Read devices, users, keys, ACLs and DNS for a tailnet; manage devices, routes and auth keys.
Call this server's tools from your browser. Nothing to install.
Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.
Tool list from our last check. Connect live to refresh it.
Authorize or de-authorize a device (only relevant when device approval is enabled for the tailnet). Tailscale REST: POST /device/{deviceId}/authorized.
The device id.
True to authorize the device into the tailnet, false to de-authorize it.
The server marks this tool as destructive. Running it may delete or overwrite data on the server or in any account you connected with your headers.
Authorize or de-authorize a device (only relevant when device approval is enabled for the tailnet). Tailscale REST: POST /device/{deviceId}/authorized.
| Argument | Type | Description |
|---|---|---|
| deviceId* | string | The device id. |
| authorized* | boolean | True to authorize the device into the tailnet, false to de-authorize it. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId",
"authorized"
],
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
},
"authorized": {
"type": "boolean",
"description": "True to authorize the device into the tailnet, false to de-authorize it."
}
}
}Create a new auth key for the tailnet (used to register new devices). Tailscale REST: POST /tailnet/{tailnet}/keys.
| Argument | Type | Description |
|---|---|---|
| tags | array | ACL tags to apply to devices created with this key, e.g. ["tag:ci"]. |
| reusable | boolean | If true, the key can register multiple devices. |
| ephemeral | boolean | If true, devices registered with this key are ephemeral (removed shortly after going offline). |
| description | string | A short description for the key. |
| expirySeconds | number | Key lifetime in seconds; 0 means no expiry (if allowed by tailnet policy). |
| preauthorized | boolean | If true, devices registered with this key are pre-authorized (skip device approval). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "ACL tags to apply to devices created with this key, e.g. [\"tag:ci\"]."
},
"reusable": {
"type": "boolean",
"description": "If true, the key can register multiple devices."
},
"ephemeral": {
"type": "boolean",
"description": "If true, devices registered with this key are ephemeral (removed shortly after going offline)."
},
"description": {
"type": "string",
"description": "A short description for the key."
},
"expirySeconds": {
"type": "number",
"description": "Key lifetime in seconds; 0 means no expiry (if allowed by tailnet policy)."
},
"preauthorized": {
"type": "boolean",
"description": "If true, devices registered with this key are pre-authorized (skip device approval)."
}
}
}Delete a device, removing it from the tailnet. Tailscale REST: DELETE /device/{deviceId}.
| Argument | Type | Description |
|---|---|---|
| deviceId* | string | The device id to delete. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId"
],
"properties": {
"deviceId": {
"type": "string",
"description": "The device id to delete."
}
}
}Delete (revoke) an auth key or API access token by id — a security response. Tailscale REST: DELETE /tailnet/{tailnet}/keys/{keyId}.
| Argument | Type | Description |
|---|---|---|
| keyId* | string | The key id to delete. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"keyId"
],
"properties": {
"keyId": {
"type": "string",
"description": "The key id to delete."
}
}
}Expire a device's node key, forcing it to re-authenticate — a security response to a compromised or lost device. Tailscale REST: POST /device/{deviceId}/expire.
| Argument | Type | Description |
|---|---|---|
| deviceId* | string | The device id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId"
],
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
}
}
}Get a single device by id. Tailscale REST: GET /device/{deviceId}.
| Argument | Type | Description |
|---|---|---|
| fields | string | Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset. |
| deviceId* | string | The device id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId"
],
"properties": {
"fields": {
"enum": [
"default",
"all"
],
"type": "string",
"description": "Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset."
},
"deviceId": {
"type": "string",
"description": "The device id."
}
}
}Get the tailnet's DNS preferences (e.g. whether MagicDNS is enabled). Tailscale REST: GET /tailnet/{tailnet}/dns/preferences.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {}
}Get details of a single auth key / API access token by id (capabilities, expiry, usage). Tailscale REST: GET /tailnet/{tailnet}/keys/{keyId}.
| Argument | Type | Description |
|---|---|---|
| keyId* | string | The key id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"keyId"
],
"properties": {
"keyId": {
"type": "string",
"description": "The key id."
}
}
}Get the tailnet's ACL / policy file (returned as JSON via the Accept header, not HuJSON). Tailscale REST: GET /tailnet/{tailnet}/acl.
| Argument | Type | Description |
|---|---|---|
| details | boolean | If true, include metadata about the policy file (e.g. when and by whom it was last updated). |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"details": {
"type": "boolean",
"description": "If true, include metadata about the policy file (e.g. when and by whom it was last updated)."
}
}
}Get the tailnet's split-DNS configuration — a map of domain → nameservers. Tailscale REST: GET /tailnet/{tailnet}/dns/split-dns.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {}
}Get the tailnet's settings (device approval, key expiry, posture, etc.). Tailscale REST: GET /tailnet/{tailnet}/settings.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {}
}Get a single user by id. Tailscale REST: GET /users/{userId}.
| Argument | Type | Description |
|---|---|---|
| userId* | string | The user id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"userId"
],
"properties": {
"userId": {
"type": "string",
"description": "The user id."
}
}
}List the subnet routes a device advertises and which are enabled. Tailscale REST: GET /device/{deviceId}/routes.
| Argument | Type | Description |
|---|---|---|
| deviceId* | string | The device id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId"
],
"properties": {
"deviceId": {
"type": "string",
"description": "The device id."
}
}
}List all devices in the tailnet (name, addresses, OS, last seen, tags, etc.). Tailscale REST: GET /tailnet/{tailnet}/devices.
| Argument | Type | Description |
|---|---|---|
| fields | string | Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"fields": {
"enum": [
"default",
"all"
],
"type": "string",
"description": "Field set — 'all' returns all fields incl. posture attributes and routes; 'default' is the standard subset."
}
}
}List the global DNS nameservers configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/nameservers.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {}
}List the DNS search paths (search domains) configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/searchpaths.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {}
}List auth keys and API access tokens for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/keys.
| Argument | Type | Description |
|---|---|---|
| all | boolean | If true, returns all keys, tokens and OAuth clients in the tailnet, not just the caller's own (requires appropriate scope). Default false. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"all": {
"type": "boolean",
"description": "If true, returns all keys, tokens and OAuth clients in the tailnet, not just the caller's own (requires appropriate scope). Default false."
}
}
}List users of the tailnet, optionally filtered by type, role or status. Tailscale REST: GET /tailnet/{tailnet}/users.
| Argument | Type | Description |
|---|---|---|
| role | string | Filter by role, e.g. owner, admin, member, it-admin, network-admin, billing-admin, auditor. |
| type | string | Filter by user type. |
| status | string | Filter by user status. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {
"role": {
"type": "string",
"description": "Filter by role, e.g. owner, admin, member, it-admin, network-admin, billing-admin, auditor."
},
"type": {
"enum": [
"all",
"member",
"shared",
"invited"
],
"type": "string",
"description": "Filter by user type."
},
"status": {
"enum": [
"all",
"active",
"idle",
"suspended",
"needs-approval",
"over-billing-limit"
],
"type": "string",
"description": "Filter by user status."
}
}
}List the webhook endpoints configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/webhooks.
No arguments.
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"properties": {}
}Set (rename) a device's name. Tailscale REST: POST /device/{deviceId}/name.
| Argument | Type | Description |
|---|---|---|
| name* | string | The new device name. |
| deviceId* | string | The device id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId",
"name"
],
"properties": {
"name": {
"type": "string",
"description": "The new device name."
},
"deviceId": {
"type": "string",
"description": "The device id."
}
}
}Set the subnet routes ENABLED for a device (from the routes it advertises). REPLACES the enabled set. Tailscale REST: POST /device/{deviceId}/routes.
| Argument | Type | Description |
|---|---|---|
| routes* | array | The set of subnet routes (CIDRs) to ENABLE for this device, e.g. ["10.0.0.0/24"]. REPLACES the enabled set. |
| deviceId* | string | The device id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId",
"routes"
],
"properties": {
"routes": {
"type": "array",
"items": {
"type": "string"
},
"description": "The set of subnet routes (CIDRs) to ENABLE for this device, e.g. [\"10.0.0.0/24\"]. REPLACES the enabled set."
},
"deviceId": {
"type": "string",
"description": "The device id."
}
}
}Set a device's ACL tags. REPLACES the device's existing tags. Tailscale REST: POST /device/{deviceId}/tags.
| Argument | Type | Description |
|---|---|---|
| tags* | array | ACL tags to apply, e.g. ["tag:server"]. REPLACES the device's existing tags. |
| deviceId* | string | The device id. |
{
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"deviceId",
"tags"
],
"properties": {
"tags": {
"type": "array",
"items": {
"type": "string"
},
"description": "ACL tags to apply, e.g. [\"tag:server\"]. REPLACES the device's existing tags."
},
"deviceId": {
"type": "string",
"description": "The device id."
}
}
}