Tailscale MCP Server — Claude Code MCP server: manage your tailnet
An MCP server that hands your agent the Tailscale admin API: devices, ACLs, DNS, keys, users. Useful when you want to ask about the tailnet and act on the answer.
claude mcp add tailscale-mcp -- npx -y @yawlabs/tailscale-mcpWhat Tailscale MCP Server does
The server wraps the Tailscale v2 API in typed tools: 97 admin-API tools, 6 optional local-CLI diagnostics, one always-on catalog tool and 4 resources. Coverage runs across devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services and organization tailnets. Inputs are validated with Zod and responses come back structured, so no brittle tailscale status --json | jq pipeline to maintain.
It is not a replacement for curl. The agent chains several endpoints in a single turn: it can list devices that stopped checking in and have key expiry off, pull the audit log to explain a DNS change made overnight, or draft a minimal ACL diff that keeps your comments. Write tools carry destructiveHint or idempotentHint, which lets your client require confirmation on mutations and skip it on reads.
You need a tailnet API key. Some diagnostics rely on the local CLI, and the integration suite turns on with RUN_INTEGRATION_TESTS=1 plus a key. The server speaks stdio, so a client that only accepts URL-addressable Streamable-HTTP or SSE cannot host it. If your job is one endpoint inside CI, reach for curl instead — this server earns its place in exploratory work where you don't yet know what you need.
What it helps with
- find devices that stopped checking in and have key expiry disabled
- explain an overnight DNS change from the audit log
- draft an ACL diff while keeping HuJSON comments
- create a scoped OAuth client for a CI pipeline
- rotate auth keys past their age and print the new ones
Example prompts for the agent
- Who changed DNS in the last 24 hours? Pull the audit log and summarize it
- Draft an ACL change so
tag:mobilereachestag:dashboardbut nottag:db, keeping my comments
How to install Tailscale MCP Server
Platform CLI
claude mcp add tailscale-mcp -- npx -y @yawlabs/tailscale-mcpPlatform CLI
codex mcp add tailscale-mcp-server -- npx -y @yawlabs/tailscale-mcpConfig file
{
"mcpServers": {
"tailscale-mcp-server": {
"command": "npx",
"args": [
"-y",
"@yawlabs/tailscale-mcp"
]
}
}
}Config file
{
"servers": {
"tailscale-mcp-server": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@yawlabs/tailscale-mcp"
]
}
}
}Platform CLI
gemini mcp add tailscale-mcp-server npx -y @yawlabs/tailscale-mcpStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Tailscale MCP Server
How do I install Tailscale MCP Server in Claude Code?
Run claude mcp add tailscale-mcp -- npx -y @yawlabs/tailscale-mcp. The server starts through npx, so there is nothing to install separately.
What does Tailscale MCP Server do?
It gives an agent typed access to the Tailscale admin API: devices, ACLs, DNS, keys, users, webhooks, log streaming and posture. The agent can combine several endpoints in one turn and propose changes.
How is it different from Tailscale's own MCP tools?
The official Aperture connectors let an agent join one node or run one SSH command, and tailscale/tailscale-skill is reference material with no server of its own. This one exposes the admin API as typed tools.
