus alternatives like tailscale_deauthorize_device. No guidance on prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_batch_update_posture_attributesAIdempotent
Batch update custom posture attributes across multiple devices. Each attribute key must start with 'custom:'. Uses JSON Merge Patch semantics — pass null as the attribute config to delete.
| Name | Required | Description | Default |
|---|---|---|---|
| nodes | Yes | Map of device ID to attribute config map (e.g. { "12345": { "custom:compliant": { "value": "true" } }, "67890": { "custom:compliant": { "value": false, "expiry": "2026-12-01T00:00:00Z" } } }). Pass null as the config to delete an attribute. | |
| comment | No | Optional comment added to the audit log explaining why attributes are being set (max 200 chars) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly says 'pass null as the attribute config to delete', yet the annotations mark destructiveHint as false. This is a direct contradiction: the tool can delete attribute configuration, so the safety signal is misleading. Per the rubric, a contradiction forces a score of 1 even though the description adds useful JSON Merge Patch semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences front-load the purpose and then give the essential behavioral constraints. No filler or unnecessary repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation with a nested map parameter, the description plus fully documented schema give an agent enough to construct a valid call. The main remaining gap is the conflicting destructiveHint signal, and there is no output schema to describe the return value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters and the null-delete pattern. The description adds value beyond the schema by stating the 'custom:' key requirement and naming JSON Merge Patch semantics, which clarifies the behavior of omitted keys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact operation ('Batch update custom posture attributes'), the scope ('across multiple devices'), and the key namespace ('custom:'). This clearly distinguishes it from the sibling single-device set/delete posture attribute tools even without naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Batch update ... across multiple devices' clearly signals the multi-device use case and implies that single-device siblings should be used for one-off changes, but it does not explicitly state when-not-to-use or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_aws_external_idAIdempotent
Create or get an AWS external ID for your tailnet. Used when configuring log streaming to S3 — the external ID is included in the IAM role trust policy.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotentHint=true and destructiveHint=false. The description adds that the external ID is used in an IAM role trust policy, giving practical context beyond annotations. It does not contradict any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states the action, second provides the use case. No unnecessary words, and the description is front-loaded with the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no parameters and no output schema, the description adequately covers what the tool does and why it is used. Minor omission: it does not describe the return value format, but that is inferable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and schema description coverage is 100% (empty object). The description does not need to explain parameters, and the baseline score for no parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates or gets an AWS external ID for the tailnet, using specific verbs ('create', 'get') and a distinct resource. It is easily distinguished from sibling tools like tailscale_list_log_stream_configs or tailscale_validate_aws_trust_policy by describing a unique purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states the tool is used when configuring log streaming to S3, providing clear context. It does not list alternatives or when not to use it, but the use case is well-defined among similar tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_device_inviteA
Create a device share invitation that allows an external user to access a specific device in your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| No | Email address to send the invite to | ||
| deviceId | Yes | The device ID to create an invite for | |
| multiUse | No | Whether the invite can be used more than once (default: false) | |
| allowExitNode | No | Whether the invited device can be used as an exit node (default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate mutation (readOnlyHint=false), and the description adds 'share invitation' but lacks details on invitation behavior like expiration or acceptance.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, direct sentence with no wasted words; appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema, and description does not hint at return value or error conditions; lacks completeness for a creation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with parameter descriptions; the tool description adds no extra meaning beyond the purpose, meeting baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it creates a device share invitation for external users, distinguishing it from sibling tools like user invites or device management.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use vs alternatives or prerequisites; the purpose is implied but not elaborated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_keyA
Create a new key in your tailnet. Supports auth keys (for adding devices), OAuth clients (for programmatic API access), and federated identities (for OIDC-based CI/CD access). Returns the key value — save it immediately, as it cannot be retrieved again.
SECURITY: the response body contains a long-lived credential verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive (do not commit it, avoid re-sharing it in unrelated chat history).
Examples:
Auth key: {keyType:'auth', reusable:true, tags:['tag:ci']}
OAuth client: {keyType:'client', scopes:['devices:read','dns']}
Federated (GitHub Actions): {keyType:'federated', scopes:['devices:read'], issuer:'https://token.actions.githubusercontent.com', subject:'repo:my-org/my-repo:*'}
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ACL tags (must start with 'tag:'). Required for client/federated if scopes include 'devices:core' or 'auth_keys' | |
| issuer | No | (federated only) OIDC issuer URL (e.g. 'https://token.actions.githubusercontent.com') | |
| scopes | No | (client/federated) OAuth scopes to grant (e.g. ['devices:read', 'dns', 'acl']) | |
| keyType | No | Key type: 'auth' (default) for device auth keys, 'client' for OAuth clients, 'federated' for OIDC federation | |
| subject | No | (federated only) Expected subject claim, supports * wildcards | |
| audience | No | (federated only) Expected audience claim | |
| reusable | No | (auth only) Whether the key can be used more than once (default: false) | |
| ephemeral | No | (auth only) Whether devices using this key are ephemeral (default: false) | |
| description | No | Description for this key (max 50 chars, alphanumeric/hyphens/spaces) | |
| expirySeconds | No | (auth only) Key expiry in seconds (default: 90 days) | |
| preauthorized | No | (auth only) Whether devices are pre-authorized (default: false) | |
| customClaimRules | No | (federated only) Custom claim mapping rules |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description warns that the key value is returned once and cannot be retrieved again, alerts about sensitive credential persistence in logs, and advises immediate saving. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with purpose, security note, and examples. While it is slightly lengthy, every sentence adds value; the front-loading of purpose and immediate security warning is effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 12 parameters and no output schema, the description covers the key types, security, and return value (key must be saved). It lacks detail on the full response structure but is adequate for a key-creation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the description adds value by providing concrete examples for each key type, showing how parameters combine (e.g., federated with issuer and subject), which clarifies usage beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a new key in your tailnet' and lists three distinct types (auth, OAuth, federated), differentiating it from sibling tools like tailscale_list_keys and tailscale_get_key which are read-only operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use each key type with examples, but does not explicitly compare to update/delete siblings or specify when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_oauth_appA
Create an OAuth App for device provisioning (Tailscale alpha). Lets a third-party application enroll a device into your tailnet via the authorization-code flow, after a user consents. Returns the app's client secret -- save it immediately, it cannot be retrieved again.
SECURITY: the response body contains a long-lived credential verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive.
The supported scope is 'auth_keys:create:once' (one auth key per authorization, no refresh token). Distinct from tailscale_create_key with keyType='client', which mints a machine-to-machine OAuth client instead.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Human-readable name for the OAuth app, shown on the consent screen | |
| scopes | Yes | Scopes to grant. Currently 'auth_keys:create:once' is the supported value. | |
| redirectUris | Yes | Allowed redirect URIs for the authorization-code flow (e.g. ['https://example.com/callback']) | |
| allowedNodeAttributes | No | Optional node attributes the app may request when provisioning a device |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal mutation but the description goes further: it discloses that the client secret is shown only once, cannot be retrieved again, and is a long-lived credential that MCP clients may persist in logs. It also clarifies the auth flow details beyond annotations, such as one auth key per authorization and no refresh token. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and security-critical return value, and the SECURITY section earns its place. Every sentence adds operational or selection value with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description rightly highlights the most important return behavior: the client secret must be saved immediately and is sensitive. It could additionally sketch the full response shape, but the essential operational knowledge needed to call the tool correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful semantic context by explaining the supported scope, the one-auth-key behavior, and the flow implications for redirectUris, though most parameter detail already lives in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, resource, and purpose: creates an OAuth App for device provisioning via the authorization-code flow. It also distinguishes itself from tailscale_create_key with keyType='client', making it easy to differentiate from the closest sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names the alternative tailscale_create_key and explains the condition that selects between them: this tool is for user-consented, device-provisioning OAuth apps, while create_key with keyType='client' is for machine-to-machine OAuth clients. The supported scope and flow are also stated clearly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_org_tailnetA
Create a new API-only tailnet in your organization. Returns the tailnet (id, displayName, orgId, dnsName, createdAt) AND a freshly-minted OAuth client for it.
SECURITY: the response body contains that OAuth client's secret verbatim, and it cannot be retrieved again. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive.
Requires an OAuth client with the 'tailnets' scope -- an API key will not work. To then operate on the new tailnet, set TAILSCALE_OAUTH_TAILNET to its id and use an OAuth client with the 'all' scope.
| Name | Required | Description | Default |
|---|---|---|---|
| displayName | Yes | Human-readable name for the new tailnet | |
| organization | No | Organization ID. Defaults to '-' (the organization owning the calling credentials). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses critical behavioral traits: the response contains an OAuth client secret verbatim, the secret cannot be retrieved again, and MCP clients may persist the response in logs. It also states the required auth scope. This is substantial value beyond the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core action, immediately states return value, then presents the security warning and prerequisites in clearly labeled sections. Every sentence adds necessary operational or security information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description compensates by enumerating the returned fields (id, displayName, orgId, dnsName, createdAt) and warning about the secret. It also covers auth requirements and follow-up configuration, making it complete for correct invocation and handling of the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: displayName and organization are already documented in the schema. The description does not add extra parameter-level detail, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Create a new API-only tailnet in your organization.' It also clarifies the one-time OAuth client creation, which distinguishes this from the many list/update/delete tailnet siblings. An agent can tell exactly what operation this performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear operational context: it requires an OAuth client with the 'tailnets' scope, explicitly says an API key will not work, and explains how to operate on the new tailnet afterward. It does not mention alternative tools or explicit when-not-to-use cases, but the context is specific enough for correct selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_posture_integrationB
Create a new device posture integration.
| Name | Required | Description | Default |
|---|---|---|---|
| cloudId | No | Identifies which of the provider's clouds to integrate with. Falcon: us-1|us-2|eu-1|us-gov; Intune: global|us-gov; Jamf Pro/Kandji/Sentinel One: FQDN of your subdomain; Kolide: leave blank. | |
| clientId | No | Client ID for the provider (Intune: application UUID; Falcon/Jamf Pro: client id; Fleet/Huntress/Kandji/Kolide/Sentinel One: leave blank) | |
| provider | Yes | The posture provider slug: falcon (CrowdStrike Falcon), fleet, huntress, intune (Microsoft Intune), jamfpro (Jamf Pro), kandji (Iru, formerly Kandji), kolide (1Password XAM, formerly Kolide), sentinelone | |
| tenantId | No | Microsoft Intune directory (tenant) ID. Other providers leave blank. | |
| clientSecret | Yes | The secret (auth key, token, etc.) used to authenticate with the provider. SENSITIVE: passed straight to Tailscale and not echoed back, but MCP clients may log the input value you supply. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false and idempotentHint=false, so the agent knows this is a mutating, non-idempotent operation. The description adds no behavioral context beyond that, such as side effects, permission requirements, or the sensitive nature of clientSecret, and the secret sensitivity is only noted in the schema, not the tool description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with the verb front-loaded. The word 'new' is slightly redundant with 'Create', but overall there is no filler and the description is appropriately concise for a simple create operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema and annotations, the description is minimally viable: it names the operation and resource, while parameters and safety hints are supplied elsewhere. However, it lacks usage context, output expectations, and any warning about provider-specific integration behavior, leaving noticeable gaps for an agent deciding how and when to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the input schema thoroughly documents every parameter including provider-specific meanings. The tool description adds no parameter-level information, so the baseline score of 3 is appropriate since the schema carries the full burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Create') and a specific resource ('device posture integration'), clearly distinguishing this from sibling tools like update, list, get, and delete posture integrations. It is unambiguous and directly tells an agent what operation this tool performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool versus alternatives such as tailscale_update_posture_integration or tailscale_list_posture_integrations. It does not mention prerequisites, provider setup, or exclusions, leaving the agent to infer usage solely from the word 'create' and sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_user_inviteB
Create a new user invite that allows someone to join your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | Role to assign to the invited user (default: member) | |
| No | Email address to send the invite to |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=false. The description adds no additional behavioral context, such as side effects, authorization requirements, rate limits, or what happens on success/failure. It merely repeats the 'create' action already implied by the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, 13 words, no unnecessary information. Conciseness is excellent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple create operation with fully described parameters, the description is barely adequate. It does not explain return behavior (no output schema), error cases, or idempotency (already hinted false). Could be improved with minimal context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the description does not need to elaborate on parameters. It adds no extra meaning beyond the schema. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Create a new user invite that allows someone to join your tailnet.' It uses a specific verb (create) and resource (user invite), and distinguishes itself from sibling tools like 'create_device_invite' and 'list_user_invites'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., when to invite a user vs. invite a device). No mention of context, prerequisites, or when not to use it. The description lacks any usage hints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_create_webhookA
Create a new webhook. The response includes the webhook's signing secret -- this is the only opportunity to capture it; save it immediately.
SECURITY: the response body contains the secret verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive.
| Name | Required | Description | Default |
|---|---|---|---|
| endpointUrl | Yes | The HTTPS URL to send webhook events to | |
| subscriptions | Yes | Event types to subscribe to (at least one) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses a critical, non-obvious behavior: the response contains the signing secret and this is the only chance to capture it. It also warns that the response is sensitive and may be persisted in logs, which goes well beyond the annotations that only mark mutability and non-idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences plus a short SECURITY note convey exactly what is needed without filler. The primary purpose is front-loaded, and the security warning appears immediately after, making the structure efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter create operation with no output schema, the description covers the essential operational detail: capture the one-time signing secret immediately and treat the response as sensitive. Combined with fully documented schema parameters, nothing needed to invoke the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the schema already explaining endpointUrl as an HTTPS URL and subscriptions as event types with at least one required. The description adds no further parameter-level meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Create a new webhook,' a specific verb plus resource that clearly states the action. It distinguishes itself from sibling webhook operations like list/get/update/delete/rotate/test by name and by the creation focus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to choose this tool over alternatives such as updating, listing, or rotating webhooks. The only additional instruction ('save it immediately') concerns post-invocation handling rather than tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_deauthorize_deviceADestructiveIdempotent
Deauthorize a device, immediately removing its access to the tailnet. The device will need to be re-authorized to reconnect.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID to deauthorize |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already include destructiveHint: true and idempotentHint: true. The description adds behavioral context: 'immediately removing its access' and the need for re-authorization, which goes beyond the annotations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff. Every sentence provides necessary information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple tool (1 parameter, no output schema) and comprehensive annotations, the description fully covers the tool's purpose and effect. It is complete enough for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single parameter deviceId described as 'The device ID to deauthorize.' The description does not add additional meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Deauthorize a device, immediately removing its access to the tailnet', which is a specific verb+resource. It clearly distinguishes from sibling tools like authorize_device and delete_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: 'immediately removing its access to the tailnet' and 'The device will need to be re-authorized to reconnect.' This implies when to use it (to revoke access) and hints at the consequence, though it does not explicitly list when not to use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_deviceADestructiveIdempotent
Permanently remove a device from the tailnet. This is irreversible — the device must re-authenticate to rejoin.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true. Description adds value by stating 'This is irreversible' and 'the device must re-authenticate to rejoin', providing context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no unnecessary words. Each sentence contributes essential information: action and consequence. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple tool with one parameter, no output schema, and annotations covering destructiveness, the description sufficiently explains purpose, effect, and consequence. No missing context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the description does not add information beyond what the schema provides for the single parameter 'deviceId'. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses clear verb 'permanently remove' and specifies the resource 'device from the tailnet'. It distinguishes from sibling tools like authorize or expire by highlighting irreversibility.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies permanent removal but does not explicitly guide when to use this tool versus alternatives like tailscale_expire_device or tailscale_deauthorize_device. No when-not-to-use or alternative names mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_device_inviteADestructiveIdempotent
Delete a device invite. This is irreversible — the invite link will stop working.
| Name | Required | Description | Default |
|---|---|---|---|
| inviteId | Yes | The device invite ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Discloses beyond annotations by detailing the consequence ('invite link will stop working') and confirming irreversibility. No contradiction with annotations (destructiveHint: true).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences: first states purpose, second adds behavioral consequence. No excess words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With one well-documented parameter, no output schema, and clear annotations, the description fully covers what an AI agent needs to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema covers 100% of parameters with description for inviteId. Description adds no extra meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'Delete' and resource 'a device invite'. It distinguishes from sibling delete operations (e.g., delete_device, delete_webhook) by specifying the invite resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description mentions irreversibility and link deactivation, implying use when permanent removal is intended. However, it does not explicitly compare to alternatives like 'resend_device_invite' or list contexts where deletion is not appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_device_posture_attributeADestructiveIdempotent
Delete a custom posture attribute from a device. This is irreversible.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID | |
| attributeKey | Yes | The attribute key to delete (e.g. 'custom:lastAuditDate') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true, but the description adds the crucial behavioral trait 'irreversible,' which informs the agent that the operation cannot be undone. This adds value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff. The first sentence front-loads the action and resource. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 required params, no output schema), the description covers the essential aspects: purpose and irreversibility. Could mention response details, but not critical for a delete operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions. The description adds an example for attributeKey ('custom:lastAuditDate'), which enhances understanding without repeating schema info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Delete) and the resource (custom posture attribute from a device). It is unambiguous and distinguishes itself from sibling tools like tailscale_set_device_posture_attribute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lacks explicit guidance on when to use this tool vs alternatives (e.g., batch update or set). It only provides a basic indication of irreversibility, which is not enough for optimal agent decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_keyADestructiveIdempotent
Delete a key (auth key, OAuth client, or federated identity). This is irreversible. For auth keys, devices already authenticated are unaffected but no new devices can use it. For OAuth clients and federated identities, any integrations using them lose access immediately.
| Name | Required | Description | Default |
|---|---|---|---|
| keyId | Yes | The key ID to delete (auth key, OAuth client, or federated identity) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark as destructive and non-read-only. The description adds value by noting irreversibility and specific impacts on different key types, going beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences), front-loaded with the primary action, and contains no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple deletion tool with one parameter, the description adequately covers behavior and consequences. It could mention authentication requirements, but that is acceptable given no output schema and low complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a description for keyId. The description reiterates the key types but does not add significant new semantic information beyond the schema, earning a baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool deletes a key and specifies the types (auth key, OAuth client, federated identity). It distinguishes from sibling tools like tailscale_create_key and tailscale_update_key.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the consequences of deletion, implying when to use it. However, it does not explicitly state when not to use this tool or provide alternatives, though the context is clear given siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_log_stream_configADestructiveIdempotent
Delete a log streaming configuration. Logs will stop being sent to the configured destination.
| Name | Required | Description | Default |
|---|---|---|---|
| logType | Yes | The log type to stop streaming: 'configuration' or 'network' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveness and idempotency. The description adds the specific effect ('Logs will stop being sent'), which provides some additional context but does not disclose further behavioral traits like reversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the action and immediate consequence. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete operation with one parameter and no output schema, the description is complete: it states what is deleted and the outcome. No missing context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'logType' is fully described in the schema with enum and description. The tool description adds no additional parameter information, but schema coverage is 100%, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Delete') and resource ('log streaming configuration'), and distinguishes from siblings like set_log_stream_config and get_log_stream_config. The effect is also described.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool (to stop log streaming), but does not explicitly mention when not to use it or provide alternatives. Implied by the action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_oauth_appADestructiveIdempotent
Delete an OAuth App (Tailscale alpha). This is irreversible: the app's client secret stops working immediately and any integration using it loses its device-enrollment path, so no further device can be authorized through it. Devices already enrolled stay in the tailnet, exactly as they do when the auth key that added them is deleted. Use tailscale_list_oauth_apps to find the id.
| Name | Required | Description | Default |
|---|---|---|---|
| appId | Yes | The OAuth app ID to delete (see tailscale_list_oauth_apps) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations by explaining concrete consequences: client secret stops working immediately, integrations lose device-enrollment paths, and already-enrolled devices remain in the tailnet. This gives the agent a clear mental model of the destructive side effects, matching and enriching the destructiveHint annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three compact sentences with no filler. It front-loads the action, then explains the irreversibility and side effects, then provides the prerequisite lookup step. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter destructive tool with annotations already marking destructive and read-only hints, the description is complete: it explains what happens on deletion, what survives deletion, and how to obtain the required appId. No output schema is present, but the description covers enough for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the appId parameter is already described as 'The OAuth app ID to delete (see tailscale_list_oauth_apps)'. The description repeats the reference to list_oauth_apps but adds no new parameter-level meaning, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific action ('Delete an OAuth App') on a specific resource, and the alpha qualifier adds useful context. The resource is distinct from sibling delete tools like tailscale_delete_key and tailscale_delete_device, so an agent can immediately understand the tool's scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly advises using tailscale_list_oauth_apps to find the id, which is actionable guidance for invoking the tool. It also warns that the operation is irreversible and breaks integrations, giving strong situational context, though it does not explicitly state when not to use it or compare it with alternative OAuth app tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_posture_integrationADestructiveIdempotent
Delete a posture integration. This is irreversible.
| Name | Required | Description | Default |
|---|---|---|---|
| integrationId | Yes | The posture integration ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the 'irreversible' warning, which goes beyond the destructiveHint annotation by emphasizing permanence, but does not detail other behaviors like cascading effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences front-load the purpose and key warning, with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple one-parameter input and no output schema, the description adequately covers the tool's purpose and critical risk, making it complete for an agent to invoke safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the parameter description is already clear. The tool description does not add any additional meaning to the parameter beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (delete) and the resource (posture integration), distinguishing it from sibling tools like list, get, create, and update for posture integrations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description only warns about irreversibility but provides no guidance on when to use this tool versus alternatives such as updating or disabling the integration.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_serviceADestructiveIdempotent
Delete a Tailscale Service. This is irreversible — the service's MagicDNS name and virtual IP will be released.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceName | Yes | The service name to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate destructiveHint=true and readOnlyHint=false. The description adds specific behavioral details (irreversible, MagicDNS name and virtual IP released) beyond what annotations provide, enhancing transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences succinctly convey the action and key consequence. No filler words; front-loaded with the primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete operation with one parameter and no output schema, the description is fully adequate. It addresses the action and important side effects, meeting the needs of an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with a clear description for serviceName. The tool description adds no additional semantics beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Delete) and the resource (Tailscale Service). It also includes the irreversible consequence, distinguishing it from other delete tools like tailscale_delete_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions irreversibility as a caution but does not provide explicit when-to-use or alternatives. It is adequate but lacks explicit guidance on when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_tailnetADestructiveIdempotent
Permanently delete a tailnet. This is IRREVERSIBLE and removes every device, user, ACL, and key in it.
By default it acts on the tailnet the current credentials point at (TAILSCALE_TAILNET, or TAILSCALE_OAUTH_TAILNET when targeting an API-only tailnet). Pass tailnet to name a different one -- e.g. an id returned by tailscale_list_org_tailnets -- which requires credentials scoped to reach it; UNVERIFIED against a live tailnet, so expect a 403/404 if your token cannot. You must always pass confirmTailnet matching the effective target exactly; the call is refused locally otherwise. That check is a typo guard, not an authorization gate: when you also pass tailnet you are supplying both halves of the comparison, so it proves only that they agree -- it is a genuine second look only on the omit-tailnet path, where the value has to match the operator's environment. Restricting who may delete at all is TAILSCALE_READONLY / TAILSCALE_TOOLS, which drop this tool from the server entirely. Intended for tearing down API-only tailnets created by tailscale_create_org_tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| tailnet | No | Tailnet to delete (e.g. an id from tailscale_list_org_tailnets). Omit to target the configured tailnet. Requires credentials scoped to reach it. | |
| confirmTailnet | Yes | Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A typo guard, not an authorization gate: on the explicit-`tailnet` path the caller writes both halves of the comparison, so it proves only self-agreement. It is a real second look only when `tailnet` is omitted and the value has to match the operator's environment. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial behavioral context beyond the annotations: irreversibility, exactly which resources are destroyed, the local refusal behavior when confirmTailnet does not match, the typo-guard semantics of confirmTailnet, and the environment-variable based targeting. It also cautions that the tool is UNVERIFIED against a live tailnet, which is valuable risk information. No contradiction with destructiveHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence carries operational weight. The most critical warning—IRREVERSIBLE and what is destroyed—is front-loaded, and the parameter and credential caveats are organized into clear follow-up sentences. The length is justified given the destructive and high-stakes nature of the operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation with no output schema, the description covers what the agent needs: the default target, how to override it, the confirmation requirement, the credential limitations, the expected error behavior, and how the tool might be absent entirely due to TAILSCALE_READONLY / TAILSCALE_TOOLS. The description is complete enough to prevent dangerous misinvocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful value to both parameters: it explains that tailnet may be an id from tailscale_list_org_tailnets, and it clarifies the confirmTailnet guard's actual limitations—that on the explicit-tailnet path it proves only self-agreement rather than authorization. This goes beyond the schema's descriptions, though the schema already covers the literal mechanics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Permanently delete a tailnet.' It immediately distinguishes this from the many sibling delete tools by stating the resource scope and the irreversible removal of devices, users, ACLs, and keys. The title 'Delete tailnet' is reinforced with precise details rather than merely restated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit selection guidance: it targets the configured tailnet by default, and names tailscale_list_org_tailnets as the source for an alternative explicit tailnet. It also states the intended use case—tearing down API-only tailnets created by tailscale_create_org_tailnet—and warns about credential scoping and expected 403/404 failures for unreachable tailnets.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_userADestructiveIdempotent
Delete a user from the tailnet. This is irreversible — the user and all their devices will be removed.
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes | The user ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveness. Description adds concrete consequences: 'the user and all their devices will be removed', which is valuable beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, clearly front-loaded with action and key warning. No superfluous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple tool (1 param, no output schema), the description fully covers action, effect, and irreversibility. No gaps for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single parameter 'userId' with description in schema. Tool description adds no extra semantic value; coverage is 100%, so baseline applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the verb 'delete' and specific resource 'user from the tailnet'. Distinguishes from siblings like tailscale_suspend_user by emphasizing irreversibility and removal of devices.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like suspend or update user role. The irreversible note hints at caution but doesn't provide decision context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_user_inviteADestructiveIdempotent
Delete a user invite. This is irreversible — the invite link will stop working.
| Name | Required | Description | Default |
|---|---|---|---|
| inviteId | Yes | The user invite ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, so the description adds minimal value by stating irreversibility. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with action, no wasted words. Highly efficient and readable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete tool with complete schema and annotations, the description adequately covers purpose and key behavior. Could mention permission requirements but not strictly necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description adds no additional detail about the parameter 'inviteId'. Baseline score of 3 applies since the schema already documents the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Delete a user invite' with a specific verb and resource. It distinguishes from sibling delete tools like tailscale_delete_device_invite by specifying 'user invite'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. With many delete tools among siblings (e.g., delete_device_invite, delete_key), the description fails to provide context for selecting this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_delete_webhookADestructiveIdempotent
Delete a webhook. This is irreversible — the webhook secret cannot be recovered.
| Name | Required | Description | Default |
|---|---|---|---|
| webhookId | Yes | The webhook ID to delete |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds crucial behavioral information beyond annotations: 'This is irreversible — the webhook secret cannot be recovered.' This complements the destructiveHint annotation and provides real consequence awareness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences immediately state the action and the critical consequence. No unnecessary words or details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple deletion tool with one parameter, the description supplies the necessary purpose and behavioral warning. No output schema is needed, and the description adequately covers the irreversible nature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter webhookId, with a clear description. The tool description adds no additional meaning beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Delete a webhook' with a specific verb and resource. It distinguishes this tool from sibling tools like tailscale_rotate_webhook_secret or tailscale_test_webhook.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The description does not mention any prerequisites, context, or contrast with sibling tools such as tailscale_rotate_webhook_secret or tailscale_test_webhook.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_expire_deviceADestructiveIdempotent
Expire a device's key, forcing it to re-authenticate.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID to expire |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as destructive and idempotent. The description adds the context that the device will be forced to re-authenticate, but does not elaborate on side effects like immediate disconnection or notification behavior. It adds some value beyond annotations but lacks full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that front-loads the action and effect with no extraneous words, achieving maximum conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no complex logic), the description adequately covers the core action and consequence. However, some additional context about idempotency or call sequencing could enhance completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already describes the deviceId parameter. The description does not add any additional meaning or constraints beyond what the schema provides, resulting in no extra value for parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly indicates the action ('expire') and the resource ('a device's key'), specifying the effect of forcing re-authentication. This distinguishes it from sibling tools like tailscale_update_device_key or tailscale_deauthorize_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as tailscale_authorize_device or tailscale_update_device_key. There is no mention of prerequisites, post-conditions, or scenarios where this tool is inappropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_aclARead-onlyIdempotent
Get the current ACL policy for your tailnet. Returns the raw policy text with original formatting preserved, including comments and trailing commas (HuJSON). Also returns an ETag — you must pass it to tailscale_update_acl to safely update the policy.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint. The description adds value by explaining the raw formatting preservation and ETag purpose, which are not in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences front-loaded with the main purpose, followed by key details about format and ETag. Every sentence is meaningful with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, no output schema, and strong annotations, the description fully covers the tool's function, output format, and relationship to the update tool. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, so the description has nothing to add beyond the schema. Baseline 4 is appropriate as no parameter info is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it retrieves the current ACL policy for the tailnet, specifies the return format (raw HuJSON with preserved formatting and ETag), and distinguishes from the update tool by mentioning the ETag requirement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells that the ETag must be passed to tailscale_update_acl for safe updates, providing clear usage context. It could briefly mention other related tools like validate or preview for completeness.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_audit_logARead-onlyIdempotent
Get the tailnet audit/configuration log. Shows who changed what and when — useful for troubleshooting and compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End time in RFC3339 format. Defaults to now. | |
| start | Yes | Start time in RFC3339 format (e.g. '2026-04-01T00:00:00Z'). Required. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds behavioral detail ('Shows who changed what and when') beyond annotations, which already declare readOnlyHint, openWorldHint, idempotentHint, destructiveHint. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no redundancy, directly and efficiently conveying purpose and value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and description only vaguely states output contains 'who changed what and when'; lacks details on structure, pagination, or error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (start, end described), so description adds no extra parameter meaning; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get the tailnet audit/configuration log' with verb and resource, and distinguishes from sibling tools (e.g., tailscale_get_network_flow_logs) by specifying 'audit/configuration'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implied usage via 'useful for troubleshooting and compliance', but no explicit when-to-use vs when-not-to-use or alternative tools are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_contactsARead-onlyIdempotent
Get the tailnet contact information (security, support, admin emails).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds no behavioral context beyond annotations (readOnlyHint, idempotentHint, etc.), providing only the specific fields returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, direct sentence with no superfluous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple tool with no inputs and good annotations, description is adequate but lacks info on output format (no output schema).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0 parameters with 100% coverage; description correctly states the purpose without needing param details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Get' and specific resource 'tailnet contact information' with three email types, distinguishing it from siblings like set or resend contacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when or when not to use this tool vs alternatives, though the purpose is clear from name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_deviceARead-onlyIdempotent
Get detailed information about a specific device by its ID.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID (numeric id or nodeId, NOT the nodeKey) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, idempotentHint, and destructiveHint. The description ('Get detailed information') aligns with read-only behavior but adds no additional behavioral context beyond what annotations offer. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no superfluous information. It front-loads the core action and is immediately understandable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is a simple get operation with no output schema, the description conveys the purpose adequately. However, it doesn't hint at the structure of the returned data, which might be helpful for an agent to know what 'detailed information' includes.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The sole parameter deviceId is fully described in the schema ('The device ID (numeric id or nodeId, NOT the nodeKey)'). The description adds no further clarification, so it meets but does not exceed the schema's coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get detailed information about a specific device by its ID,' specifying a unique verb-resource combination. Among siblings like list_devices, delete_device, rename_device, this tool is distinct in retrieving detailed info for a single device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when a device ID is known, but lacks explicit guidance on when to use this tool versus alternatives like tailscale_list_devices or other getters. No exclusions or alternative suggestions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_device_inviteBRead-onlyIdempotent
Get details for a specific device invite.
| Name | Required | Description | Default |
|---|---|---|---|
| inviteId | Yes | The device invite ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description only restates 'Get details' but does not add any behavioral context beyond what the annotations provide (e.g., no mention of output content, error scenarios, or side effects).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no superfluous words. It is efficiently front-loaded and earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, strong annotations, no output schema), the minimal description is sufficient. It clearly conveys the read operation, and the context from sibling names and annotations fills remaining gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%; the only parameter 'inviteId' has a clear description in the schema ('The device invite ID'). The tool description adds no extra meaning beyond that, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Get details for a specific device invite' uses a specific verb ('Get') and resource ('device invite'), clearly distinguishing it from sibling tools like 'tailscale_list_device_invites' (listing) or 'tailscale_create_device_invite' (creation).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., when to get vs. list invites) and no exclusions or prerequisites. It simply restates the name's intent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_device_posture_attributesARead-onlyIdempotent
Get all posture attributes for a device, including custom and system-managed attributes.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the description adds minimal extra behavioral context. It mentions the inclusion of custom and system-managed attributes, but does not disclose pagination, error handling, or other behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear and front-loaded. Every word is necessary, with no redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description adequately conveys that all posture attributes (custom and system-managed) are returned. For a read-only tool with one parameter and high schema coverage, this is nearly complete. Minor gap: no mention of potential pagination or an empty list response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description does not add meaning beyond the schema's description of deviceId as 'The device ID'. The description neither clarifies format nor provides additional semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'posture attributes for a device', including the scope 'custom and system-managed attributes'. This distinguishes it from sibling tools that set or delete posture attributes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is used to retrieve posture attributes, but it does not explicitly state when to use it over alternatives like 'set' or 'delete' tools. No exclusion criteria or alternative recommendations are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_device_routesARead-onlyIdempotent
Get the subnet routes a device advertises and which are enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by detailing what the tool retrieves (subnet routes, both advertised and enabled), but does not introduce any additional behavioral traits beyond what annotations cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence without any unnecessary words. It provides all necessary information succinctly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one parameter and no output schema. The description explains what is returned (advertised and enabled subnet routes), which is complete for this read-only operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter deviceId is adequately described in the schema. The description adds no further detail about the parameter itself, meeting the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it gets subnet routes that a device advertises and which are enabled, using the verb 'get' and specifying the resource 'subnet routes'. This distinguishes it from sibling tools like tailscale_set_device_routes, which writes routes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives, nor does it mention prerequisites (e.g., device must exist). While the tool's name and sibling list imply it's for reading, the description does not clarify when to use this tool over the corresponding write tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_dns_configurationARead-onlyIdempotent
Get the unified DNS configuration for your tailnet, including nameservers, search paths, split DNS, and MagicDNS preference in a single call.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows it's safe. The description adds that it returns 'unified' config with specified components, which is extra context but does not disclose additional behavioral traits beyond what annotations imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with the key action ('Get the unified DNS configuration') and lists what it includes. No extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no output schema, the description fully explains what is returned (nameservers, search paths, split DNS, MagicDNS preference). No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description correctly implies no inputs are needed, adding no further param info. Baseline for zero-param tools is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves the unified DNS configuration, naming specific components (nameservers, search paths, split DNS, MagicDNS preference). It distinguishes from sibling tools like tailscale_get_nameservers and tailscale_get_dns_preferences by emphasizing 'unified' and listing multiple parts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this comprehensive tool versus individual get tools (e.g., get_nameservers, get_search_paths). No mention of prerequisites or cases where a more targeted call would be better.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_dns_preferencesARead-onlyIdempotent
Get DNS preferences for your tailnet, including whether MagicDNS is enabled.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly, idempotent, and non-destructive behavior. The description adds context that it operates on the tailnet level and specifically mentions MagicDNS, which goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the purpose. Every word serves a purpose, with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with no output schema, the description sufficiently covers what the tool does (get DNS preferences) and highlights a key attribute (MagicDNS). It is complete given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters and 100% schema coverage, the description does not need to explain parameters. It adds no parameter info, but none is required. Baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get', the resource 'DNS preferences for your tailnet', and includes a specific detail about MagicDNS. It distinguishes itself from sibling tools like tailscale_set_dns_preferences and tailscale_get_dns_configuration by focusing on preferences.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for querying DNS preferences but does not provide explicit guidance on when to use this tool versus alternatives like tailscale_get_dns_configuration or tailscale_get_split_dns. No when-not or exclusion criteria are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_keyARead-onlyIdempotent
Get details for a specific key (auth key, OAuth client, or federated identity).
| Name | Required | Description | Default |
|---|---|---|---|
| keyId | Yes | The key ID (auth key, OAuth client, or federated identity) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description states 'Get details,' which aligns with annotations (readOnlyHint, idempotentHint, destructiveHint). However, it adds no behavioral context beyond what annotations already provide. Given annotation coverage, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that directly conveys the tool's purpose with no extraneous words. It is efficiently front-loaded and immediately informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one parameter and full annotation coverage, the description is complete. It explains what the tool does, what keys are applicable, and does not require an output schema explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers the single parameter (keyId) with a description identical in scope to the tool description. Schema description coverage is 100%, so the baseline is 3. The description does not add additional meaning or usage details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Get), the resource (key), and specifies the types of keys (auth key, OAuth client, federated identity). It distinguishes the tool from siblings like tailscale_list_keys and tailscale_create_key by focusing on retrieving details for a specific key.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you have a specific key ID. Context signals (sibling tools) indicate there is a list counterpart, but the description does not explicitly state when to use this vs other key tools. It provides clear context but lacks exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_log_stream_configARead-onlyIdempotent
Get the log streaming configuration for a specific log type.
| Name | Required | Description | Default |
|---|---|---|---|
| logType | Yes | The log type: 'configuration' for audit logs, 'network' for network flow logs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the description adds no behavioral context beyond that. It does not discuss return format, error scenarios, or authentication needs, which would be useful given the lack of an output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is perfectly concise and front-loaded with the action and resource. No extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one parameter and rich annotations, the description covers the essential purpose. However, it could mention that the configuration is retrieved (e.g., 'returns the current log stream configuration for the specified log type') to slightly improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with the parameter logType fully described via an enum and descriptions. The description does not add extra meaning; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' and identifies the resource 'log streaming configuration' with a constraint 'for a specific log type', clearly distinguishing it from sibling tools like tailscale_list_log_stream_configs (which lists all) and tailscale_set_log_stream_config (which modifies).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a single log type configuration but does not explicitly state when to use it vs. listing all configurations (tailscale_list_log_stream_configs) or when not to use it. No prerequisites or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_log_stream_statusARead-onlyIdempotent
Get the status of log streaming for a specific log type. Shows whether logs are being delivered successfully.
| Name | Required | Description | Default |
|---|---|---|---|
| logType | Yes | The log type: 'configuration' for audit logs, 'network' for network flow logs |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds value beyond annotations by specifying that the tool shows 'whether logs are being delivered successfully'. Annotations already indicate read-only, idempotent, and non-destructive behavior. The description provides context on the nature of the status, which is helpful but does not detail response structure or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with two sentences, no wasted words, and front-loads the key action. It is easy to scan and understand instantly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema, the description gives a high-level idea of the response but could be more specific (e.g., what fields are returned, success/failure indicators). For a tool with one parameter and simple purpose, it is adequate but not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the only parameter (logType) with full enum explanation. The description does not add any additional meaning or constraints beyond what the schema provides, so it meets the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'status of log streaming for a specific log type'. It specifies what the status shows (whether logs are delivered successfully). This distinguishes it from sibling tools like tailscale_get_log_stream_config or tailscale_list_log_stream_configs which manage configurations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives. While the purpose is clear, there is no mention of prerequisites, filtering, or comparison to similar tools (e.g., tailscale_get_log_stream_config). The agent might not know when to choose this over other log-related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_nameserversARead-onlyIdempotent
Get the DNS nameservers configured for your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint. The description adds no extra behavioral context beyond confirming it is a read operation. No information about return format or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with zero waste. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description adequately conveys the purpose. However, it lacks any hint about the return value structure or pagination, which would improve completeness for agents.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema description coverage is 100%. Per rubric, 0 parameters baseline is 4. No additional parameter information needed since none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get the DNS nameservers configured for your tailnet,' using a specific verb and resource. It unambiguously distinguishes from sibling tools like tailscale_set_nameservers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as tailscale_get_dns_preferences or tailscale_get_dns_configuration. There is no mention of when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_network_flow_logsARead-onlyIdempotent
Get network traffic flow logs showing connections between devices. Shows source/destination nodes, timestamps, and traffic metadata — useful for security monitoring and debugging connectivity.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | End time in RFC3339 format. Defaults to now. | |
| start | Yes | Start time in RFC3339 format (e.g. '2026-04-01T00:00:00Z'). Required. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, so the tool is safe. The description adds behavioral context by listing the types of data returned (source/destination, timestamps, traffic metadata). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences: first states the action, second describes contents and use case. No wasted words, front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given simple parameters (2 strings) and no output schema, the description is adequate. It explains what data is returned (source/destination, timestamps, metadata) and the use case. Could mention pagination or time range limits, but not critical for a read-only tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema documents parameters sufficiently. The description mentions timestamps but does not add significant meaning beyond what the schema provides (e.g., RFC3339 format, required start). Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The tool name and description clearly state the verb 'Get' and the resource 'network flow logs'. The description provides specifics about showing connections between devices with source/destination, timestamps, and metadata, distinguishing it from other tailscale_get_* tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions the tool is useful for security monitoring and debugging connectivity, giving context for when to use it. There are no alternative flow log tools among siblings, so usage is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_oauth_appARead-onlyIdempotent
Get an OAuth App's configuration (name, redirect URIs, scopes) by its app ID. Use this to verify an app was registered as intended. The client secret is not returned -- it is only available at creation time.
| Name | Required | Description | Default |
|---|---|---|---|
| appId | Yes | The OAuth app ID returned by tailscale_create_oauth_app |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, but the description adds valuable non-obvious behavior: the client secret is not returned and only exists at creation time. This prevents the agent from assuming a getter returns all stored configuration. It also names the configuration fields returned, which is useful given there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states the operation and scope, the second gives the use case and the key behavioral caveat. Every sentence earns its place, and the most important identifying detail is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter read-only getter with rich annotations, the description is complete. It specifies what is returned, what is not returned, and when to use it. The lack of an output schema is compensated by naming the returned configuration fields and the secret caveat.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the appId parameter is already well described as 'The OAuth app ID returned by tailscale_create_oauth_app'. The description only rephrases this as 'by its app ID', adding no new semantic information. Baseline 3 is appropriate when the schema fully documents the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Get' with a clear resource ('an OAuth App's configuration') and identifies the lookup key ('by its app ID'). It enumerates the fields returned (name, redirect URIs, scopes), making the tool's purpose unambiguous and distinguishable from getters for other resources like tailscale_get_key or tailscale_get_webhook.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit use case: 'Use this to verify an app was registered as intended.' It also provides a practical caveat about the client secret being unavailable, which helps agents avoid expecting it. It does not explicitly name alternative tools for when this tool is not appropriate, but the contextual guidance is sufficient for a simple getter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_posture_integrationARead-onlyIdempotent
Get details for a specific device posture integration.
| Name | Required | Description | Default |
|---|---|---|---|
| integrationId | Yes | The posture integration ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so description adds no extra behavioral traits. It doesn't disclose any potential side effects or limitations beyond what annotations provide, which is acceptable but unhelpful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with 8 words, front-loaded with verb and resource. No wasted words or superfluous details. Highly concise and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of a single-parameter get operation with no output schema, description covers the essential purpose. However, it doesn't hint at what 'details' include in the response, which could be improved. Nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema already provides 100% description coverage for the only parameter 'integrationId'. Description does not add new meaning about the parameter, such as how to obtain the ID or format expectations. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Get details for a specific device posture integration', using specific verb 'Get' and resource 'posture integration'. Distinguishes from sibling list/create/update/delete tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance. Missing mention of alternatives like list_posture_integrations for retrieving all integrations. Implicitly clear for single item retrieval but lacks explicit context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_search_pathsARead-onlyIdempotent
Get the DNS search paths configured for your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint. The description adds no extra behavioral context (e.g., permissions, rate limits). Since annotations are comprehensive, the description is adequate but not enhanced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb and resource, no extraneous words. Highly concise and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with no parameters and full annotation coverage, the description is mostly complete. However, there is no mention of return value format or pagination, which could be helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters in the input schema, so the description does not need to provide parameter semantics. Baseline score of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'Get' and resource 'DNS search paths' with scope 'configured for your tailnet'. It is specific and distinguishes from sibling tools like tailscale_set_search_paths.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Description does not explicitly state when to use this tool vs alternatives like tailscale_set_search_paths or get_dns_preferences. Usage is implied by the read-only nature, but no direct guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_serviceARead-onlyIdempotent
Get details for a specific Tailscale Service, including its MagicDNS name, virtual IP, and configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceName | Yes | The service name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only and idempotent. The description adds specific return fields (MagicDNS name, virtual IP, configuration), providing behavioral context beyond what annotations offer. It does not cover error conditions or permissions, but the annotations adequately signal safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action, and contains no unnecessary words or fluff. Every phrase adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read tool with one parameter and no output schema, the description adequately explains what the tool does and what information is returned. It is complete enough for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single required parameter (serviceName). The description does not add extra meaning about the parameter format, examples, or how to obtain the service name, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'specific Tailscale Service', and lists specific details returned (MagicDNS name, virtual IP, configuration). It distinguishes itself from siblings like tailscale_list_services and tailscale_update_service.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when you need details of a single service, but does not explicitly state when to use this tool versus listing services or when not to use it. No alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_service_device_approvalARead-onlyIdempotent
Get the approval status of a specific device for a Tailscale Service.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID | |
| serviceName | Yes | The service name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, so the tool is known to be safe and non-destructive. The description adds no further behavioral details (e.g., what happens if the device does not exist, the format of the approval status). With annotations covering the safety profile, a moderate score is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded with the key action. There is no unnecessary information, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool, the description is minimally complete. However, it lacks information about the return value (e.g., format or type of approval status) and does not explain potential responses or error conditions. With no output schema, this gap is notable but not critical given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers both parameters with descriptions, achieving 100% schema description coverage. The tool description does not add any additional meaning or examples beyond what the schema provides. The baseline score of 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and the resource ('approval status of a specific device for a Tailscale Service'). It distinguishes from the sibling tool 'tailscale_set_service_device_approval' which sets the approval, providing clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. For example, it does not mention that this is for reading approval status, while 'tailscale_set_service_device_approval' is for modifying it. No when-to-use or when-not-to-use context is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_split_dnsARead-onlyIdempotent
Get the split DNS configuration for your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds no additional behavioral context, but does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no redundant information. It is front-loaded with the key action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter read tool with clear annotations, the description is sufficient. However, it could benefit from briefly noting that the operation returns the current configuration.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are 0 parameters, and schema description coverage is 100%. The description does not need to add parameter information; baseline for 0 parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get') and resource ('the split DNS configuration for your tailnet'). It distinguishes this tool from sibling tools like tailscale_get_dns_preferences and tailscale_get_dns_configuration by specifying 'split DNS'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving split DNS configuration but provides no explicit guidance on when to use it versus alternatives. No exclusions or when-not scenarios are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_tailnet_settingsARead-onlyIdempotent
Get your tailnet settings (device approval, key expiry, HTTPS certificates, etc.).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the agent knows this is a safe, idempotent read. The description adds value by listing example settings but does not go beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no unnecessary words, front-loading the action ('Get') and resource ('your tailnet settings') immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description provides enough context through examples to understand what the tool returns. It could be more detailed about the exact structure, but for a simple get operation it is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters in the input schema (baseline 4), and the description does not add parameter-specific information since none exist. The examples in the description hint at return values, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves tailnet settings and provides specific examples (device approval, key expiry, HTTPS certificates), making the purpose immediately understandable. It distinguishes itself from the sibling tool `tailscale_update_tailnet_settings` which modifies settings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly indicates read-only use but does not explicitly mention when to use this tool versus alternatives like the update sibling. The context signals (readOnlyHint) reinforce this, but the description lacks direct guidance on when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_userARead-onlyIdempotent
Get details for a specific user.
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes | The user ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint. The description adds no behavioral context beyond 'Get details', which is expected for a read operation. It could mention the return format or scope of details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. Efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get operation with no output schema, the description is adequate but lacks detail on what 'details' are returned (e.g., email, role, status). Slightly incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the userId parameter documented. The description does not add extra meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and resource 'user', and narrows to 'a specific user', distinguishing it from tailscale_list_users and other user manipulation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: use this to get details for a specific user by ID. However, it does not explicitly mention when not to use it or alternative tools like tailscale_list_users for finding a user.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_user_inviteARead-onlyIdempotent
Get details for a specific user invite.
| Name | Required | Description | Default |
|---|---|---|---|
| inviteId | Yes | The user invite ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, fully conveying the tool's safety profile. The description adds no additional behavioral context beyond confirming it retrieves details. It neither contradicts nor enriches the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence of 7 words with no redundancy. Every word contributes to the core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (single parameter, no output schema), the description is functional. However, it omits any hint about the return value ('details' is vague), which would help an agent understand what information to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema description coverage, the schema already documents the inviteId parameter. The description adds no extra meaning or usage guidance for the parameter, staying at the baseline level.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Get details for a specific user invite,' specifying the verb (Get) and resource (details for a specific user invite). This distinguishes it from sibling tools like list (tailscale_list_user_invites), create, delete, and resend.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives, nor does it mention prerequisites or context. Usage is implied by the name and description, but no exclusions or alternative tool references are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_get_webhookARead-onlyIdempotent
Get details for a specific webhook.
| Name | Required | Description | Default |
|---|---|---|---|
| webhookId | Yes | The webhook ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. Description adds no additional behavioral context beyond 'Get details'. Consistent but not enhancing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly concise: single sentence clearly states purpose. No unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema; description does not hint at return value contents (e.g., webhook details). For a simple read tool, some indication of the response shape would be beneficial but not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, parameter description 'The webhook ID' is adequate. Description adds no extra meaning beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states verb 'Get details' and resource 'specific webhook'. Distinguished from sibling 'tailscale_list_webhooks' which lists all webhooks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance. The specificity is implied but could be improved by referencing the list sibling tool for when to use each.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_device_invitesARead-onlyIdempotent
List all device invites for a specific device.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID to list invites for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds no extra behavioral context beyond the resource scope, which is adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It earns its place by being direct and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple list tool but lacks guidance on response format, pagination, or filtering, which could be helpful given no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema coverage is 100% with one parameter. The description adds no additional meaning beyond what the schema already provides for deviceId.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List', the resource 'device invites', and the scope 'for a specific device', distinguishing it from sibling invite tools like create, get, or delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage requires a device ID but provides no explicit guidance on when to use this tool versus alternatives like tailscale_get_device_invite for a single invite.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_devicesARead-onlyIdempotent
List all devices in your tailnet with their status, IP addresses, OS, and last seen time.
| Name | Required | Description | Default |
|---|---|---|---|
| fields | No | Comma-separated list of fields to include. Omit for all fields. Valid fields: addresses, advertisedRoutes, authorized, blocksIncomingConnections, clientConnectivity, clientVersion, connectedToControl, created, distro, enabledRoutes, expires, hostname, id, isExternal, keyExpiryDisabled, lastSeen, machineKey, name, nodeId, nodeKey, os, sshEnabled, tags, tailnetLockError, tailnetLockKey, updateAvailable, user. Use 'all' for every field. | |
| filters | No | Server-side filters as key-value pairs. Filter by any top-level device property (e.g. { isEphemeral: 'true', os: 'linux', tags: 'tag:prod' }). Multiple filters are ANDed together. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide readOnlyHint, destructiveHint, etc., so safety is clear. Description adds that returned data includes status, IP addresses, OS, and last seen time, but lacks details on pagination, rate limits, or other behaviors. With annotations covering the core traits, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that conveys essential purpose and output fields. No redundant information, perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full schema documentation and read-only annotations, the description is nearly complete. However, there is no output schema, and the description only hints at return fields. Still, for a listing tool with good annotations, it covers most needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; both parameters (fields, filters) are well-documented in the schema. The description does not add extra parameter meaning, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states listing all devices in a tailnet with specific fields (status, IP, OS, last seen). Verb 'list' and resource 'devices' are unambiguous, and it distinguishes from sibling tools like tailscale_get_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or alternatives. Usage is implied by name and purpose, but there is no guidance on when not to use this or when to prefer a similar tool (e.g., tailscale_get_device for a single device).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_keysARead-onlyIdempotent
List keys in your tailnet. By default lists auth keys only. Set 'all' to true to include OAuth clients and federated identities.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | When true, returns all key types (auth keys, OAuth clients, federated identities). Default: false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the description adds minimal behavioral context beyond restating the listing behavior. No additional traits like pagination or rate limits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences, no wasted words, and effectively communicates the core purpose and parameter behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional boolean and no output schema, the description is complete. It covers the purpose, default behavior, and parameter effect, complemented by sufficient annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage, the parameter is fully documented. The description only reiterates that the default is auth keys only, adding no new meaning beyond the schema's description of the 'all' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists keys in a tailnet, specifying the default behavior (auth keys only) and the optional 'all' parameter for broader scope. It distinguishes from sibling tools like tailscale_get_key for single keys.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on default vs extended usage, but does not explicitly mention when to prefer sibling tools like tailscale_get_key for specific keys.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_log_stream_configsARead-onlyIdempotent
List all log streaming configurations for your tailnet. Fetches both 'configuration' (audit) and 'network' (flow) log stream configs. Log streaming sends logs to external destinations like Axiom, Datadog, Splunk, Elasticsearch, or S3.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by specifying that both configuration and network log stream configs are fetched and explaining the purpose of log streaming. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two concise sentences. The first sentence front-loads the primary action and scope. The second adds relevant detail about log streaming destinations. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a list operation with no output schema, the description explains what is listed and why. It mentions the two types and external destinations. While it does not discuss pagination or return format, these are reasonable omissions for a simple list with likely few entries.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, and schema description coverage is 100% (vacuous). According to guidelines, baseline is 4 for 0 params. The description does not need to add parameter semantics since there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists all log streaming configurations for the tailnet, specifies two types (configuration and network), and explains the purpose of log streaming to external destinations. The name and description distinguish it from related tools like get, set, delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for what the tool does but does not explicitly state when to use it versus alternatives. It implies that this tool is for viewing all configs, while other tools (e.g., get, set, delete) are for specific operations. No exclusions or when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_oauth_appsARead-onlyIdempotent
List the OAuth Apps registered in your tailnet (Tailscale alpha). Returns an oauthApps array describing each app (id, name, redirect URIs, scopes). Client secrets are NOT included -- a secret is only returned once, by tailscale_create_oauth_app at creation time. This is how you recover the id of an app you did not record; pass that id to tailscale_delete_oauth_app to revoke it.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, it discloses the key behavioral caveat: client secrets are never included and are returned only once at creation time. It also states the response contains an oauthApps array with id, name, redirect URIs, and scopes, which is materially useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: what the tool does, what it returns, and the critical secret caveat plus a usage workflow. The most important caveat is placed prominently rather than buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless list operation with strong annotations, the description covers behavior, return contents, an important exclusion (secrets), and a concrete downstream use. Nothing needed for correct invocation or interpretation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no parameters, so the description correctly focuses on return data rather than parameter semantics. The baseline of 4 applies because parameter documentation is not needed with an empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('OAuth Apps registered in your tailnet'), and it clarifies the scope and output shape. It is clearly distinguishable from sibling tools like tailscale_get_oauth_app, tailscale_create_oauth_app, and tailscale_delete_oauth_app.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly identifies a use case: recover the id of an app you did not record, then pass it to tailscale_delete_oauth_app. It does not explicitly contrast with tailscale_get_oauth_app, but the list-vs-get distinction and the recovery/revocation workflow give sufficient guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_org_tailnetsARead-onlyIdempotent
List the tailnets in your organization, including API-only tailnets created via the API. Paginated: returns at most limit results (Tailscale defaults to 100) plus a cursor. Pass that cursor back to fetch the next page; an empty cursor in the response means you have reached the end. Requires OAuth authentication.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max tailnets to return in this page. Omit to use Tailscale's default of 100. | |
| cursor | No | Pagination cursor from a previous response. Omit for the first page. | |
| organization | No | Organization ID. Defaults to '-' (the organization owning the calling credentials). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the operation read-only, idempotent, and non-destructive. The description adds valuable behavioral detail beyond those: pagination behavior, a concrete default limit of 100, and the cursor-based termination condition. This gives the agent an accurate model of how the tool behaves at runtime.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences that front-load the core purpose, then cover pagination and authentication with zero redundancy. Every sentence earns its place and no space is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with no output schema and fully documented optional parameters, the description is complete. It explains scope, pagination semantics, default behavior, termination condition, and authentication requirements, so an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description goes slightly beyond the schema by explaining the pagination contract: pass the cursor back, and an empty cursor signals the last page. This adds useful semantic meaning to the 'cursor' parameter beyond its schema description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('tailnets in your organization'), and adds the scope detail 'including API-only tailnets created via the API.' This clearly distinguishes it from related sibling tools like create_org_tailnet and delete_tailnet.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear operational context: it explains pagination flow, the meaning of an empty cursor, and OAuth authentication requirements. It does not explicitly name alternatives or say when not to use this tool, but the listing semantics are unambiguous and the context provided is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_posture_integrationsARead-onlyIdempotent
List all device posture integrations configured for your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint. The description adds minimal behavioral context ('configured for your tailnet') but does not contradict annotations. With strong annotation coverage, a score of 3 is appropriate; the description does not add significant behavioral detail beyond what is already structured.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence that front-loads the action and resource. Every word earns its place; no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and no output schema, the description adequately explains the tool's purpose. It could mention that the result is a list, but 'List' implies that. Overall, it is complete for a simple listing tool with comprehensive annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the input schema is fully covered. The description does not need to add parameter details. Baseline of 4 for 0-param tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and resource 'device posture integrations', clearly distinguishing it from sibling tools like tailscale_get_posture_integration (single item) and mutation tools. It also specifies scope ('all ... configured for your tailnet').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives (e.g., when to list vs get). While the name and description imply listing, for an AI agent, explicit differentiation from tailscale_get_posture_integration would improve usability. The lack of parameters reduces the need, but it is still a gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_service_hostsARead-onlyIdempotent
List devices hosting a specific Tailscale Service.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceName | Yes | The service name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description restates the purpose without adding behavioral context beyond what annotations provide, such as side effects, response size, or pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word is necessary and directly conveys the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple list tool with one parameter and rich annotations. However, without an output schema, it could hint at the return format (e.g., a list of device identifiers). Missing this context makes it less complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single parameter 'serviceName' described as 'The service name'. The description does not add further meaning (e.g., format, allowed values, or how to obtain the name). Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List devices hosting a specific Tailscale Service' clearly states the action (List), resource (devices hosting a service), and specificity (specific Tailscale Service). It distinguishes from siblings like tailscale_list_services which lists services themselves.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing hosts of a service but provides no explicit guidance on when to use this over alternative list tools (e.g., tailscale_list_services) or any preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_servicesARead-onlyIdempotent
List all Tailscale Services in your tailnet. Services provide stable MagicDNS names and virtual IPs, decoupled from individual devices. Note: services are created implicitly when a node first advertises one (tailscale up --advertise-services=svc:name); there is no API endpoint to create a service from this MCP. Use the update/delete/approval tools here once the service exists.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds valuable context about service lifecycle (implicit creation, no create endpoint) that is not in annotations, enhancing transparency beyond structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences plus a note, front-loading the core purpose. Every sentence serves a distinct role: statement of function, explanation of creation mechanism, and guidance on related tools. No superfluous content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (list all, no params) and lack of output schema, the description covers the essential usage. However, it does not describe the return format or fields, which could aid an agent in downstream processing. Still, the core action is fully specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters. The description does not need to add parameter meaning because there are none. The schema coverage is 100% (empty schema), and the description correctly implies no input is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists all Tailscale Services in the tailnet. The verb 'List' and resource 'Tailscale Services' are specific. It distinguishes itself from sibling list tools (e.g., list_devices, list_keys) by naming a different resource type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly notes that services are created implicitly via `tailscale up` and that there is no API to create them via this MCP. It directs users to use update/delete/approval tools once the service exists, providing clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_user_invitesARead-onlyIdempotent
List all user invites for your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint; description adds no extra behavioral traits. It is accurate but does not provide additional context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with purpose, no extra words. Efficient and clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and no output schema, the description adequately conveys the action. Could mention pagination or response format, but not essential for completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, and schema coverage is 100%. Description adds nothing beyond what the schema provides, which is baseline 4 for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states verb 'List' and resource 'user invites' with scope 'all for your tailnet'. It is specific and distinguishes from siblings like get_user_invite which retrieves a single invite, and create_user_invite which creates one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use versus alternatives, though the purpose is straightforward. Implied usage for listing all invites, but lacks when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_usersARead-onlyIdempotent
List all users in your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| role | No | Filter by user role | |
| type | No | Filter by user type: 'member' (direct members), 'shared' (shared-in users), or 'all' (default) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds no behavioral context beyond the scope of listing all users, which is already implied by the tool name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words, front-loaded with the essential purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and simple optional filters, the description is mostly complete. However, it doesn't describe the return format or any pagination behavior, which could be inferred but not guaranteed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters having descriptions in the schema (role and type filters). The description adds no additional meaning beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'List all users in your tailnet' is a specific verb+resource combination, clearly distinguishing it from sibling tools like tailscale_get_user (single user) and tailscale_list_user_invites (invites).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for listing all users, but provides no explicit guidance on when to use this tool vs alternatives (e.g., tailscale_get_user for a specific user). No when-not-to-use or filtering context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_list_webhooksARead-onlyIdempotent
List all webhooks configured for your tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false. The description adds no additional behavioral context (e.g., response structure or limits), but does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that is front-loaded and contains no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with no parameters and adequate annotations, the description is complete enough. It could mention that it returns a list, but the verb 'list' implies this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so coverage is 100%. With 0 parameters, the baseline score is 4; the description does not need to add parameter information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The tool name and description clearly state it lists all webhooks for the tailnet. This distinguishes it from siblings like tailscale_get_webhook (singular) and mutation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives (e.g., for a single webhook, use tailscale_get_webhook). It only states what the tool does.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_preview_aclARead-onlyIdempotent
Preview the ACL rules that would apply to a specific user or IP address if a proposed policy were applied.
| Name | Required | Description | Default |
|---|---|---|---|
| type | Yes | Preview type: 'user' to see rules for a user, 'ipport' to see rules for an IP | |
| policy | Yes | The proposed ACL policy text to preview | |
| previewFor | Yes | The user email (for type 'user') or IP:port (for type 'ipport') to preview rules for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds the 'Preview' context, confirming it is a safe, non-modifying operation. It does not disclose additional behaviors like rate limits, response format, or any prerequisites. Since annotations cover the key safety profile, the description does not need to repeat them, but it adds limited new behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 20 words, front-loading the key action 'Preview the ACL rules'. No extraneous information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 3 required parameters with full schema descriptions and annotations that cover safety. However, there is no output schema, and the description does not hint at what the response contains (e.g., a list of rules or a summary). For a preview tool, mentioning the return format would improve completeness. Given the simplicity and available metadata, the description is adequate but leaves a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with each parameter described. The description adds value by linking parameters to the preview context: 'specific user or IP address' relates to previewFor, and 'proposed policy' relates to policy. It also clarifies the enum for 'type' by mentioning user and IP address. This contextual meaning goes beyond the schema descriptions, justifying a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: previewing ACL rules that would apply to a specific user or IP address under a proposed policy. It uses a specific verb ('Preview') and identifies the resource ('ACL rules') and scope ('specific user or IP address'). This distinguishes it from sibling tools like tailscale_get_acl (get current ACL) and tailscale_validate_acl (validate whole policy).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: to see rules for a specific entity under a proposed policy. It provides clear context but does not explicitly exclude cases or mention alternatives such as tailscale_validate_acl for whole-policy validation. The absence of explicit 'when-not-to-use' guidance prevents a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_rename_deviceAIdempotent
Set the name of a device in the tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The new name for the device (FQDN within your tailnet) | |
| deviceId | Yes | The device ID to rename |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=true. The description adds no extra behavioral context beyond 'set', such as effects on DNS or device connectivity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no unnecessary words, directly states the action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple mutation with two well-documented parameters and annotations covering safety, the description is sufficiently complete. Could add note about name uniqueness but not essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions (e.g., 'FQDN within your tailnet'). The description adds no additional meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Set the name of a device in the tailnet' uses a specific verb ('Set') and resource ('name of a device'), clearly distinguishing it from sibling tools like tailscale_get_device or tailscale_delete_device.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The purpose implies it's for changing a device name, but lacks context such as prerequisites or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_resend_contact_verificationA
Resend the verification email for a tailnet contact.
| Name | Required | Description | Default |
|---|---|---|---|
| contactType | Yes | The contact type to resend verification for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description does not contradict annotations; it aligns with readOnlyHint=false and destructiveHint=false. However, it adds little beyond the annotations, i.e., no mention of side effects or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 10 words, no wasted content. Front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter tool with no output schema, the description provides the essential purpose. Could mention that it only works for unverified contacts, but it's nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; the parameter has a description in the schema. The tool description does not add extra meaning beyond the schema, so baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'resend' and resource 'verification email for a tailnet contact', clearly distinguishing it from sibling tools like tailscale_set_contacts and tailscale_get_contacts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool, prerequisites (e.g., contact must exist and be unverified), or alternatives. Only states the action without context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_resend_device_inviteB
Resend a device invite email.
| Name | Required | Description | Default |
|---|---|---|---|
| inviteId | Yes | The device invite ID to resend |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate the tool is not read-only, not destructive, and not idempotent. The description adds 'resend' which implies a mutation (sending email), but no further behavioral details (e.g., whether it invalidates the previous invite) are provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the key action. It is efficient but could benefit from additional context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple mutation with one parameter and no output schema, the description is minimally adequate. However, it lacks information about preconditions (e.g., invite must exist) or the effect (sends another email), which would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the parameter 'inviteId' is already well-described in the schema as 'The device invite ID to resend'. The description adds no additional meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Resend a device invite email' clearly states the verb (resend) and resource (device invite email), distinguishing it from sibling tools like create, delete, or list invites.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., creating a new invite). The required 'inviteId' parameter implies the invite must already exist, but this is not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_resend_user_inviteB
Resend a user invite email.
| Name | Required | Description | Default |
|---|---|---|---|
| inviteId | Yes | The user invite ID to resend |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate a non-read-only, non-destructive mutation. The description adds no further behavioral context (e.g., email sending details, idempotency implications), but does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no redundancy. It is well-structured and immediately identifies the tool's purpose, though it could benefit from slightly more detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema and the minimal annotation, the description does not explain the result or side effects (e.g., whether the email is resent, or if the invite must be pending). This leaves gaps for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'inviteId' is fully described in the schema. The description adds no additional meaning beyond what the schema provides, so baseline score applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Resend a user invite email', using a specific verb and resource. It distinguishes effectively from sibling tools like tailscale_resend_device_invite by specifying 'user invite'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., creating a new invite or checking status). The agent might not know prerequisites or limitations such as invite state or rate limits.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_restore_userAIdempotent
Restore a previously suspended user, re-granting them access to the tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes | The user ID to restore |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true (safe to retry) and destructiveHint=false. The description adds 're-granting access', confirming it is a non-destructive mutation. However, it does not elaborate on side effects like permission restoration or behavior if the user is already active. With annotations covering safety, the description adds moderate value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 10 words, directly stating the purpose without any filler. It is front-loaded and highly concise, meeting the standard for efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no output schema, and informative annotations including idempotentHint), the description is nearly complete. It lacks details about return value or edge cases (e.g., user not suspended), but for a straightforward restore operation, the provided information is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a single parameter 'userId' described as 'The user ID to restore'. The description does not add additional semantic meaning beyond what the schema provides, so a baseline score of 3 is appropriate per guidelines.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Restore'), the target ('previously suspended user'), and the effect ('re-granting them access to the tailnet'). It distinguishes from sibling tools like tailscale_suspend_user and tailscale_delete_user by specifying the restoration of a suspended user.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for restoring a suspended user but does not explicitly provide when-to-use guidance or differentiate from alternatives like tailscale_approve_user or tailscale_resend_user_invite. No exclusions or when-not-to-use are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_rotate_webhook_secretA
Rotate a webhook's secret. Returns the new secret — save it immediately, as it cannot be retrieved again. The old secret is immediately invalidated.
SECURITY: the response body contains the secret verbatim. MCP clients commonly persist tool responses to logs and conversation transcripts; treat this response as sensitive.
| Name | Required | Description | Default |
|---|---|---|---|
| webhookId | Yes | The webhook ID whose secret to rotate |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds significant behavioral context beyond annotations: the old secret is immediately invalidated, the new secret must be saved immediately, and a security warning about response handling. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise paragraphs: first describing the action and critical behaviors, second a security warning. No extraneous content; every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for this simple rotation tool. It explains the return value (new secret), its sensitivity, and the effect on the old secret. No output schema is needed given the clear return description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter (webhookId), and the description does not add new details about the parameter beyond what the schema provides. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'rotate' and the resource 'webhook's secret', with explicit details about the behavior (returns new secret, old invalidated). It distinguishes from sibling tools like delete or update webhooks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for secret rotation but does not explicitly state when to use this tool versus alternatives (e.g., update_webhook or delete_webhook). It lacks explicit when-not or alternative tool references.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_contactsAIdempotent
Update tailnet contact information. Each provided contact type (account/support/security) is PATCHed in parallel; per-type errors are returned alongside the successes so a partial failure doesn't lose the work that succeeded. On partial failure the response is data: { applied, failed } -- inspect data.failed for per-type error details.
| Name | Required | Description | Default |
|---|---|---|---|
| account | No | Account contact email | |
| support | No | Support contact email | |
| security | No | Security contact email |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes beyond annotations by detailing the parallel PATCH behavior and partial failure handling with response structure ({ applied, failed }). Annotations already indicate idempotentHint=true and destructiveHint=false, so the description adds valuable behavioral context. Score 4 for meaningful additional transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loading the purpose and then explaining key behavioral details (parallel PATCH, partial failure). No redundant words or repetition. Ideal conciseness for the complexity level.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is no output schema, the description adequately covers the update mechanism and error response. It explains the optional nature of parameters (any subset can be provided) and partial failure handling. However, it could mention that this is for tailnet-level contacts, which is clear from context. Score 4 for covering essential behavioral aspects without major gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with each parameter having a brief description (e.g., 'Account contact email'). The tool description adds that parameters are patched in parallel but does not elaborate on parameter syntax or constraints. Baseline is 3 due to high schema coverage, and the description provides marginal added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Update' and resource 'tailnet contact information', specifying the three contact types (account/support/security). It does not explicitly differentiate from the sibling 'tailscale_get_contacts', but the action is distinct enough. A score of 4 reflects good clarity without explicit sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lacks any guidance on when to use this tool versus alternatives like 'tailscale_get_contacts' or 'tailscale_resend_contact_verification'. It describes the update behavior but does not provide context for selection, resulting in a score of 2 for missing when-to-use and when-not-to-use instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_device_ipBIdempotent
Set the Tailscale IPv4 address for a device.
| Name | Required | Description | Default |
|---|---|---|---|
| ipv4 | Yes | The new Tailscale IPv4 address for the device (e.g. '100.64.0.1') | |
| deviceId | Yes | The device ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral details beyond annotations. It does not explain what happens to the device (e.g., connectivity), permissions needed, or side effects. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, short sentence with no wasted words. Efficient and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite low complexity (2 required params, no output schema), the description omits important context like constraints on the IP address (e.g., subnet) or whether the change takes effect immediately. This is insufficient for a potentially impactful operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents both parameters and their formats. The description adds no additional meaning, fitting the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Set) and resource (Tailscale IPv4 address for a device), making it distinct from sibling tools like set_device_tags or set_device_routes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites or exclusions mentioned. The idempotent annotation is present but not described.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_device_posture_attributeAIdempotent
Set a custom posture attribute on a device. Creates or updates the attribute. Attribute keys must start with 'custom:'. Useful for compliance tracking, JIT access, and custom security policies.
| Name | Required | Description | Default |
|---|---|---|---|
| value | Yes | The attribute value (string, number, or boolean) | |
| expiry | No | Optional expiry time in RFC3339 format (e.g. '2026-12-01T00:00:00Z'). Attribute is automatically removed after expiry. | |
| deviceId | Yes | The device ID | |
| attributeKey | Yes | The attribute key (must start with 'custom:', e.g. 'custom:lastAuditDate') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish that this is a mutating, idempotent, non-destructive operation. The description adds behavioral context by explaining the create-or-update behavior, the required 'custom:' key prefix, and practical use cases. It does not discuss auth requirements or side effects, but the annotation coverage lowers the burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences with the main action front-loaded, followed by the key constraint and intended use cases. Every sentence adds useful information and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For this simple set operation, the combination of annotations, complete schema descriptions, and a concise tool description provides everything an agent needs: behavior, idempotency, key format, value types, optional expiry, and likely use cases. An output schema is not necessary for a setter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter documented including type constraints and expiry behavior. The tool description only restates the 'custom:' prefix already present in the attributeKey description, so it adds no new parameter-level meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Set'), the resource ('custom posture attribute on a device'), and the create-or-update semantics. This distinguishes it from sibling tools like getting, deleting, or batch-updating posture attributes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives implied use cases ('compliance tracking, JIT access, and custom security policies') but never explicitly says when to choose this tool over tailscale_batch_update_posture_attributes or when not to use it. No exclusions or alternative routing are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_device_routesADestructiveIdempotent
Set the enabled subnet routes for a device. Replaces all currently enabled routes — pass the full list of routes you want enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| routes | Yes | Full list of CIDR routes to enable (e.g. ['10.0.0.0/24', '192.168.1.0/24']). Replaces existing enabled routes. | |
| deviceId | Yes | The device ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and idempotent behavior, but the description adds meaningful context by explicitly stating that existing routes are replaced and instructing the agent to pass the complete desired list. This goes beyond the structured annotations and clarifies the real-world effect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The core action is stated first, followed immediately by the critical behavioral caveat about replacing routes, making it highly efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter, no-output-schema tool, the description covers the essential operational behavior: setting routes, replacing all current routes, and needing the full list. A brief pointer to get_device_routes as a prerequisite would make it fully complete, but the current description provides enough context for correct invocation in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the routes parameter already explaining that it is the full list and replaces existing routes. The description reinforces this behavior but does not add additional parameter-level detail beyond what the schema already provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Set') with a clear resource ('enabled subnet routes for a device'). It clearly distinguishes itself from 'get_device_routes' and other device configuration tools by specifying the action and object.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains an important usage constraint: routes are replaced wholesale, so the caller must pass the full list. However, it does not explicitly tell the agent when to prefer this tool over alternatives or suggest using get_device_routes first, leaving some usage context implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_devices_authorizedADestructiveIdempotent
Authorize or deauthorize multiple devices in one call. Each device's POST runs in parallel; per-device errors are returned alongside the successes so a partial failure doesn't lose the work that succeeded. On partial failure the call still returns success (ok) with data: { authorized, succeeded, failed } -- inspect data.failed for the per-device errors. Common use: authorize a batch of newly-enrolled CI hosts, or deauthorize a group of devices flagged by a security review.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceIds | Yes | Device IDs to update | |
| authorized | Yes | true to authorize, false to deauthorize |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes parallel execution and partial failure behavior in detail, including return format on partial failure. Annotations indicate mutation and destructiveness, but description adds significant value beyond those.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences plus a use-case sentence. No unnecessary words, front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers partial failure return format well. Missing general return schema (e.g., full success structure), but given no output schema, description compensates with key behavioral details. Slight gap for all-success case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. Description does not add additional meaning or examples for the two parameters beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states 'Authorize or deauthorize multiple devices in one call' with specific verb and resource. The name and title reinforce this, and it distinguishes from sibling single-device authorize/deauthorize tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit common use cases (batch CI hosts, security review). Implicitly distinguishes from single-device tools, but does not explicitly state 'use single-device tools for one device'. Still clear context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_device_tagsADestructiveIdempotent
Set ACL tags on a device. Replaces all existing tags — pass the full list of tags you want applied.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | Yes | Full list of ACL tags (e.g. ['tag:server', 'tag:production']). Replaces all existing tags. | |
| deviceId | Yes | The device ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explicitly discloses the key destructive behavior: all existing tags are replaced. This meaningfully supplements the annotations' destructiveHint=true by clarifying what exactly gets overwritten. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, each earning its place. The primary action comes first, and the most important caveat about replacing tags is front-loaded and unambiguous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter mutation, the description plus annotations and schema provide enough for an agent to call it correctly. It would benefit from noting whether authorization or current device state is needed, but the core behavior is fully covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters are already clearly documented, including the full-list replacement semantics on tags. The description reinforces this but adds little beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: setting ACL tags on a device. It immediately distinguishes the tool from device mutation siblings by naming the specific resource (ACL tags) and the critical replacement behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives like other set_* device tools or the ACL-specific tools. It communicates how to invoke it but not when it is the right choice among the many sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_dns_configurationADestructiveIdempotent
Set the unified DNS configuration for your tailnet in a single call. Replaces all DNS settings (nameservers, search paths, split DNS, MagicDNS preference).
| Name | Required | Description | Default |
|---|---|---|---|
| dns | No | List of DNS server IP addresses | |
| magicDNS | No | Whether to enable MagicDNS | |
| splitDns | No | Map of domain to nameserver list for split DNS | |
| searchPaths | No | List of DNS search domains |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal destructiveHint=true, readOnlyHint=false, and idempotentHint=true. The description adds valuable context by specifying exactly what gets overwritten—'nameservers, search paths, split DNS, MagicDNS preference'—going beyond the generic destructive annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences front-load the verb and resource, then state the effect. There is no redundancy, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description plus schema covers the atomic replacement behavior, the four parameter groups, and the nested splitDns structure. It does not explicitly state the effect of omitting a parameter (e.g., cleared vs. left unchanged), but 'Replaces all DNS settings' strongly implies full replacement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description maps the four parameter groups (dns, searchPaths, splitDns, magicDNS) to 'nameservers, search paths, split DNS, MagicDNS preference' but does not add syntax, defaults, or behavior beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the specific verb 'Set', the resource 'unified DNS configuration for your tailnet', and the qualifier 'in a single call'. It then enumerates what is replaced, which clearly distinguishes it from sibling tools like tailscale_set_nameservers, tailscale_set_search_paths, and tailscale_set_dns_preferences.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'in a single call' and 'Replaces all DNS settings' clearly conveys this is the comprehensive DNS configuration endpoint, contrasting with the piecemeal setter siblings. It does not explicitly name when-not-to-use or list alternatives, but the unified-vs-specific context is strong and easily inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_dns_preferencesBIdempotent
Set DNS preferences for your tailnet, such as enabling or disabling MagicDNS.
| Name | Required | Description | Default |
|---|---|---|---|
| magicDNS | Yes | Whether to enable MagicDNS |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate it's a write operation (readOnlyHint=false), idempotent (idempotentHint=true), and non-destructive (destructiveHint=false). The description adds minimal behavioral context beyond mentioning MagicDNS toggling. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 12 words, with no filler. Every word adds value, and it front-loads the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter boolean toggle, the description is adequate. It covers the main use case (MagicDNS). However, given many sibling DNS tools, a brief note on what 'preferences' means relative to other DNS settings would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the 'magicDNS' boolean parameter. The description reiterates the example but does not add new meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it sets DNS preferences for the tailnet, using a specific verb and resource, with an example of MagicDNS. It distinguishes from get tools, but could be more explicit about how it differs from tailscale_set_dns_configuration or other set tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like tailscale_set_dns_configuration, tailscale_set_nameservers, or tailscale_set_search_paths. The description only states what it does, not when to prefer it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_log_stream_configAIdempotent
Set the log streaming configuration for a specific log type. Configures where logs are sent (e.g. Axiom, Datadog, Splunk, Elasticsearch, S3).
Per-destination required fields:
splunk / elastic / panther / cribl / datadog / axiom: url + token (user optional)
s3: s3Bucket + s3Region + s3AuthenticationType, plus either (s3AccessKeyId + s3SecretAccessKey) for 'accesskey' auth or s3RoleArn for 'rolearn' auth. Call tailscale_create_aws_external_id first when using 'rolearn'.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Destination URL (required for non-s3 destinations) | |
| user | No | Username for the destination (if required) | |
| token | No | Authentication token or API key for the destination. SENSITIVE: passed straight to Tailscale and not echoed back, but MCP clients may log the input value you supply. | |
| logType | Yes | The log type: 'configuration' for audit logs, 'network' for network flow logs | |
| s3Bucket | No | (s3 only) S3 bucket name. Required when destinationType is 's3'. | |
| s3Region | No | (s3 only) AWS region of the S3 bucket. Required when destinationType is 's3'. | |
| s3RoleArn | No | (s3 only) IAM role ARN that Tailscale will assume. Required when s3AuthenticationType is 'rolearn'. | |
| s3KeyPrefix | No | (s3 only) Optional prefix prepended to the auto-generated S3 object key. | |
| s3AccessKeyId | No | (s3 only) AWS access key id. Required when s3AuthenticationType is 'accesskey'. | |
| destinationType | Yes | The log streaming destination type | |
| compressionFormat | No | Compression algorithm for log uploads. Defaults to 'none'. | |
| s3SecretAccessKey | No | (s3 only) AWS secret access key. Required when s3AuthenticationType is 'accesskey'. SENSITIVE: see the token field's note about MCP client logging. | |
| uploadPeriodMinutes | No | Minutes to wait between uploads (1-1440). Optional. | |
| s3AuthenticationType | No | (s3 only) Authentication mode. Required when destinationType is 's3'. Tailscale recommends 'rolearn'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent and non-destructive behavior. The description adds useful context about per-destination required fields and the prerequisite for S3 role ARN. It does not contradict annotations and provides additional behavioral detail beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized with two paragraphs. It front-loads the purpose and then provides structured per-destination details. Slightly more could be streamlined, but it is effective and not verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of the tool (14 parameters), the description covers the main use case and conditional requirements. However, it does not explain what the return value is (likely the updated config) or any side effects like overwriting existing config. For a setter with no output schema, this gap reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds value by grouping parameters by destination type and specifying required combinations (e.g., url+token for non-s3, bucket+region+authentication for s3), which goes beyond the individual parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Set the log streaming configuration') and the resource ('for a specific log type'), and distinguishes it from sibling tools like get/delete/list. The verb and resource are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly guides usage by listing per-destination required fields and includes a critical prerequisite ('Call tailscale_create_aws_external_id first when using rolearn'). However, it does not explicitly state when to use this tool vs alternatives like get/delete/log stream configs, though the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_nameserversADestructiveIdempotent
Set the DNS nameservers for your tailnet. Replaces all existing nameservers.
| Name | Required | Description | Default |
|---|---|---|---|
| dns | Yes | List of DNS server IP addresses (e.g. ['8.8.8.8', '1.1.1.1']) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations: 'Replaces all existing nameservers' explicitly describes the destructive effect, aligning with destructiveHint=true and idempotentHint=true. It does not contradict the annotations and tells the agent what gets overwritten, which is the most important behavioral trait for this operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The primary action is front-loaded, and the destructive replacement warning is the second sentence, earning its place as critical behavioral information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter setter with annotations covering mutation and destructiveness, the description is largely complete: it names the target resource, the scope (tailnet), and the destructive replacement behavior. It does not describe the response/return value, but this is a simple mutation tool and the absence is not a major gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the dns parameter is well documented with a type and example ('8.8.8.8', '1.1.1.1'). The tool-level description does not add parameter semantics beyond what the schema already provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Set') and resource ('DNS nameservers for your tailnet'), and the second sentence clarifies the mutation semantics. It is distinct from tailscale_get_nameservers by verb and from set_search_paths/set_dns_preferences by resource, though it does not explicitly name or contrast those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as tailscale_set_dns_configuration, tailscale_set_search_paths, or tailscale_get_nameservers. The description implies its use through the name and resource but provides no exclusions, prerequisites, or conditional routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_search_pathsADestructiveIdempotent
Set the DNS search paths for your tailnet. Replaces all existing search paths.
| Name | Required | Description | Default |
|---|---|---|---|
| searchPaths | Yes | List of DNS search domains (e.g. ['example.com', 'internal.corp']) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context beyond the annotations by explicitly stating that all existing search paths are replaced. This clarifies the destructive scope of the operation beyond the generic destructiveHint=true annotation, telling the agent this is a full-state overwrite rather than an incremental update.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The core purpose is front-loaded, and the essential replacement behavior is stated in the second sentence. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter mutation with complete schema coverage, the description adequately conveys what the tool does and its destructive replacement behavior. It does not mention return values or prerequisites, but the low complexity and existing annotations reduce the need for further detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents the parameter. The description adds value by making clear that searchPaths represents the complete desired set, not a delta, since it replaces all existing search paths. This helps the agent understand the semantics of the single required parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Set'), a specific resource ('DNS search paths for your tailnet'), and a key behavioral qualifier ('Replaces all existing search paths'). This clearly distinguishes it from read-only siblings like tailscale_get_search_paths and from related setter tools like tailscale_set_nameservers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given about when to use this tool versus alternatives such as tailscale_get_search_paths or tailscale_set_dns_configuration. The intended use is implied by the name and description, but there are no exclusions or conditions helping an agent choose among related DNS tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_service_device_approvalAIdempotent
Approve or reject a device to host a Tailscale Service.
| Name | Required | Description | Default |
|---|---|---|---|
| approved | Yes | Whether to approve (true) or reject (false) the device | |
| deviceId | Yes | The device ID | |
| serviceName | Yes | The service name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=true. The description adds no further behavioral context beyond stating the action. For instance, it does not disclose what happens when a device is rejected (e.g., service disruption) or whether prior approvals are overridden. Given annotation coverage, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is clear and contains no extraneous information. It is appropriately front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks context on what 'approve a device to host a Tailscale Service' entails, such as the implications of approval/rejection, the relationship between deviceId and serviceName, or expected outcomes. Since there is no output schema, additional description could help agents understand the result. However, the tool is relatively simple and the name is explanatory, so a 3 is fair.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters have descriptions in the schema (100% coverage), explaining approved, deviceId, and serviceName. The description adds no additional meaning beyond what the schema provides, so baseline score of 3 is justified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action 'approve or reject' and the resource 'device to host a Tailscale Service'. It effectively distinguishes from sibling tools like tailscale_get_service_device_approval (which retrieves) and tailscale_authorize_device (which authorizes device for tailnet, not service hosting).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when needing to approve/reject a device for service hosting), but provides no explicit guidance on when not to use this tool versus alternatives like tailscale_authorize_device or tailscale_approve_user. The context from sibling tools suggests clear separation, but the description itself lacks explicit usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_set_split_dnsADestructiveIdempotent
Set split DNS configuration. Maps domains to specific nameservers. Replaces the entire split DNS configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| splitDns | Yes | Map of domain to nameserver list (e.g. { "corp.example.com": ["10.0.0.1"], "internal.dev": ["10.0.0.2"] }) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With destructiveHint=true already present in annotations, the description still adds specific value by stating exactly what is destroyed: the entire split DNS configuration. This is meaningful behavioral context beyond the generic annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences with no filler. The most important behavioral distinction ('Replaces the entire split DNS configuration') is included prominently, and every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is only one required parameter, and the schema fully documents it. The description covers the key destructive replacement behavior, and no output schema exists, so return-value documentation is not required. An agent has enough information to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the parameter schema already explains the map-of-domain-to-nameserver-list structure with an example. The description's 'Maps domains to specific nameservers' adds little beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Set') and resource ('split DNS configuration'), then explains the behavior ('Maps domains to specific nameservers'). The sentence 'Replaces the entire split DNS configuration' also distinguishes it from tailscale_update_split_dns, so an agent can tell them apart without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly communicates that this call replaces the whole split DNS configuration, which is the key context for choosing it over an incremental update. However, it does not explicitly name the alternative or state 'use this when replacing all entries, not for partial updates,' so it stops short of fully explicit routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_statusARead-onlyIdempotent
Check that the Tailscale API connection is working. Returns your tailnet name, device count, and confirms authentication is valid. Use this to verify setup.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, idempotentHint=true, destructiveHint=false. Description adds what the tool returns (tailnet name, device count, auth confirmation), which is additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, no extraneous information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters, no output schema, and strong annotations, the description fully covers the tool's purpose and behavior. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters in schema, so description adds no param info. Schema coverage is 100% (no params), baseline for 0 params is 4, which is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it checks Tailscale API connection, returns specific data (tailnet name, device count, auth confirmation), and distinguishes from siblings, which are mostly about DNS, devices, ACLs, and settings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Use this to verify setup.' Provides clear context for when to use, though does not explicitly mention when not to use or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_suspend_userADestructiveIdempotent
Suspend a user, immediately revoking their access to the tailnet. Their devices will be disconnected. Can be reversed with tailscale_restore_user.
| Name | Required | Description | Default |
|---|---|---|---|
| userId | Yes | The user ID to suspend |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds value beyond annotations: specifies that access is revoked immediately and devices are disconnected. Annotations already indicate destructiveHint=true, but description provides concrete behavioral detail. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with primary action and effect, followed by relationship to sibling. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple single-parameter suspend tool, description covers key effects and undo path. No missing crucial context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (userId) with full schema coverage. Description adds no additional info beyond the schema's own description. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action (suspend a user) and the immediate effect (revoke access, disconnect devices). Explicitly distinguishes from sibling tailscale_restore_user by noting reversibility.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Mentions reversibility with tailscale_restore_user, guiding when to use this tool for temporary suspension. However, lacks explicit context on when not to use (e.g., permanent deletion alternatives) or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_test_webhookA
Send a test event to a webhook endpoint to verify it is configured correctly and receiving events.
| Name | Required | Description | Default |
|---|---|---|---|
| webhookId | Yes | The webhook ID to test |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-readonly and non-destructive behavior. The description adds that a test event is sent, but does not elaborate on potential side effects, rate limits, authentication requirements, or what happens to the webhook. It provides context beyond annotations but remains thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action and purpose. Every word earns its place, no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description is sufficiently complete. It explains what it does and the required input. However, it could mention the expected response (e.g., success or error), which would aid the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the parameter webhookId described as 'The webhook ID to test'. The description adds no additional meaning beyond the schema. Baseline 3 applies because schema already does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'send a test event' and the resource 'webhook endpoint', and explains the purpose 'to verify it is configured correctly and receiving events'. This distinguishes it from other webhook related tools like list, get, create, update, delete, and rotate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use after setting up a webhook, but does not explicitly state when to use versus alternatives or provide when-not-to-use guidance. It is adequate but could be improved by mentioning 'Use after creating or updating a webhook to verify configuration'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_aclADestructiveIdempotent
Update the ACL policy for your tailnet. Accepts the full policy as a string to preserve formatting, comments, and trailing commas (HuJSON). You MUST pass the ETag from tailscale_get_acl to prevent overwriting concurrent changes. Always get the current ACL first, make targeted edits to the text, and pass the full modified text back.
| Name | Required | Description | Default |
|---|---|---|---|
| etag | Yes | The ETag from tailscale_get_acl. Required to prevent concurrent edit conflicts. | |
| policy | Yes | The full ACL policy text. Preserve existing formatting, comments, and structure. Only modify the specific parts that need to change. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals important behavior beyond annotations: the policy is replaced as a full string to preserve HuJSON formatting, comments, and trailing commas, and the ETag prevents overwriting concurrent changes. This gives the agent a clear mental model of the destructive yet idempotent replace semantics that the annotations alone do not convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences deliver the action, the formatting rationale, the concurrency requirement, and the safe workflow with zero wasted words. The most critical constraint, passing the ETag, is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter update tool with a full input schema and clear annotations, the description covers what matters most: what to pass, why, and the required preceding call. No output schema exists, but return-value details are not essential for a mutating ACL update.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaningful context by explaining why the policy must be the full text and why the ETag is required, enriching both parameters beyond their schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description opens with 'Update the ACL policy for your tailnet,' a specific verb-plus-resource statement that clearly identifies the operation. It also names tailscale_get_acl as the ETag source, distinguishing this write operation from the read tool without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit workflow: get the current ACL first, make targeted text edits, and pass the full modified policy back. It clearly states the ETag prerequisite but does not explicitly compare against sibling validation tools like tailscale_validate_acl or tailscale_preview_acl, so it slightly misses the 'when not to use' bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_device_keyAIdempotent
Update a device's key settings, such as disabling key expiry. Useful for servers that should never need to re-authenticate.
| Name | Required | Description | Default |
|---|---|---|---|
| deviceId | Yes | The device ID | |
| keyExpiryDisabled | Yes | Whether to disable key expiry for this device |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the tool is not read-only, not destructive, and idempotent. The description adds context about disabling key expiry for servers, which aligns with these hints. However, it doesn't disclose potential side effects (e.g., impact on existing sessions) beyond what is inferred from the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states the purpose, second provides a practical example. No unnecessary words, and the key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter boolean update without an output schema, the description and schema together provide sufficient context. It could mention re-enabling key expiry, but the example and param names implicitly cover it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and both parameters have clear descriptions in the schema. The description echoes 'disabling key expiry' but adds no new semantic information beyond the schema. Thus, it meets the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it updates device key settings, specifically disabling key expiry, which distinguishes it from sibling tools like tailscale_rename_device or tailscale_expire_device. The verb 'Update' and resource 'device's key settings' are specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a concrete use case: 'Useful for servers that should never need to re-authenticate.' This implies when to use the tool. However, it does not explicitly mention when not to use it or differentiate from sibling tailscale_update_key (which deals with auth keys), leaving slight room for confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_keyAIdempotent
Update an existing key. Supported fields depend on the key type: all key types accept 'description'; OAuth clients and federated identities additionally accept 'scopes' and 'tags'; federated identities additionally accept 'issuer', 'subject', 'audience', and 'customClaimRules'. For auth keys, pass only 'description' — the Tailscale API will reject other fields.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Updated ACL tags (must start with 'tag:') | |
| keyId | Yes | The key ID to update | |
| issuer | No | (federated only) Updated OIDC issuer URL | |
| scopes | No | (client/federated) Updated OAuth scopes | |
| subject | No | (federated only) Updated subject claim pattern | |
| audience | No | (federated only) Updated audience claim | |
| description | No | Updated description (max 50 chars, alphanumeric/hyphens/spaces) | |
| customClaimRules | No | (federated only) Updated custom claim rules |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, idempotentHint=true, destructiveHint=false. The description adds behavioral details: supported fields per key type, rejection of unsupported fields for auth keys. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single concise paragraph, front-loaded with main action, every sentence adds distinct value – no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters (some nested) and no output schema, the description covers key-type-specific behavior and parameter usage rules thoroughly. Could mention error behavior (e.g., key not found), but overall complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds significant value by mapping fields to key types and explaining acceptance rules beyond the schema definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update an existing key', specifies supported fields per key type, and distinguishes from siblings like tailscale_create_key and tailscale_delete_key by outlining key-type-specific constraints.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context on which key types accept which fields, guiding correct invocation. However, it does not explicitly state when to use this tool versus alternatives (e.g., create or delete), though the context strongly implies it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_posture_integrationAIdempotent
Update an existing posture integration's credentials or configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| cloudId | No | Updated cloud identifier (e.g. 'us-1', 'global', or provider FQDN) | |
| clientId | No | Updated client ID for the provider | |
| tenantId | No | Updated tenant ID | |
| clientSecret | No | Updated client secret for the provider (omit to retain the existing secret). SENSITIVE: passed straight to Tailscale and not echoed back, but MCP clients may log the input value you supply. | |
| integrationId | Yes | The posture integration ID to update |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=true. The description 'Update' implies mutation but does not add details about side effects, partial vs full update, or consistency guarantees. Adequate but no extra value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence of 10 words, no fluff. Every word is necessary and front-loaded. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters, no output schema, and basic annotations, the description is minimal. It does not explain update semantics (partial vs full replacement, omitted field behavior) or return value. Adequate but not complete for complex usage scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides descriptions for all 5 parameters (100% coverage). The description does not add semantic meaning beyond the schema; it restates 'credentials or configuration.' Baseline 3 applies since schema documentation is complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Update an existing posture integration's credentials or configuration.' It uses a specific verb (update) and resource (posture integration), distinguishing it from sibling tools like create, delete, get, and list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., create_posture_integration or delete_posture_integration). It does not mention prerequisites, exclusions, or context for usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_serviceBIdempotent
Update a Tailscale Service's configuration.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ACL tags for the service | |
| ports | No | Ports the service listens on | |
| serviceName | Yes | The service name to update | |
| autoApproveHosts | No | Whether to auto-approve devices that want to host this service |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false, idempotentHint=true, destructiveHint=false, and openWorldHint=true. The description adds no behavioral context beyond what annotations provide, such as potential side effects, authentication needs, or partial update behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no extraneous words, achieving conciseness. However, it is very minimal and could benefit from additional front-loaded context without sacrificing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters and no output schema, the description is adequate but incomplete. It does not explain return values, update semantics (e.g., partial vs full replace), or which fields are updatable. Combined with annotations, it meets a basic threshold but lacks depth.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, meaning all four parameters have descriptions in the input schema. The description does not add any parameter semantics beyond what the schema already provides, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Update a Tailscale Service's configuration' clearly specifies a verb ('Update') and resource ('Tailscale Service's configuration'), effectively distinguishing it from sibling tools like tailscale_get_service (read) and tailscale_delete_service (delete).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., tailscale_update_service_device_approval) or prerequisites. The description merely states the action without contextual usage instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_split_dnsAIdempotent
Partially update split DNS configuration. Merges the provided domains with the existing config — only the specified domains are changed, others are untouched. Set a domain's nameservers to an empty array to remove it.
| Name | Required | Description | Default |
|---|---|---|---|
| splitDns | Yes | Map of domain to nameserver list to merge (e.g. { "new.example.com": ["10.0.0.3"] }). Only specified domains are changed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare mutability, idempotency, and non-destructive nature. Description adds detail about merge semantics and removal via empty array, aligning with openWorldHint and idempotentHint. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that cover the core behavior and a special case. No wasted words; front-loaded with action and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the essential behavior for a partial update tool with a nested parameter. Lacks mention of prerequisites or error conditions, but annotations compensate for many behavioral aspects. Good for the complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all parameter details with description and example. Description adds semantic value by explaining merge behavior and removal via empty array, going beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly identifies the verb (partially update), resource (split DNS configuration), and the specific merge behavior. Distinguishes from sibling tools like tailscale_set_split_dns which likely replaces the entire config.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains when to use (partial updates, merging domains) and how to remove a domain (set to empty array). Lacks explicit mention of alternatives like tailscale_set_split_dns for full replacement, but the partial update description implies its use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_tailnet_settingsBIdempotent
Update tailnet settings (device approval, auto-updates, key expiry, HTTPS certificates, network flow logging, regional routing, posture identity collection).
| Name | Required | Description | Default |
|---|---|---|---|
| httpsEnabled | No | Whether HTTPS certificates are enabled (for tailscale serve/funnel) | |
| usersApprovalOn | No | Whether user approval is required | |
| aclsExternalLink | No | URL to the external ACL management system (shown in the admin console) | |
| devicesApprovalOn | No | Whether device approval is required | |
| regionalRoutingOn | No | Whether regional routing is enabled | |
| devicesAutoUpdatesOn | No | Whether auto-updates are enabled | |
| networkFlowLoggingOn | No | Whether network flow logging is enabled | |
| devicesKeyDurationDays | No | Key expiry duration in days | |
| aclsExternallyManagedOn | No | Whether ACLs are externally managed (e.g. via GitOps) | |
| postureIdentityCollectionOn | No | Whether posture identity collection is enabled | |
| usersRoleAllowedToJoinExternalTailnets | No | Which user roles can join external tailnets |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotentHint=true and destructiveHint=false. The description adds no behavioral detail beyond listing settings categories; it does not mention partial update behavior, success response, or authorization requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, directly lists the settings categories. No unnecessary words. Efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 11 optional params and no output schema, the description explains what it does but not the return value or side effects. For a settings update tool, it is adequate but could mention what is returned (e.g., updated settings or success status).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline 3. The description lists categories but adds little meaning beyond the parameter names and their own descriptions, which are already detailed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (Update) and resource (tailnet settings), listing categories. However, it does not differentiate from the read counterpart (tailscale_get_tailnet_settings) which is a sibling tool, but the verb makes the distinction obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention that for reading settings one should use tailscale_get_tailnet_settings, nor any prerequisites or conditions for updating.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_user_roleAIdempotent
Update a user's role in the tailnet.
| Name | Required | Description | Default |
|---|---|---|---|
| role | Yes | The new role to assign | |
| userId | Yes | The user ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent, non-destructive mutation. Description adds no extra behavioral context beyond 'update'. Baseline score as annotations suffice.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single concise sentence with no redundancy. Efficiently conveys the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no description of return value. Lacks explanation of side effects or response format, though simple mutation may not require it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers 100% of parameters with descriptions. Description does not add meaning beyond schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'update a user's role in the tailnet' with a specific verb and resource. Distinguishes from sibling tools like tailscale_get_user or tailscale_approve_user.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives (e.g., approve_user, suspend_user). Lacks context for appropriate scenarios or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_update_webhookAIdempotent
Update an existing webhook's endpoint URL and/or subscriptions.
| Name | Required | Description | Default |
|---|---|---|---|
| webhookId | Yes | The webhook ID to update | |
| endpointUrl | No | New HTTPS URL to send webhook events to | |
| subscriptions | No | Updated list of event types to subscribe to (at least one) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the operation as not read-only, idempotent, and non-destructive, so the description does not need to restate those facts. It adds useful behavioral context by indicating that either endpoint URL or subscriptions, or both, can be updated in a single call, clarifying partial-update semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or redundant restatement of the tool name. Every word contributes to identifying the action, target, and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple update operation with fully documented parameters and annotations covering idempotency and destructiveness, this is nearly complete. A minor gap is the absence of any indication of the response shape or whether providing subscriptions replaces the entire subscription list rather than merging with existing ones.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with clear descriptions for webhookId, endpointUrl, and subscriptions. The tool description's 'endpoint URL and/or subscriptions' mirrors the schema's optionality without adding deeper parameter-level meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Update'), a clear resource ('existing webhook'), and the exact mutable fields ('endpoint URL and/or subscriptions'). This differentiates it from sibling tools like create_webhook, delete_webhook, rotate_webhook_secret, and test_webhook without needing to inspect schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'existing webhook' implies the tool is for modifying a webhook that already exists, providing some usage context. However, it does not explicitly state when to prefer this over create_webhook or rotate_webhook_secret, nor does it mention how to obtain a webhook ID (e.g., via list_webhooks or get_webhook).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_validate_aclARead-onlyIdempotent
Validate an ACL policy without applying it. Returns any errors found, or confirms the policy is valid.
| Name | Required | Description | Default |
|---|---|---|---|
| policy | Yes | The full ACL policy text to validate |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description confirms no application but adds no new behavioral details beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and outcome, no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single parameter, clear annotations, and simple output described, the description is complete for an agent to understand what the tool does and what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the single 'policy' parameter. The tool description does not add further meaning or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'validate' and the resource 'ACL policy', and specifies that it does not apply the policy, distinguishing it from update/apply operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for validation before applying, but does not explicitly differentiate from the sibling tool 'tailscale_preview_acl', which may serve a similar purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tailscale_validate_aws_trust_policyARead-onlyIdempotent
Validate that an AWS IAM role trust policy is correctly configured with the Tailscale external ID. Use this after setting up the IAM role for S3 log streaming.
| Name | Required | Description | Default |
|---|---|---|---|
| roleArn | Yes | The AWS IAM role ARN to validate against | |
| externalId | Yes | The AWS external ID to validate |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds 'Validate' which aligns with these annotations, but doesn't elaborate on validation behavior or output beyond what annotations imply. Acceptable given annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, concise and to the point. Every word adds value, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple validation tool with two parameters and good annotations, the description is complete. It covers purpose, usage timing, and is self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description does not add additional meaning beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Validate') and the specific resource ('AWS IAM role trust policy') with the Tailscale external ID. It distinguishes from siblings like 'tailscale_create_aws_external_id' by specifying validation after setup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use ('after setting up the IAM role for S3 log streaming'), providing clear context. No exclusions or alternatives are mentioned, but the use case is well-defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.18.0- Changed
tailscale_batch_update_posture_attributes1 field changed- changed
Input schema / properties / nodes / additionalProperties / additionalProperties / anyOfPrevious value: -[ - { - "properties": { - "expiry": { - "type": "string" - }, - "value": { - "anyOf": [ - { - "type": "string" - }, - { - "type": "number" - }, - { - "type": "boolean" - } - ] - } - }, - "required": [ - "value" - ], - "type": "object" - }, - { - "type": "null" - } -]New value: +[ + { + "properties": { + "expiry": { + "type": "string" + }, + "value": { + "type": [ + "string", + "number", + "boolean" + ] + } + }, + "required": [ + "value" + ], + "type": "object" + }, + { + "type": "null" + } +]
- Added
tailscale_delete_oauth_app - Changed
tailscale_delete_tailnet1 field changed- changed
Input schema / properties / confirmTailnet / descriptionPrevious value: -"Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A deliberate second look before an irreversible org-wide delete."New value: +"Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A typo guard, not an authorization gate: on the explicit-`tailnet` path the caller writes both halves of the comparison, so it proves only self-agreement. It is a real second look only when `tailnet` is omitted and the value has to match the operator's environment."
- Added
tailscale_list_oauth_apps - Changed
tailscale_set_device_posture_attribute2 fields changed- removed
Input schema / properties / value / anyOfRemoved value: -[ - { - "type": "string" - }, - { - "type": "number" - }, - { - "type": "boolean" - } -] - added
Input schema / properties / value / typeAdded value: +[ + "string", + "number", + "boolean" +]
- Changed
tailscale_update_acl1 field changed- added
Input schema / properties / etag / minLengthAdded value: +1
8 tool updates
v0.17.1- Added
tailscale_create_oauth_app - Added
tailscale_create_org_tailnet - Changed
tailscale_create_posture_integration3 fields changed- changed
Input schema / properties / clientId / descriptionPrevious value: -"Client ID for the provider (Intune: application UUID; Falcon/Jamf Pro: client id; Kandji/Kolide/Sentinel One: leave blank)"New value: +"Client ID for the provider (Intune: application UUID; Falcon/Jamf Pro: client id; Fleet/Huntress/Kandji/Kolide/Sentinel One: leave blank)" - changed
Input schema / properties / provider / descriptionPrevious value: -"The posture provider"New value: +"The posture provider slug: falcon (CrowdStrike Falcon), fleet, huntress, intune (Microsoft Intune), jamfpro (Jamf Pro), kandji (Iru, formerly Kandji), kolide (1Password XAM, formerly Kolide), sentinelone" - changed
Input schema / properties / provider / enumPrevious value: -[ - "falcon", - "intune", - "jamfpro", - "kandji", - "kolide", - "sentinelone" -]New value: +[ + "falcon", + "fleet", + "huntress", + "intune", + "jamfpro", + "kandji", + "kolide", + "sentinelone" +]
- Changed
tailscale_create_webhook1 field changed- added
Input schema / properties / subscriptions / items / enumAdded value: +[ + "exitNodeIPForwardingNotEnabled", + "nodeApproved", + "nodeCreated", + "nodeDeleted", + "nodeKeyExpired", + "nodeKeyExpiringInOneDay", + "nodeNeedsApproval", + "nodeNeedsSignature", + "nodeSigned", + "policyUpdate", + "subnetIPForwardingNotEnabled", + "userApproved", + "userCreated", + "userDeleted", + "userNeedsApproval", + "userRestored", + "userRoleUpdated", + "userSuspended" +]
- Added
tailscale_delete_tailnet - Added
tailscale_get_oauth_app - Added
tailscale_list_org_tailnets - Changed
tailscale_update_webhook1 field changed- added
Input schema / properties / subscriptions / items / enumAdded value: +[ + "exitNodeIPForwardingNotEnabled", + "nodeApproved", + "nodeCreated", + "nodeDeleted", + "nodeKeyExpired", + "nodeKeyExpiringInOneDay", + "nodeNeedsApproval", + "nodeNeedsSignature", + "nodeSigned", + "policyUpdate", + "subnetIPForwardingNotEnabled", + "userApproved", + "userCreated", + "userDeleted", + "userNeedsApproval", + "userRestored", + "userRoleUpdated", + "userSuspended" +]
89 tool updates
v0.13.3- First observed
tailscale_accept_device_invite - First observed
tailscale_approve_user - First observed
tailscale_authorize_device - First observed
tailscale_batch_update_posture_attributes - First observed
tailscale_create_aws_external_id - First observed
tailscale_create_device_invite - First observed
tailscale_create_key - First observed
tailscale_create_posture_integration - First observed
tailscale_create_user_invite - First observed
tailscale_create_webhook - First observed
tailscale_deauthorize_device - First observed
tailscale_delete_device - First observed
tailscale_delete_device_invite - First observed
tailscale_delete_device_posture_attribute - First observed
tailscale_delete_key - First observed
tailscale_delete_log_stream_config - First observed
tailscale_delete_posture_integration - First observed
tailscale_delete_service - First observed
tailscale_delete_user - First observed
tailscale_delete_user_invite - First observed
tailscale_delete_webhook - First observed
tailscale_expire_device - First observed
tailscale_get_acl - First observed
tailscale_get_audit_log - First observed
tailscale_get_contacts - First observed
tailscale_get_device - First observed
tailscale_get_device_invite - First observed
tailscale_get_device_posture_attributes - First observed
tailscale_get_device_routes - First observed
tailscale_get_dns_configuration - First observed
tailscale_get_dns_preferences - First observed
tailscale_get_key - First observed
tailscale_get_log_stream_config - First observed
tailscale_get_log_stream_status - First observed
tailscale_get_nameservers - First observed
tailscale_get_network_flow_logs - First observed
tailscale_get_posture_integration - First observed
tailscale_get_search_paths - First observed
tailscale_get_service - First observed
tailscale_get_service_device_approval - First observed
tailscale_get_split_dns - First observed
tailscale_get_tailnet_settings - First observed
tailscale_get_user - First observed
tailscale_get_user_invite - First observed
tailscale_get_webhook - First observed
tailscale_list_device_invites - First observed
tailscale_list_devices - First observed
tailscale_list_keys - First observed
tailscale_list_log_stream_configs - First observed
tailscale_list_posture_integrations - First observed
tailscale_list_service_hosts - First observed
tailscale_list_services - First observed
tailscale_list_user_invites - First observed
tailscale_list_users - First observed
tailscale_list_webhooks - First observed
tailscale_preview_acl - First observed
tailscale_rename_device - First observed
tailscale_resend_contact_verification - First observed
tailscale_resend_device_invite - First observed
tailscale_resend_user_invite - First observed
tailscale_restore_user - First observed
tailscale_rotate_webhook_secret - First observed
tailscale_set_contacts - First observed
tailscale_set_device_ip - First observed
tailscale_set_device_posture_attribute - First observed
tailscale_set_device_routes - First observed
tailscale_set_device_tags - First observed
tailscale_set_devices_authorized - First observed
tailscale_set_dns_configuration - First observed
tailscale_set_dns_preferences - First observed
tailscale_set_log_stream_config - First observed
tailscale_set_nameservers - First observed
tailscale_set_search_paths - First observed
tailscale_set_service_device_approval - First observed
tailscale_set_split_dns - First observed
tailscale_status - First observed
tailscale_suspend_user - First observed
tailscale_test_webhook - First observed
tailscale_update_acl - First observed
tailscale_update_device_key - First observed
tailscale_update_key - First observed
tailscale_update_posture_integration - First observed
tailscale_update_service - First observed
tailscale_update_split_dns - First observed
tailscale_update_tailnet_settings - First observed
tailscale_update_user_role - First observed
tailscale_update_webhook - First observed
tailscale_validate_acl - First observed
tailscale_validate_aws_trust_policy
TDQS
Each tool targets a distinct resource/action (device, route, posture attribute, ACL, DNS setting, key, webhook, service, invite, log stream), and descriptions explicitly call out single-vs-batch and replace-vs-merge semantics. A few pairs like the unified DNS configuration versus the individual DNS setters, or set_split_dns versus update_split_dns, could be confused, but the descriptions disambiguate them well.
Nearly all tools follow the tailscale_<verb>_<noun> snake_case pattern, e.g., list_devices, create_webhook, delete_key. Minor inconsistencies exist: tailscale_status lacks a verb, tailscale_set_devices_authorized uses an adjective instead of authorize/deauthorize, and some resources alternate between singular and plural forms like posture_attribute versus posture_attributes. Overall, the naming pattern is predictable.
With 96 tools, this is far beyond the well-scoped 3-15 tool range and exceeds the 50+ extreme threshold. While each tool maps to a real Tailscale API operation, the sheer surface will bloat agent context and make tool selection significantly harder. This is an extreme count for an MCP server.
The set covers the Tailscale admin domain thoroughly: devices, ACLs, DNS, keys, OAuth, users, invites, webhooks, posture integrations, services, log streaming, and audit/flow logs all have lifecycle and operational tools. CRUD coverage is nearly exhaustive, and the only notable absent operation—service creation—is an upstream API limitation explicitly noted. There are no obvious dead ends.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Deploy, monitor, and manage your OpenClaw AI assistants via natural language.
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Your Supabase account in natural language: run SQL, apply migrations, manage tables, storage, edge f
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Related MCP Servers
- FlicenseNot gradedqualityNot gradedmaintenanceEnables interaction with the Tailscale API to manage devices, ACLs, keys, and DNS configurations directly from MCP clients like Claude Desktop or Raycast.-
- AlicenseAqualityCmaintenanceAn MCP server for managing and monitoring Tailscale networks through natural language. It enables users to list devices, check connection status, monitor for client updates, and retrieve detailed tailnet summaries.6157MIT
- AlicenseAqualityBmaintenanceEnables AI agents to securely interact with Tailscale tailnets for device inventory, ACL review, key hygiene, and more, with token-efficient output and write-gated mutations.19MIT
- AlicenseNot gradedqualityDmaintenanceQuery devices, check connectivity, and get network status from your Tailscale tailnet directly via an AI assistant.MIT
Appeared in Searches
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/YawLabs/tailscale-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server