Tailscale MCP Server

- Device management— list, authorize, deauthorize, delete, expire keys, manage routes.
- Network operations— connect/disconnect host, ping peers, get CLI status and version.
- Administration— tailnet info, file sharing, exit nodes, webhooks, device tags, server version.
- ACL and policy— read/validate/update ACL, DNS settings, auth keys, policy file, network lock.
- Read-only resources— tailnet summary, device list, per-device detail, current ACL.
- Prompts— guided connectivity diagnosis and ACL change review.
- Risk-gated tools—read,write, andadminlevels viaTAILSCALE_ALLOWED_TOOL_RISK.
- OAuth + API key— OAuth client credentials (preferred) or legacy API key.
- Private HTTP mode— bearer auth, Host validation, request size limits, health check endpoint.
- Docker support— pre-built images on Docker Hub and GHCR; sidecar deployment with Tailscale Serve.

- Node.js 20+— run vianpxor install globally (no extra runtime needed).
- Bun 1.3+— used for development; also works as a production runtime.
- Docker— use the pre-built image (no local runtime required).

- OAuth client credentials:TAILSCALE_OAUTH_CLIENT_ID+TAILSCALE_OAUTH_CLIENT_SECRET(preferred).
- Legacy API key:TAILSCALE_API_KEY.

The localTailscale CLIis optional. It is only required for CLI-backed tools:get_network_status,connect_network,disconnect_network,ping_peer,get_version, andmanage_exit_nodes(set/clear operations).

Edit~/.claude/claude_desktop_config.json(create if absent).

docker run --rm \ -e TAILSCALE_API_KEY="tskey-api-..." \ -e TAILSCALE_TAILNET="-" \ -p 127.0.0.1:3000:3000 \ hexsleeves/tailscale-mcp-server:latest

docker run --rm \ -e TAILSCALE_API_KEY="tskey-api-..." \ -e TAILSCALE_TAILNET="-" \ -p 127.0.0.1:3000:3000 \ ghcr.io/hexsleeves/tailscale-mcp-server:latest

Once the server is connected to your MCP client, try these:

- "List my Tailscale devices and show which ones are offline."
- "What is the current Tailscale network status on this machine?"
- "Diagnose connectivity to my NAS at 100.64.0.5."
- "Show me the current ACL policy for my tailnet."
- "Review this ACL change before I apply it."(attach the new policy)
- "What DNS nameservers is my tailnet using?"
- "List all active webhooks in my tailnet."

# Install dependencies (Bun required for development) bun install # Type check bun run typecheck # Run tests bun test # Lint and format bun run check # Build bun run build # Full verification (typecheck + lint + test + build) bun run qa:full # Security audit bun audit

Network reconnaissance and security scanning with port scanning, DNS analysis, and vulnerability assessment

Provides a unified interface to AWS services for security investigations and incident response.

Interact with the Illumio Policy Compute Engine (PCE) to manage workloads, labels, and analyze traffic flows.

A Python-based MCP server for Cisco's Meraki Dashboard, providing tools to query the API for discovering, monitoring, and managing your Meraki environment.

Network diagnostics from 6 global regions — SSL, DNS, ping, whois, traceroute, port scan, latency. Works without an API key.

MCP access to cluster-wide L4 and L7 network traffic, packets, APIs, and complete payloads.

Retrieves essential network information from devices using gNMI and OpenConfig models.

Civilian situational awareness for AI deployments — real-time risk dashboards, multi-source threat correlation, anomaly detection, and automated alerting for critical infrastructure and enterprise AI systems.

MCP servers for managing homelab infrastructure through Claude Desktop. Monitor Docker/Podman containers, Ollama AI models, Pi-hole DNS, Unifi networks, and Ansible inventory.