# Tailscale

Controls local Tailscale nodes through the CLI and manages the tailnet via the control-plane API. Gives AI coding agents direct access to network state.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 15
- Author: tailscale-mcp
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/tailscale-mcp/tailscale-mcp
- Updated: 2026-10-10
- HTML: https://affpapa.org/en/nevibecode/mcp/tailscale

## What it does

This server connects an AI assistant to Tailscale infrastructure. It runs local node operations by calling the `tailscale` CLI directly and executes wider tailnet changes using the control-plane REST API. Each plane works independently. If no credentials are supplied, network-wide tools stay hidden while local node tools remain available.

Tools are grouped into `minimal`, `core`, and `full` presets. Dangerous actions stay restricted by default. Read operations are always enabled, but configuration edits and destructive actions demand explicit permission flags. Tailnet-wide destructive calls also mandate passing `confirm: true`.

On macOS, the server requires the shim installed at `/usr/local/bin`. Pointing directly to the binary inside the application bundle launches the GUI instead of answering CLI calls, causing all node tools to fail.

## Requirements
- Needs: Node.js (commands run via npx)
- Environment variables: `TAILSCALE_API_KEY`, `TAILSCALE_OAUTH_CLIENT_ID`, `TAILSCALE_OAUTH_CLIENT_SECRET`, `TAILSCALE_TAILNET`, `TAILSCALE_MCP_PRESET`, `TAILSCALE_MCP_ALLOW_WRITE`, `TAILSCALE_MCP_ALLOW_DESTRUCTIVE` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add --env TAILSCALE_API_KEY=<TAILSCALE_API_KEY> --env TAILSCALE_OAUTH_CLIENT_ID=<TAILSCALE_OAUTH_CLIENT_ID> --env TAILSCALE_OAUTH_CLIENT_SECRET=<TAILSCALE_OAUTH_CLIENT_SECRET> --env TAILSCALE_TAILNET=<TAILSCALE_TAILNET> --env TAILSCALE_MCP_PRESET=<TAILSCALE_MCP_PRESET> --transport stdio tailscale -- npx -y @tailscale-mcp/tailscale-mcp
```
Replace <…> with your own values. 2 more environment variables are in the server README

### Codex

**Platform CLI**
```bash
codex mcp add tailscale --env TAILSCALE_API_KEY=<TAILSCALE_API_KEY> --env TAILSCALE_OAUTH_CLIENT_ID=<TAILSCALE_OAUTH_CLIENT_ID> --env TAILSCALE_OAUTH_CLIENT_SECRET=<TAILSCALE_OAUTH_CLIENT_SECRET> --env TAILSCALE_TAILNET=<TAILSCALE_TAILNET> --env TAILSCALE_MCP_PRESET=<TAILSCALE_MCP_PRESET> -- npx -y @tailscale-mcp/tailscale-mcp
```
Replace <…> with your own values. 2 more environment variables are in the server README

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "tailscale": {
            "command": "npx",
            "args": [
                "-y",
                "@tailscale-mcp/tailscale-mcp"
            ],
            "env": {
                "TAILSCALE_API_KEY": "<TAILSCALE_API_KEY>",
                "TAILSCALE_OAUTH_CLIENT_ID": "<TAILSCALE_OAUTH_CLIENT_ID>",
                "TAILSCALE_OAUTH_CLIENT_SECRET": "<TAILSCALE_OAUTH_CLIENT_SECRET>",
                "TAILSCALE_TAILNET": "<TAILSCALE_TAILNET>",
                "TAILSCALE_MCP_PRESET": "<TAILSCALE_MCP_PRESET>"
            }
        }
    }
}
```
Replace <…> with your own values. 2 more environment variables are in the server README

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "tailscale": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "@tailscale-mcp/tailscale-mcp"
            ],
            "env": {
                "TAILSCALE_API_KEY": "<TAILSCALE_API_KEY>",
                "TAILSCALE_OAUTH_CLIENT_ID": "<TAILSCALE_OAUTH_CLIENT_ID>",
                "TAILSCALE_OAUTH_CLIENT_SECRET": "<TAILSCALE_OAUTH_CLIENT_SECRET>",
                "TAILSCALE_TAILNET": "<TAILSCALE_TAILNET>",
                "TAILSCALE_MCP_PRESET": "<TAILSCALE_MCP_PRESET>"
            }
        }
    }
}
```
Replace <…> with your own values. 2 more environment variables are in the server README

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e TAILSCALE_API_KEY=<TAILSCALE_API_KEY> -e TAILSCALE_OAUTH_CLIENT_ID=<TAILSCALE_OAUTH_CLIENT_ID> -e TAILSCALE_OAUTH_CLIENT_SECRET=<TAILSCALE_OAUTH_CLIENT_SECRET> -e TAILSCALE_TAILNET=<TAILSCALE_TAILNET> -e TAILSCALE_MCP_PRESET=<TAILSCALE_MCP_PRESET> tailscale npx -y @tailscale-mcp/tailscale-mcp
```
Replace <…> with your own values. 2 more environment variables are in the server README

## When to use it
- inspect node status and active devices across the tailnet
- modify device routing and tailnet configuration through the REST API
- restrict agent execution to read-only network inspection
- verify environment tools and credentials using `tailscale-mcp diagnose`

## Example prompts
- List all reachable devices currently active in my tailnet
- Check the connection status of this local Tailscale node
- Run `tailscale-mcp diagnose` to see which tool sets are currently enabled

## Similar
- [Tailscale MCP Server](https://affpapa.org/en/nevibecode/mcp/tailscale-mcp-server.md) — MCP server · ★ 35
- [tunnel-doctor](https://affpapa.org/en/nevibecode/skills/tunnel-doctor.md) — skill · 678 installs
- [network-engineer](https://affpapa.org/en/nevibecode/agents/network-engineer.md) — subagent · 1871 installs
- [edgesecurityaccess-wireguard-vpn](https://affpapa.org/en/nevibecode/skills/edgesecurityaccess-wireguard-vpn.md) — skill · 788 installs
- [node-connect](https://affpapa.org/en/nevibecode/skills/node-connect.md) — skill · 793 installs
- [huawei-cloud-network-query](https://affpapa.org/en/nevibecode/skills/huawei-cloud-network-query.md) — skill · 17000 installs

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md