Tailscale RMCP — Claude Code MCP server for tailnet management
This server lets an agent inspect Tailscale devices, routes, DNS, API keys, ACL policy, and users. Use it to check a tailnet or authorize a device from an MCP client.
claude mcp add --env TAILSCALE_API_KEY=<TAILSCALE_API_KEY> --env TAILSCALE_RMCP_VERSION=<TAILSCALE_RMCP_VERSION> --env TAILSCALE_RMCP_REPO=<TAILSCALE_RMCP_REPO> --env TAILSCALE_RMCP_RELEASE_BASE_URL=<TAILSCALE_RMCP_RELEASE_BASE_URL> --env RUST_LOG=<RUST_LOG> --transport stdio tailscale-rmcp -- npx -y @dinglebear/rtailscaleWhat Tailscale RMCP does
Tailscale RMCP exposes an MCP tool named tailscale alongside the rtailscale CLI. An agent can list devices, inspect an individual device, read subnet routes and DNS settings, and retrieve ACL policy, API keys, and tailnet users. Device authorization is available too.
Deleting a device requires TAILSCALE_ALLOW_DESTRUCTIVE=true on the server and a separate confirmation from the caller. You need a Tailscale API key with permissions for the actions you intend to use, plus a configured TAILSCALE_TAILNET. This server does not replace the Tailscale admin console or provide general WireGuard control.
Claude Code can connect over stdio with npx or use the HTTP endpoint. For local HTTP use, the documented command binds the server to 127.0.0.1. Keep the API key in TAILSCALE_API_KEY; MCP tool arguments are not a place to pass that credential.
What it helps with
- list devices in a tailnet
- inspect subnet routes and DNS settings
- read ACL policy and tailnet users
- authorize a device on the tailnet
- delete a device with explicit confirmation
Example prompts for the agent
- List the devices in my tailnet and summarize their details.
- Check the subnet routes and DNS settings for my tailnet.
- Authorize this device on the tailnet; ask me to confirm before deleting any device.
How to install Tailscale RMCP
1Platform CLI
claude mcp add --env TAILSCALE_API_KEY=<TAILSCALE_API_KEY> --env TAILSCALE_RMCP_VERSION=<TAILSCALE_RMCP_VERSION> --env TAILSCALE_RMCP_REPO=<TAILSCALE_RMCP_REPO> --env TAILSCALE_RMCP_RELEASE_BASE_URL=<TAILSCALE_RMCP_RELEASE_BASE_URL> --env RUST_LOG=<RUST_LOG> --transport stdio tailscale-rmcp -- npx -y @dinglebear/rtailscaleReplace <…> with your own values
2Platform CLI: remote server
claude mcp add --transport http tailscale-rmcp https://ts.dinglebear.ai/mcp1Platform CLI: remote server
codex mcp add tailscale-rmcp --url https://ts.dinglebear.ai/mcp2Platform CLI
codex mcp add tailscale-rmcp --env TAILSCALE_API_KEY=<TAILSCALE_API_KEY> --env TAILSCALE_RMCP_VERSION=<TAILSCALE_RMCP_VERSION> --env TAILSCALE_RMCP_REPO=<TAILSCALE_RMCP_REPO> --env TAILSCALE_RMCP_RELEASE_BASE_URL=<TAILSCALE_RMCP_RELEASE_BASE_URL> --env RUST_LOG=<RUST_LOG> -- npx -y @dinglebear/rtailscaleReplace <…> with your own values
Config file
{
"mcpServers": {
"tailscale-rmcp": {
"url": "https://ts.dinglebear.ai/mcp"
}
}
}{
"mcpServers": {
"tailscale-rmcp": {
"command": "npx",
"args": [
"-y",
"@dinglebear/rtailscale"
],
"env": {
"TAILSCALE_API_KEY": "<TAILSCALE_API_KEY>",
"TAILSCALE_RMCP_VERSION": "<TAILSCALE_RMCP_VERSION>",
"TAILSCALE_RMCP_REPO": "<TAILSCALE_RMCP_REPO>",
"TAILSCALE_RMCP_RELEASE_BASE_URL": "<TAILSCALE_RMCP_RELEASE_BASE_URL>",
"RUST_LOG": "<RUST_LOG>"
}
}
}
}Replace <…> with your own values
Config file
{
"servers": {
"tailscale-rmcp": {
"type": "http",
"url": "https://ts.dinglebear.ai/mcp"
}
}
}{
"servers": {
"tailscale-rmcp": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@dinglebear/rtailscale"
],
"env": {
"TAILSCALE_API_KEY": "<TAILSCALE_API_KEY>",
"TAILSCALE_RMCP_VERSION": "<TAILSCALE_RMCP_VERSION>",
"TAILSCALE_RMCP_REPO": "<TAILSCALE_RMCP_REPO>",
"TAILSCALE_RMCP_RELEASE_BASE_URL": "<TAILSCALE_RMCP_RELEASE_BASE_URL>",
"RUST_LOG": "<RUST_LOG>"
}
}
}
}Replace <…> with your own values
1Platform CLI: remote server
gemini mcp add -t http tailscale-rmcp https://ts.dinglebear.ai/mcp2Platform CLI
gemini mcp add -e TAILSCALE_API_KEY=<TAILSCALE_API_KEY> -e TAILSCALE_RMCP_VERSION=<TAILSCALE_RMCP_VERSION> -e TAILSCALE_RMCP_REPO=<TAILSCALE_RMCP_REPO> -e TAILSCALE_RMCP_RELEASE_BASE_URL=<TAILSCALE_RMCP_RELEASE_BASE_URL> -e RUST_LOG=<RUST_LOG> tailscale-rmcp npx -y @dinglebear/rtailscaleReplace <…> with your own values
Step by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about Tailscale RMCP
How do I install Tailscale RMCP in Claude Code?
Run claude mcp add rtailscale -e TAILSCALE_API_KEY=<TAILSCALE_API_KEY> -- npx -y @dinglebear/rtailscale. Replace the placeholder with a Tailscale API key.
What does Tailscale RMCP do?
It gives Claude Code and other supported clients MCP access to Tailscale data and device authorization. Device deletion has additional safeguards.
What do I need to use Tailscale RMCP?
Provide a Tailscale API key through TAILSCALE_API_KEY and configure the target tailnet. Deletion also requires TAILSCALE_ALLOW_DESTRUCTIVE=true and explicit caller confirmation.
