Headscale MCP connector

headscale_users

DestructiveIdempotent

Create, list, rename, or delete users on a self-hosted Headscale server. Writes use dry-run previews and require confirmation; deletion removes the user's nodes and keys.

Instructions

headscale_users calls the users toolset on a self-hosted Headscale server (4 actions). Authorization is Bearer. Writes need confirm set to the boolean true and HEADSCALE_ALLOW_WRITES=true. Omit confirm for a dry-run preview that does not send the write. Warnings: This deletes a user and the nodes and keys that belong to that user. Actions: create_user: POST /api/v1/user. Create a user. delete_user: DELETE /api/v1/user/{id}. Delete a user. list_users: GET /api/v1/user. List users. rename_user: POST /api/v1/user/{oldId}/rename/{newName}. Rename a user.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "action": "<action>"
    },
    "name": "headscale_users"
  }
}

Input Schema

Name	Required	Description
`body`	No	JSON body for the Headscale operation. Secrets are redacted in previews.
`query`	No	OpenAPI query parameters.
`action`	Yes	Headscale operation to call.
`params`	No	OpenAPI path parameters, such as nodeId or id.
`confirm`	No	Set to the boolean true to execute the write. Omit this field for a dry-run preview. false and the string true are rejected.

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Nov 5, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint and openWorldHint, but the description adds the crucial detail that delete_user removes the user's nodes and keys as well, plus the auth scheme and the dry-run semantics. It stops short of covering rate limits or response shape, which is acceptable given the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The write-safety warning and dry-run rule are front-loaded before the action list, which is the right order. The action list is compact, though repeating 'Create a user'/'Delete a user' after each endpoint is mildly redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter, nested-body, multi-action mutation tool with no output schema, the description covers authorization, write confirmation, destructive side effects, and every action's endpoint. Nothing an agent needs to invoke it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline would be 3; the description adds value by tying params/body/query to concrete operations and explaining the confirm gate and its rejection of false or the string 'true'. It does not spell out which path parameter each action requires (id vs oldId/newName), leaving some inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('calls the users toolset on a self-hosted Headscale server') and enumerates all four actions with their HTTP method and path, which distinguishes it from siblings like headscale_nodes and headscale_policy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the write gate explicitly: confirm must be boolean true and HEADSCALE_ALLOW_WRITES=true, and omitting confirm yields a dry-run preview. It does not name when to prefer a sibling tool (e.g., use headscale_nodes for node operations), so routing between toolsets is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server