MCP Server

tailscale

            io.usefulapi/tailscale
        

Cloud & Infrastructure Security Public & reachable MCP 2026-07-28

What this MCP does

Manages Tailscale tailnet devices, routes, users, DNS, ACL policies, authentication keys, and device security actions.

tailscale_authorize_device

Authorize device

Authorize or de-authorize a device (only relevant when device approval is enabled for the tailnet). Tailscale REST: POST /device/{deviceId}/authorized.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId', 'authorized'], 'properties': {'deviceId': {'type': 'string', 'description': 'The device id.'}, 'authorized': {'type': 'boolean', 'description': 'True to authorize the device into the tailnet, false to de-authorize it.'}}}

tailscale_create_auth_key

Create auth key

Create a new auth key for the tailnet (used to register new devices). Tailscale REST: POST /tailnet/{tailnet}/keys.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {'tags': {'type': 'array', 'items': {'type': 'string'}, 'description': 'ACL tags to apply to devices created with this key, e.g. ["tag:ci"].'}, 'reusable': {'type': 'boolean', 'description': 'If true, the key can register multiple devices.'}, 'ephemeral': {'type': 'boolean', 'description': 'If true, devices registered with this key are ephemeral (removed shortly after going offline).'}, 'description': {'type': 'string', 'description': 'A short description for the key.'}, 'expirySeconds': {'type': 'number', 'description': 'Key lifetime in seconds; 0 means no expiry (if allowed by tailnet policy).'}, 'preauthorized': {'type': 'boolean', 'description': 'If true, devices registered with this key are pre-authorized (skip device approval).'}}}

tailscale_delete_device

Delete device

Delete a device, removing it from the tailnet. Tailscale REST: DELETE /device/{deviceId}.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId'], 'properties': {'deviceId': {'type': 'string', 'description': 'The device id to delete.'}}}

tailscale_delete_key

Delete key

Delete (revoke) an auth key or API access token by id — a security response. Tailscale REST: DELETE /tailnet/{tailnet}/keys/{keyId}.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['keyId'], 'properties': {'keyId': {'type': 'string', 'description': 'The key id to delete.'}}}

tailscale_expire_device_key

Expire device key

Expire a device's node key, forcing it to re-authenticate — a security response to a compromised or lost device. Tailscale REST: POST /device/{deviceId}/expire.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId'], 'properties': {'deviceId': {'type': 'string', 'description': 'The device id.'}}}

tailscale_get_device

Get device

Get a single device by id. Tailscale REST: GET /device/{deviceId}.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId'], 'properties': {'fields': {'enum': ['default', 'all'], 'type': 'string', 'description': "Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset."}, 'deviceId': {'type': 'string', 'description': 'The device id.'}}}

tailscale_get_dns_preferences

Get DNS preferences

Get the tailnet's DNS preferences (e.g. whether MagicDNS is enabled). Tailscale REST: GET /tailnet/{tailnet}/dns/preferences.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {}}

tailscale_get_key

Get key

Get details of a single auth key / API access token by id (capabilities, expiry, usage). Tailscale REST: GET /tailnet/{tailnet}/keys/{keyId}.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['keyId'], 'properties': {'keyId': {'type': 'string', 'description': 'The key id.'}}}

tailscale_get_policy_file

Get policy file

Get the tailnet's ACL / policy file (returned as JSON via the Accept header, not HuJSON). Tailscale REST: GET /tailnet/{tailnet}/acl.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {'details': {'type': 'boolean', 'description': 'If true, include metadata about the policy file (e.g. when and by whom it was last updated).'}}}

tailscale_get_split_dns

Get split DNS

Get the tailnet's split-DNS configuration — a map of domain → nameservers. Tailscale REST: GET /tailnet/{tailnet}/dns/split-dns.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {}}

tailscale_get_tailnet_settings

Get tailnet settings

Get the tailnet's settings (device approval, key expiry, posture, etc.). Tailscale REST: GET /tailnet/{tailnet}/settings.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {}}

tailscale_get_user

Get user

Get a single user by id. Tailscale REST: GET /users/{userId}.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['userId'], 'properties': {'userId': {'type': 'string', 'description': 'The user id.'}}}

tailscale_list_device_routes

List device routes

List the subnet routes a device advertises and which are enabled. Tailscale REST: GET /device/{deviceId}/routes.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId'], 'properties': {'deviceId': {'type': 'string', 'description': 'The device id.'}}}

tailscale_list_devices

List devices

List all devices in the tailnet (name, addresses, OS, last seen, tags, etc.). Tailscale REST: GET /tailnet/{tailnet}/devices.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {'fields': {'enum': ['default', 'all'], 'type': 'string', 'description': "Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset."}}}

tailscale_list_dns_nameservers

List DNS nameservers

List the global DNS nameservers configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/nameservers.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {}}

tailscale_list_dns_searchpaths

List DNS search paths

List the DNS search paths (search domains) configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/searchpaths.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {}}

tailscale_list_keys

List keys

List auth keys and API access tokens for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/keys.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {'all': {'type': 'boolean', 'description': "If true, returns all keys, tokens and OAuth clients in the tailnet, not just the caller's own (requires appropriate scope). Default false."}}}

tailscale_list_users

List users

List users of the tailnet, optionally filtered by type, role or status. Tailscale REST: GET /tailnet/{tailnet}/users.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {'role': {'type': 'string', 'description': 'Filter by role, e.g. owner, admin, member, it-admin, network-admin, billing-admin, auditor.'}, 'type': {'enum': ['all', 'member', 'shared', 'invited'], 'type': 'string', 'description': 'Filter by user type.'}, 'status': {'enum': ['all', 'active', 'idle', 'suspended', 'needs-approval', 'over-billing-limit'], 'type': 'string', 'description': 'Filter by user status.'}}}

tailscale_list_webhooks

List webhooks

List the webhook endpoints configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/webhooks.

Read only

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'properties': {}}

tailscale_set_device_name

Set device name

Set (rename) a device's name. Tailscale REST: POST /device/{deviceId}/name.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId', 'name'], 'properties': {'name': {'type': 'string', 'description': 'The new device name.'}, 'deviceId': {'type': 'string', 'description': 'The device id.'}}}

tailscale_set_device_routes

Set device routes

Set the subnet routes ENABLED for a device (from the routes it advertises). REPLACES the enabled set. Tailscale REST: POST /device/{deviceId}/routes.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId', 'routes'], 'properties': {'routes': {'type': 'array', 'items': {'type': 'string'}, 'description': 'The set of subnet routes (CIDRs) to ENABLE for this device, e.g. ["10.0.0.0/24"]. REPLACES the enabled set.'}, 'deviceId': {'type': 'string', 'description': 'The device id.'}}}

tailscale_set_device_tags

Set device tags

Set a device's ACL tags. REPLACES the device's existing tags. Tailscale REST: POST /device/{deviceId}/tags.

Destructive

Input schema

{'type': 'object', '$schema': 'https://json-schema.org/draft/2020-12/schema', 'required': ['deviceId', 'tags'], 'properties': {'tags': {'type': 'array', 'items': {'type': 'string'}, 'description': 'ACL tags to apply, e.g. ["tag:server"]. REPLACES the device\'s existing tags.'}, 'deviceId': {'type': 'string', 'description': 'The device id.'}}}

Changed

                            tailscale_delete_device
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_delete_key
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_create_auth_key
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_set_device_routes
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_expire_device_key
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_set_device_tags
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_set_device_name
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_authorize_device
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_tailnet_settings
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_webhooks
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_user
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_users
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_split_dns
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_dns_searchpaths
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_dns_preferences
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_dns_nameservers
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_policy_file
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_key
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_keys
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_device_routes
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_get_device
                        

Oct. 1, 2026, 2:42 a.m.

Changed

                            tailscale_list_devices
                        

Oct. 1, 2026, 2:42 a.m.

Added

                            tailscale_delete_device
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_delete_key
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_create_auth_key
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_set_device_routes
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_expire_device_key
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_set_device_tags
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_set_device_name
                        

Sept. 25, 2026, 2:44 a.m.

Added

                            tailscale_authorize_device
                        

Sept. 25, 2026, 2:44 a.m.

Server details

Version

1.0.0

Transport

Streamable HTTP

Tools

Latency

167 ms

Last scan

Oct. 1, 2026, 2:42 a.m.

First seen

Sept. 13, 2026, 2:25 a.m.

Endpoint

https://tailscale.usefulapi.io/mcp

Recent scans

Success

Oct. 1, 2026, 2:42 a.m.

Success

Sept. 29, 2026, 2:49 a.m.

Success

Sept. 27, 2026, 2:41 a.m.

Success

Sept. 25, 2026, 2:44 a.m.

Error

Sept. 21, 2026, 2:44 a.m.

Error

Sept. 17, 2026, 12:53 p.m.

tailscale

What this MCP does

Tools

Recent tool changes

Similar MCP servers

BorealHost

BlackVeil DNS & Email Security Scanner

Hackertarget

Busymate DevTools

Ripe Stat

Cloudflare Radar

Domains

Rdap