Manage and inspect a Tailscale tailnet end-to-end through 97 admin-API tools, 4 browseable resources, an always-on tool-catalog helper, and 6 optional local-CLI diagnostics.

• Devices — list/get devices with server-side filters and field selection; authorize, deauthorize, bulk authorize, delete, rename, expire keys, set tags, set IP, toggle key expiry, and manage subnet routes and posture attributes.

• ACLs / policy — read HuJSON ACLs with ETag, validate, preview rules per user/IP, diff who gains or loses access, and safely update via ETag-protected writes.

• DNS — get/set nameservers, search paths, split DNS (full or partial merge), MagicDNS preferences, and a unified all-in-one config get/set.

• Keys / trust credentials — list, get, create, update, delete auth keys, OAuth clients, federated (OIDC) identities, plus OAuth Apps for third-party device provisioning.

• Users — list/get, approve, suspend, restore, change roles, delete users and their devices.

• Tailnet settings & contacts — read/update HTTPS, device/user approval, key expiry, auto-updates, regional routing, flow logging, external ACL management; manage security/support/account contacts.

• Organization tailnets — list, create API-only tailnets (returns one-time OAuth secret), and irreversibly delete tailnets.

• Webhooks — list, create, update, delete, rotate secrets, and send test events.

• Posture integrations — list, get, create, update, delete integrations for providers like Falcon, Fleet, Intune, Jamf, Kandji, Kolide, SentinelOne.

• Services — list/get/update/delete Tailscale Services, list hosts, and approve or reject hosting devices.

• Log streaming — configure audit/flow log delivery to Axiom, Datadog, Splunk, Elastic, S3, etc.; check delivery status; manage AWS external IDs and validate IAM trust policies.

• Invites — create, list, get, resend, delete, and accept device invites and user invites.

• Logs — pull configuration audit logs and network flow logs over a time range.

• Resources — browse tailnet status, devices, ACL policy, and DNS config without a tool call.

• tailscale_tool_groups — always available; explains which tools exist and, if one is missing, the exact env var change to enable it.

• Local CLI (opt-in via TAILSCALE_LOCAL_CLI=1) — read-only diagnostics from the local tailscale binary: status, ping, netcheck, version, whoami, service list.

• Configuration knobs — subset tools via profiles/groups (TAILSCALE_PROFILE, TAILSCALE_TOOLS), drop writes (TAILSCALE_READONLY), scope writes (TAILSCALE_WRITE_GROUPS), and force approval on irreversible tools (TAILSCALE_REQUIRE_APPROVAL).

Integrates with the Tailscale v2 API to manage a tailnet, including tools for devices, ACLs, DNS, keys, users, webhooks, audit logs, and other administrative functions.

1. Click on "Deploy Server".

2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.

3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@@yawlabs/tailscale-mcp list devices that haven't checked in for 30 days"

That's it! The server will respond to your query, and you can continue using it as needed.

Here is a step-by-step guide with screenshots.