usefulapi

Tailscale MCP server. Read devices, users, keys, ACLs and DNS for a tailnet; manage devices, routes and auth keys.

Claude

Open Settings → Connectors → Add custom connector
Paste this URL:
https://tailscale.usefulapi.io/mcp
Authenticate with Tailscale when prompted

Cursor · VS Code · Windsurf · Cline

Add to your MCP config, then reload & authorize:

{
  "mcpServers": {
    "tailscale": {
      "url": "https://tailscale.usefulapi.io/mcp"
    }
  }
}

live24 toolsFree 100 tool calls / monthPro $9/mo · $90/yr

Tools 24

Tool	Type	What it does
`tailscale_list_devices`	read	List devices List all devices in the tailnet (name, addresses, OS, last seen, tags, etc.). Tailscale REST: GET /tailnet/{tailnet}/devices.
`tailscale_get_device`	read	Get device Get a single device by id. Tailscale REST: GET /device/{deviceId}.
`tailscale_list_device_routes`	read	List device routes List the subnet routes a device advertises and which are enabled. Tailscale REST: GET /device/{deviceId}/routes.
`tailscale_list_keys`	read	List keys List auth keys and API access tokens for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/keys.
`tailscale_get_key`	read	Get key Get details of a single auth key / API access token by id (capabilities, expiry, usage). Tailscale REST: GET /tailnet/{tailnet}/keys/{keyId}.
`tailscale_get_policy_file`	read	Get policy file Get the tailnet's ACL / policy file (returned as JSON via the Accept header, not HuJSON). Tailscale REST: GET /tailnet/{tailnet}/acl.
`tailscale_list_dns_nameservers`	read	List DNS nameservers List the global DNS nameservers configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/nameservers.
`tailscale_get_dns_preferences`	read	Get DNS preferences Get the tailnet's DNS preferences (e.g. whether MagicDNS is enabled). Tailscale REST: GET /tailnet/{tailnet}/dns/preferences.
`tailscale_list_dns_searchpaths`	read	List DNS search paths List the DNS search paths (search domains) configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/searchpaths.
`tailscale_get_split_dns`	read	Get split DNS Get the tailnet's split-DNS configuration — a map of domain → nameservers. Tailscale REST: GET /tailnet/{tailnet}/dns/split-dns.
`tailscale_list_users`	read	List users List users of the tailnet, optionally filtered by type, role or status. Tailscale REST: GET /tailnet/{tailnet}/users.
`tailscale_get_user`	read	Get user Get a single user by id. Tailscale REST: GET /users/{userId}.
`tailscale_list_webhooks`	read	List webhooks List the webhook endpoints configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/webhooks.
`tailscale_get_tailnet_settings`	read	Get tailnet settings Get the tailnet's settings (device approval, key expiry, posture, etc.). Tailscale REST: GET /tailnet/{tailnet}/settings.
`tailscale_authorize_device`	write	Authorize device Authorize or de-authorize a device (only relevant when device approval is enabled for the tailnet). Tailscale REST: POST /device/{deviceId}/authorized.
`tailscale_set_device_name`	write	Set device name Set (rename) a device's name. Tailscale REST: POST /device/{deviceId}/name.
`tailscale_set_device_tags`	write	Set device tags Set a device's ACL tags. REPLACES the device's existing tags. Tailscale REST: POST /device/{deviceId}/tags.
`tailscale_expire_device_key`	write	Expire device key Expire a device's node key, forcing it to re-authenticate — a security response to a compromised or lost device. Tailscale REST: POST /device/{deviceId}/expire.
`tailscale_set_device_routes`	write	Set device routes Set the subnet routes ENABLED for a device (from the routes it advertises). REPLACES the enabled set. Tailscale REST: POST /device/{deviceId}/routes.
`tailscale_create_auth_key`	write	Create auth key Create a new auth key for the tailnet (used to register new devices). Tailscale REST: POST /tailnet/{tailnet}/keys.
`tailscale_delete_key`	write	Delete key Delete (revoke) an auth key or API access token by id — a security response. Tailscale REST: DELETE /tailnet/{tailnet}/keys/{keyId}.
`tailscale_delete_device`	write	Delete device Delete a device, removing it from the tailnet. Tailscale REST: DELETE /device/{deviceId}.
`tailscale_usage_status`	meta	Usage status (free-tier meter) Report the caller's current free-tier usage this month: calls used, monthly limit, remaining, and whether the cap is reached.
`tailscale_upgrade`	meta	Upgrade to Pro (unlimited) Subscribe to Pro for unlimited tool calls, monthly ($9) or yearly ($90). Returns a Stripe Checkout link.

Pricing

Plan	Price	Limit
Free	$0	100 tool calls / month
Pro	$9/mo · $90/yr	Unlimited

This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.