Tailscale MCP Server: Run Your Tailnet From an Agent

Search for a Tailscale MCP server and you get five real projects with five different ideas of what the job is. None of them is published by Tailscale. This post is about picking one: what each actually exposes, where each stops, and the one thing that no amount of tool filtering will fix. Our entry is npx -y @yawlabs/tailscale-mcp, and it is not the right answer for every reader here.

Why an MCP server at all, when the CLI exists

Because the CLI is scoped to one machine. Tailscale's own CLI documentation opens by describing it as a built-in interface you can use to "manage and troubleshoot your device within your Tailscale network (known as a tailnet)" -- your device, singular. That page does not enumerate what the CLI leaves out, so take the positive evidence instead: the tailnet-wide concerns you want to ask about at 2am are the ones the v2 HTTP API is organized around.

The tailnet-wide surface lives in the v2 HTTP API instead. Tailscale publishes it as an OpenAPI document, and you can read it yourself:

curl -s "https://api.tailscale.com/api/v2?outputOpenapiSchema=true" | head -40

That document is OpenAPI 3.1.0 with 60 paths, grouped under 15 tags: Devices, PolicyFile, Keys, DNS, Logging, Users, UserInvites, DeviceInvites, DevicePosture, Contacts, Webhooks, TailnetSettings, Services, OAuthApps and Organizations. Every one of the servers below is, underneath, a typed wrapper over some subset of those 60 paths. The differences are which subset, how the server is reached, and what it lets an agent write.

There is no official Tailscale MCP server

Worth stating clearly, because several aggregator listings imply otherwise. On September 11, 2026 the tailscale GitHub organization had 134 public repositories and none with "mcp" in the name. The nearest thing to an official one is jaxxstorm/tailscale-mcp, written by Lee Briggs, Tailscale's Director of Solutions Engineering. Tailscale's blog republished his write-up with the company's standard disclaimer: the post originally appeared on his personal site, and "We value Tailscalars' opinions, though they may not represent those of Tailscale itself." Treat it as a very well-informed community project, not a vendor product.

What each one exposes

Tool counts are the number everyone quotes and the number everyone gets wrong, our own marketing pages included. Where I could run the server, I ran it. Ours prints its surface on startup:

$ TAILSCALE_API_KEY=tskey-api-... npx -y @yawlabs/tailscale-mcp@latest
@yawlabs/tailscale-mcp v0.19.1 ready (97 tools)
@yawlabs/tailscale-mcp: note -- this server can write to keys, users, acl ... (quoted in full below)
@yawlabs/tailscale-mcp: tip -- set TAILSCALE_PROFILE=core (52 tools) or =minimal (20) to load a smaller tool surface. See README.

$ TAILSCALE_LOCAL_CLI=1 npx -y @yawlabs/tailscale-mcp@latest
@yawlabs/tailscale-mcp v0.19.1 ready (103 tools, local-cli=on)

97 by default, 103 with the opt-in local-node diagnostics. For the others I am quoting their own repositories rather than measuring: the numbers below are what each project documents about itself, with the GitHub metadata read on September 11, 2026.

Capability	`@yawlabs/tailscale-mcp`	jaxxstorm/tailscale-mcp	HexSleeves/tailscale-mcp
Language, install	TypeScript, `npx`	Go binary	TypeScript, `npx`, Docker Hub, GHCR
Transport	stdio	Streamable HTTP on `/mcp` via tsnet; stdio marked deprecated	stdio
Surface	97 tools measured, 103 with local CLI, 4 resources	90 of 90 API operations mapped, per its generated coverage report	Nine tools listed in its README
Local node diagnostics (ping, netcheck, status)	Opt-in via `TAILSCALE_LOCAL_CLI=1`	Admin API only	In the default surface, alongside the API tools
Narrowing the tool surface	`TAILSCALE_PROFILE` (20 / 52 / 97), `TAILSCALE_TOOLS`, `TAILSCALE_READONLY`, `TAILSCALE_WRITE_GROUPS`	OAuth grants in the tailnet policy file, keyed on `jaxxstorm.com/cap/mcp`	None documented in its README
Friction on irreversible calls	`TAILSCALE_REQUIRE_APPROVAL=1` marks nine tools as requiring user interaction	Write tools documented as guarded, requiring an explicit confirmation token	None documented in its README
License	MIT	No LICENSE file in the repository	MIT
Latest activity	v0.19.1 on npm, published 2026-09-09	Pushed 2026-07-20, 31 stars	Pushed 2026-09-10, 129 stars

Two more are worth knowing about. pnocera/tailscale-mcp-server is a Go server built on Tailscale's own tailscale.com/client/tailscale/v2 library, documenting 42 tools each annotated with the OAuth scope it needs; it was last pushed in July 2025. phildougherty/go-tailscale-mcp is CLI-first (profiles, exit nodes, route advertisement) and is the only one of the five with Kubernetes operator tools, behind ENABLE_K8S_OPERATOR=true. Its README says MIT but the repository has no LICENSE file, which is worth resolving before you take it to work.

The thing no tool filter fixes

Every knob in that table filters what the server registers. None of them narrows the credential. Our server says so on startup, unprompted, when your configuration grants writes to an admin-equivalent area:

@yawlabs/tailscale-mcp: note -- this server can write to keys, users, acl, which is
tailnet-admin-equivalent. tailscale_create_key mints an OAuth client with any scopes
the caller asks for, tailscale_update_user_role accepts "owner", and
tailscale_update_acl rewrites policy for every principal. Scope the Tailscale OAuth
client itself to the areas you need -- that bound survives outside this process;
this one does not. TAILSCALE_WRITE_GROUPS narrows what this server exposes.

The sentence about scoping the OAuth client is the whole security argument for this category. An agent that can run a shell and read your environment can call the API directly with the same token, whatever the MCP server chose to advertise. Tool filtering is ergonomics and blast-radius reduction inside a cooperating client; the Tailscale-side OAuth client scope is the actual boundary. This is also where jaxxstorm's design is genuinely stronger than ours, which brings us to the honest part.

Where the alternatives win

jaxxstorm/tailscale-mcp, on authorization and reachability. It serves MCP over Streamable HTTP as a tsnet node, so the endpoint is published on the tailnet itself rather than on a port you have to expose (its README also lists a localhost address), and it authorizes callers through Tailscale OAuth grants expressed in your policy file. That puts access control in the same place as the rest of your tailnet policy, reviewed the same way, instead of in environment variables on a laptop. If you want one shared server for a team rather than a stdio process per developer, this is the design to copy. It also publishes a generated coverage report against a vendored OpenAPI snapshot, which is a better honesty mechanism than a hand-maintained tool count.
HexSleeves/tailscale-mcp, on smallness and reach. Nine documented tools is not a deficiency if nine tools is what you use; it is 88 fewer tool descriptions in your context window, which is a real cost on every single turn (the hidden cost of 200 MCP tools). It is the most-starred of the five by a wide margin -- 129 stars against our 29 when I read GitHub on September 11, 2026 -- ships Docker Hub and GHCR images for people who would rather not run npx, and puts local CLI operations and API operations in one surface without an opt-in flag.
pnocera/tailscale-mcp-server, on provenance. Building on Tailscale's own Go client library means the API types come from the vendor, and every tool description naming its required OAuth scope is a nice touch we do not match.
phildougherty/go-tailscale-mcp, on Kubernetes. If your tailnet is mostly the Tailscale Kubernetes operator, ProxyGroups and Connectors and tailnet ingress are the tools you want, and no other server in this list has them.
The plain CLI, for one machine. If the question is "is this box connected and why is it slow", tailscale status and tailscale netcheck in a shell beat every option here.

Which one to pick

Team server, policy-file authorization, tailnet-only endpoint: jaxxstorm. Accept that it ships no license file, or ask for one.
Small surface, containers, one developer, mixed local and admin questions: HexSleeves.
Broad admin coverage with per-area write scoping and approval prompts, from a laptop: ours. The whole v2 surface is there, and you can cut it to 20 tools when you do not need it.
Kubernetes operator work: phildougherty.
One endpoint in a CI job: none of them. Use curl, or the ACL subcommands below.

Try it

Add it to any MCP client, or let Yaw MCP fan one config out to every client on the machine. The card with the one-click install is on our MCP servers page:

export TAILSCALE_API_KEY="tskey-api-..."
npx -y @yawlabs/tailscale-mcp@latest

# start narrow, widen when you hit a wall
TAILSCALE_PROFILE=core TAILSCALE_READONLY=1 npx -y @yawlabs/tailscale-mcp@latest

# ACL deploys from CI need no agent at all
npx -y @yawlabs/tailscale-mcp@latest validate-acl tailscale/acl.json
npx -y @yawlabs/tailscale-mcp@latest deploy-acl tailscale/acl.json

For what the interactive half actually feels like once it is wired up, five tailnet audits in one prompt is the worked version. Source: github.com/YawLabs/tailscale-mcp.

Frequently Asked Questions

Is there an official Tailscale MCP server?

Not as of September 11, 2026. The tailscale GitHub organization has 134 public repositories and none of them has mcp in the name. The closest thing is a personal project by a Tailscale employee, published on his own account with the company's standard disclaimer that Tailscalars' opinions may not represent Tailscale itself.

Do I need an MCP server if I already have the tailscale CLI?

For single-node work, no. Tailscale's own CLI documentation describes the CLI as a way to manage and troubleshoot your device within your Tailscale network -- your device, singular. Tailnet-wide administration is what the v2 HTTP API covers: its OpenAPI document groups 60 paths under 15 tags including PolicyFile, DNS, Keys, Users and Webhooks. That surface is what an MCP server over the API is for.

How do I stop an agent from rewriting my ACLs?

Scope the Tailscale OAuth client itself. Every tool-filtering environment variable narrows what the MCP server registers, not what the credential can do, so an agent with shell access can still curl the API with the same token. Credential scoping is the bound that survives outside the server process.

Jeff Yaw, Yaw Labs. Follow along at tokenlimit.news for weekly notes on AI infrastructure.

Published by Yaw Labs.