Read devices, users, keys, ACLs and DNS for a tailnet; manage devices, routes and auth keys. For IT admins and DevOps teams who run their network with Tailscale. Hosted by usefulapi — connect from Claude, ChatGPT, Cursor, or any MCP client.
Team and Enterprise: an Owner adds the connector for the organization first.
Run this command, then run /mcp in Claude Code to log in:
Add to Cursor or add this to ~/.cursor/mcp.json:
{
"mcpServers": {
"tailscale": {
"url": "https://tailscale.usefulapi.io/mcp"
}
}
}Add to VS Code or add this to .vscode/mcp.json:
{
"servers": {
"tailscale": {
"type": "http",
"url": "https://tailscale.usefulapi.io/mcp"
}
}
}No Add custom MCP server option? It depends on your account or workspace settings: see OpenAI's guide.
Run these commands. The second one opens the login page:
Other MCP clients (Windsurf, Cline, Zed and more): add the URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser. Do not add an Authorization header: see Before you connect.
The AI lists the devices in the tailnet with OS, addresses, tags and last seen time. It picks out stale ones and groups them by OS or tag.
tailscale_list_devices tailscale_get_device
The AI lists the users and their roles, and the auth keys and API tokens with expiry. You see which keys end soon.
tailscale_list_users tailscale_list_keys tailscale_get_key
The AI reads the policy file, DNS nameservers, split DNS and tailnet settings, and explains them.
tailscale_get_policy_file tailscale_list_dns_nameservers tailscale_get_split_dns tailscale_get_tailnet_settings
The AI renames a device, replaces its ACL tags, authorizes or de-authorizes it, or changes the enabled subnet routes of a device.
Changes data · tailscale_set_device_name tailscale_set_device_tags tailscale_authorize_device tailscale_set_device_routes
The AI expires a device's node key to force sign-in again, deletes a device, or revokes an auth key. It can also create a new auth key.
Changes data · tailscale_expire_device_key tailscale_delete_device tailscale_delete_key tailscale_create_auth_key
The login page asks for your Tailscale API access token.
Optional: Tailnet (optional — defaults to the key's own tailnet).
Generate one in the Tailscale admin console → Settings → Keys → API access tokens. Your credentials are used only to call the API on your behalf and to derive a private account id; they are never shown to anyone.
Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Tailscale API access token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
Turn on the Tailscale connector, then ask in plain words. The AI picks the tools.
| Tool | Type | What it does |
|---|---|---|
tailscale_list_devices | read | List devices List all devices in the tailnet (name, addresses, OS, last seen, tags, etc.). Tailscale REST: GET /tailnet/{tailnet}/devices. |
tailscale_get_device | read | Get device Get a single device by id. Tailscale REST: GET /device/{deviceId}. |
tailscale_list_device_routes | read | List device routes List the subnet routes a device advertises and which are enabled. Tailscale REST: GET /device/{deviceId}/routes. |
tailscale_list_keys | read | List keys List auth keys and API access tokens for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/keys. |
tailscale_get_key | read | Get key Get details of a single auth key / API access token by id (capabilities, expiry, usage). Tailscale REST: GET /tailnet/{tailnet}/keys/{keyId}. |
tailscale_get_policy_file | read | Get policy file Get the tailnet's ACL / policy file (returned as JSON via the Accept header, not HuJSON). Tailscale REST: GET /tailnet/{tailnet}/acl. |
tailscale_list_dns_nameservers | read | List DNS nameservers List the global DNS nameservers configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/nameservers. |
tailscale_get_dns_preferences | read | Get DNS preferences Get the tailnet's DNS preferences (e.g. whether MagicDNS is enabled). Tailscale REST: GET /tailnet/{tailnet}/dns/preferences. |
tailscale_list_dns_searchpaths | read | List DNS search paths List the DNS search paths (search domains) configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/dns/searchpaths. |
tailscale_get_split_dns | read | Get split DNS Get the tailnet's split-DNS configuration — a map of domain → nameservers. Tailscale REST: GET /tailnet/{tailnet}/dns/split-dns. |
tailscale_list_users | read | List users List users of the tailnet, optionally filtered by type, role or status. Tailscale REST: GET /tailnet/{tailnet}/users. |
tailscale_get_user | read | Get user Get a single user by id. Tailscale REST: GET /users/{userId}. |
tailscale_list_webhooks | read | List webhooks List the webhook endpoints configured for the tailnet. Tailscale REST: GET /tailnet/{tailnet}/webhooks. |
tailscale_get_tailnet_settings | read | Get tailnet settings Get the tailnet's settings (device approval, key expiry, posture, etc.). Tailscale REST: GET /tailnet/{tailnet}/settings. |
tailscale_authorize_device | write | Authorize device Authorize or de-authorize a device (only relevant when device approval is enabled for the tailnet). Tailscale REST: POST /device/{deviceId}/authorized. |
tailscale_set_device_name | write | Set device name Set (rename) a device's name. Tailscale REST: POST /device/{deviceId}/name. |
tailscale_set_device_tags | write | Set device tags Set a device's ACL tags. REPLACES the device's existing tags. Tailscale REST: POST /device/{deviceId}/tags. |
tailscale_expire_device_key | write | Expire device key Expire a device's node key, forcing it to re-authenticate — a security response to a compromised or lost device. Tailscale REST: POST /device/{deviceId}/expire. |
tailscale_set_device_routes | write | Set device routes Set the subnet routes ENABLED for a device (from the routes it advertises). REPLACES the enabled set. Tailscale REST: POST /device/{deviceId}/routes. |
tailscale_create_auth_key | write | Create auth key Create a new auth key for the tailnet (used to register new devices). Tailscale REST: POST /tailnet/{tailnet}/keys. |
tailscale_delete_key | write | Delete key Delete (revoke) an auth key or API access token by id — a security response. Tailscale REST: DELETE /tailnet/{tailnet}/keys/{keyId}. |
tailscale_delete_device | write | Delete device Delete a device, removing it from the tailnet. Tailscale REST: DELETE /device/{deviceId}. |
tailscale_usage_status | Usage status (free-tier meter) Report the caller's current usage: the plan, calls used this month, the limit of the plan (the free monthly cap or the Pro fair use limit), remaining, and whether the limit is reached. Read-only; does not count against the meter. | |
tailscale_request_feature | Request a missing feature Tell usefulapi that the user needs something the Tailscale tools cannot do yet (a missing tool, field or filter). Call it only when the user asks for something none of the tools can do, and tell the user that you send the request. Do not call it for errors or for normal requests. Do not include personal data, credentials or customer records. Stored with the product name and the client type (for example Claude or Cursor), without the user's account. At most 5 requests per day. Does not count against the meter. | |
tailscale_upgrade | Upgrade to Pro (unlimited*) Get Pro: unlimited tool calls (fair use limit: 10,000 a month) on Tailscale (the free tier caps monthly usage). Plans: "monthly" — $9/month; "yearly" — $90/year (2 months free). Cancel any time: Pro then runs to the end of the paid period, so it also suits a one-time job. *A fair use limit applies. For heavy use (near Pro's limit): "plus" or "plus_yearly" — Pro+, $39/month or $390/year, unlimited tool calls (fair use limit: 100,000 a month); an existing Pro subscription changes to Pro+ in place (needs confirm: true; the price difference for the rest of the period is charged at once). Otherwise returns a short link to open in your browser (it opens Stripe Checkout); after payment the account upgrades automatically. Does not count against the meter. | |
tailscale_cancel_subscription | Cancel the Pro subscription Cancel the caller's Tailscale Pro subscription at the end of the paid period (no refund for the current period; Pro continues until then, then the free tier applies). Requires confirm: true. Run tailscale_upgrade later to undo the cancel before the period ends. Does not count against the meter. |
| Plan | Price | Limit |
|---|---|---|
| Free | $0 | 50 tool calls / month |
| Pro | $9/mo · $90/yr | Unlimited* |
*Pro fair use limit: 10,000 tool calls a month on this server. For more, write to [email protected].
Pro covers this Tailscale server only. Subscribe with tailscale_upgrade (it returns a Stripe Checkout link). Cancel any time with tailscale_cancel_subscription: Pro continues to the end of the paid period, with no refund for the current period, and running tailscale_upgrade before then undoes the cancel. Or write to [email protected].
Find devices that have not been seen lately. Check users, keys and their expiry. Review ACLs, DNS and tailnet settings. Rename or tag devices, change approval or subnet routes. Respond to a lost device or leaked key. See what you can do for the details.
No. usefulapi is an independent service. It is not affiliated with or endorsed by Tailscale. The server calls the Tailscale API with your own Tailscale access, so it sees only the data that your account can see.
Yes. In Claude, add this server's URL as a custom connector. In ChatGPT, add it as a custom MCP server in Plugins. Then log in once. Cursor, VS Code, Claude Code and Codex work too. See the setup steps.
The login page asks for your Tailscale API access token. See Before you connect for where to find it.
No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Tailscale API access token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
The login stores them encrypted in the authorization grant of your connection. The server uses them to call the Tailscale API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in Tailscale.
Yes, if you approve it. 8 of the 22 Tailscale tools can create or change data. The other 14 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.
The Free plan gives 50 tool calls / month. Pro costs $9/mo or $90/yr, with unlimited tool calls (fair use limit: 10,000 tool calls a month), for this Tailscale server only. Cancel any time: Pro then runs to the end of the paid period. Run tailscale_usage_status to see how many calls you used.
Ask the AI to run tailscale_upgrade: it returns a Stripe Checkout link. To cancel, run tailscale_cancel_subscription. Pro continues to the end of the paid period.
Tell the AI what you wanted to do. It can send the request with tailscale_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.
Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, ChatGPT, Codex, Cursor, VS Code, Windsurf and others.
This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.
Need a tool this server does not have, or a connection to another system? We build custom integrations and MCP servers.