tailscale-rmcp

MCP server and CLI for Tailscale: inspect and manage tailnet devices, routes, users, keys, DNS, and ACL policy over stdio or streamable HTTP.

It exposes one MCP tool, tailscale, plus the rtailscale CLI. Agents can list devices, inspect routes, read API keys, ACL policy, DNS settings, and users, authorize devices, and delete devices when the destructive gate is explicitly enabled.

30-second path: set TAILSCALE_API_KEY, then run npx -y tailscale-rmcp devices --json -> start loopback HTTP with TAILSCALE_MCP_HOST=127.0.0.1 npx -y tailscale-rmcp serve -> call tools/call with {"action":"devices"}.

Status: operational RMCP upstream-client server. Write-capable for device authorization; destructive device deletion requires both server opt-in and caller confirmation. HTTP MCP supports loopback dev mode, static bearer tokens, and Google OAuth through lab-auth.

Not for: replacing the Tailscale admin console, bypassing Tailscale account permissions, operating multiple unrelated tailnets from one trust boundary, storing API keys for callers, arbitrary WireGuard control, or passing Tailscale API keys through MCP tool arguments.

Contents

• Naming
• Capabilities And Boundaries
• Install
• Quickstart
• Client Configuration
• Runtime Surfaces
• MCP Tool Reference
• CLI Reference
• Configuration
• Authentication
• Safety And Trust Model
• Architecture
• Distribution Contract
• Development
• Verification
• Deployment
• Troubleshooting
• Related Servers
• Documentation
• License

Naming

Surface	This repo
Repository	tailscale-rmcp
Rust crate	tailscale-rmcp
Binary / CLI	rtailscale
npm package	tailscale-rmcp
npm binary aliases	tailscale-rmcp, rtailscale
MCP tool	tailscale
Config home	~/.tailscale-mcp on hosts, /data in containers
Env prefixes	TAILSCALE_*, TAILSCALE_MCP_*, TAILSCALE_RMCP_* for npm launcher controls

The repo, crate, and npm package use the RMCP family name. The shipped binary is rtailscale to avoid shadowing the official tailscale CLI.

Capabilities And Boundaries

• List devices and inspect a single device by node ID or legacy numeric device ID.
• Read subnet routes, API keys, ACL policy, DNS/MagicDNS settings, and tailnet users.
• Authorize a device for the tailnet.
• Delete a device only when TAILSCALE_ALLOW_DESTRUCTIVE=true and the caller also passes explicit confirmation.
• Provide setup and doctor commands for local plugin/runtime checks.

This repo owns	Tailscale owns	Explicitly out of scope
MCP/CLI projection, request validation, HTTP MCP auth policy, response shaping, setup checks, and destructive gates.	Tailnet state, device identities, ACL semantics, DNS behavior, API key issuance, user membership, and upstream authorization.	Replacing the admin console, storing caller credentials, multi-tailnet tenancy, arbitrary WireGuard control, policy editing beyond exposed actions, and local Tailscale daemon management.

Install

Path	Command	Best for	Notes
npm / npx	npx -y tailscale-rmcp --help	Local MCP clients and quick trials.	Downloads the matching rtailscale binary from GitHub Releases.
Release installer	curl -fsSL https://raw.githubusercontent.com/dinglebear-ai/rtailscale/main/scripts/install.sh | bash	Host installs without Node.	Installs rtailscale for the current Linux host.
Docker / Compose	docker compose up -d	Shared HTTP MCP deployments.	Reads .env and exposes container port 40040.
B