rtailscale

Name: rtailscale
Author: dinglebear-ai

Stars

How to install rtailscale?

dinglebear-ai/rtailscale

$git clone https://github.com/dinglebear-ai/rtailscale

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Install & use

Install rtailscale by running `git clone https://github.com/dinglebear-ai/rtailscale`, then use it for the current task and follow its documentation at https://github.com/dinglebear-ai/rtailscale.

Files · 1

View on GitHub

README.md

1	# tailscale-rmcp
2
3	`tailscale-rmcp` is a Rust MCP server and CLI for managing a
4	[Tailscale](https://tailscale.com/) tailnet through the Tailscale REST API.
5
6	It exposes one MCP tool, `tailscale`, plus the `rtailscale` CLI. Agents can
7	list devices, inspect routes, read API keys, ACL policy, DNS settings, and
8	users, authorize devices, and delete devices when the destructive gate is
9	explicitly enabled.
10
11	30-second path: set `TAILSCALE_API_KEY`, then run
12	`npx -y tailscale-rmcp devices --json` -> start loopback HTTP with
13	`TAILSCALE_MCP_HOST=127.0.0.1 npx -y tailscale-rmcp serve` -> call `tools/call`
14	with `{"action":"devices"}`.
15
16	Status: operational RMCP upstream-client server. Write-capable for device
17	authorization; destructive device deletion requires both server opt-in and
18	caller confirmation. HTTP MCP supports loopback dev mode, static bearer tokens,
19	and Google OAuth through `lab-auth`.
20
21	Not for: replacing the Tailscale admin console, bypassing Tailscale account
22	permissions, operating multiple unrelated tailnets from one trust boundary,
23	storing API keys for callers, arbitrary WireGuard control, or passing Tailscale
24	API keys through MCP tool arguments.
25
26	## Contents
27
28	- [Naming](#naming)
29	- [Capabilities And Boundaries](#capabilities-and-boundaries)
30	- [Install](#install)
31	- [Quickstart](#quickstart)
32	- [Client Configuration](#client-configuration)
33	- [Runtime Surfaces](#runtime-surfaces)
34	- [MCP Tool Reference](#mcp-tool-reference)
35	- [CLI Reference](#cli-reference)
36	- [Configuration](#configuration)
37	- [Authentication](#authentication)
38	- [Safety And Trust Model](#safety-and-trust-model)
39	- [Architecture](#architecture)
40	- [Distribution Contract](#distribution-contract)
41	- [Development](#development)
42	- [Verification](#verification)
43	- [Deployment](#deployment)
44	- [Troubleshooting](#troubleshooting)
45	- [Related Servers](#related-servers)
46	- [Documentation](#documentation)
47	- [License](#license)
48
49	## Naming
50
51	\| Surface \| This repo \|
52	\|---\|---\|
53	\| Repository \| `tailscale-rmcp` \|
54	\| Rust crate \| `tailscale-rmcp` \|
55	\| Binary / CLI \| `rtailscale` \|
56	\| npm package \| `tailscale-rmcp` \|
57	\| npm binary aliases \| `tailscale-rmcp`, `rtailscale` \|
58	\| MCP tool \| `tailscale` \|
59	\| Config home \| `~/.tailscale-mcp` on hosts, `/data` in containers \|
60	\| Env prefixes \| `TAILSCALE_`, `TAILSCALE_MCP_`, `TAILSCALE_RMCP_*` for npm launcher controls \|
61
62	The repo, crate, and npm package use the RMCP family name. The shipped binary is
63	`rtailscale` to avoid shadowing the official `tailscale` CLI.
64
65	## Capabilities And Boundaries
66
67	- List devices and inspect a single device by node ID or legacy numeric device
68	ID.
69	- Read subnet routes, API keys, ACL policy, DNS/MagicDNS settings, and tailnet
70	users.
71	- Authorize a device for the tailnet.
72	- Delete a device only when `TAILSCALE_ALLOW_DESTRUCTIVE=true` and the caller
73	also passes explicit confirmation.
74	- Provide setup and doctor commands for local plugin/runtime checks.
75
76	\| This repo owns \| Tailscale owns \| Explicitly out of scope \|
77	\|---\|---\|---\|
78	\| MCP/CLI projection, request validation, HTTP MCP auth policy, response shaping, setup checks, and destructive gates. \| Tailnet state, device identities, ACL semantics, DNS behavior, API key issuance, user membership, and upstream authorization. \| Replacing the admin console, storing caller credentials, multi-tailnet tenancy, arbitrary WireGuard control, policy editing beyond exposed actions, and local Tailscale daemon management. \|
79
80	## Install
81
82	\| Path \| Command \| Best for \| Notes \|
83	\|---\|---\|---\|---\|
84	\| npm / npx \| `npx -y tailscale-rmcp --help` \| Local MCP clients and quick trials. \| Downloads the matching `rtailscale` binary from GitHub Releases. \|
85	\| Release installer \| `curl -fsSL https://raw.githubusercontent.com/jmagar/rtailscale/main/scripts/install.sh \\| bash` \| Host installs without Node. \| Installs `rtailscale` for the current Linux host. \|
86	\| Docker / Compose \| `docker compose up -d` \| Shared HTTP MCP deployments. \| Reads `.env` and exposes container port `40040`. \|
87	\| Build from source \| `cargo build --release` \| Development and audits. \| Produces `target/release/rtailscale`. \|
88	\| Plugin \| `claude plugin install plugins/tailscale` \| Claude Code local plugin setup from this checkout. \| Uses the packaged setup hook, skill, and local runtime metadata. \|
89
90	### npm / npx
91
92	Run the stdio MCP server or CLI without a manual binary install:
93
94	```bash
95	npx -y tailscale-rmcp --help
96	npx -y tailscale-rmcp mcp
97	npx -y tailscale-rmcp devices --json
98	```
99
100	The npm package downloads `rtailscale` during `postinstall`. Override download
101	behavior only when testing packaging:
102
103	\| Variable \| Purpose \|
104	\|---\|---\|
105	\| `TAILSCALE_RMCP_SKIP_DOWNLOAD=1` \| Skip postinstall binary download. \|
106	\| `TAILSCALE_RMCP_VERSION` or `TAILSCALE_RMCP_BINARY_VERSION` \| Select the GitHub Release tag. \|
107	\| `TAILSCALE_RMCP_REPO` \| Select the GitHub repo used for release downloads. \|
108	\| `TAILSCALE_RMCP_RELEASE_BASE_URL` \| Select a custom release base URL. \|
109
110	### Build From Source
111
112	```bash
113	git clone https://github.com/jmag

6 picks

Type

rtailscale

bydinglebear-ai· 6 MCP servers

Stars

How to install rtailscale?

dinglebear-ai/rtailscale

$git clone https://github.com/dinglebear-ai/rtailscale

Installs into the current project.

›Prefer a prompt? Paste this to your agent

Install & use

Install rtailscale by running `git clone https://github.com/dinglebear-ai/rtailscale`, then use it for the current task and follow its documentation at https://github.com/dinglebear-ai/rtailscale.

Files · 1

View on GitHub

README.md

1	# tailscale-rmcp
2
3	`tailscale-rmcp` is a Rust MCP server and CLI for managing a
4	[Tailscale](https://tailscale.com/) tailnet through the Tailscale REST API.
5
6	It exposes one MCP tool, `tailscale`, plus the `rtailscale` CLI. Agents can
7	list devices, inspect routes, read API keys, ACL policy, DNS settings, and
8	users, authorize devices, and delete devices when the destructive gate is
9	explicitly enabled.
10
11	30-second path: set `TAILSCALE_API_KEY`, then run
12	`npx -y tailscale-rmcp devices --json` -> start loopback HTTP with
13	`TAILSCALE_MCP_HOST=127.0.0.1 npx -y tailscale-rmcp serve` -> call `tools/call`
14	with `{"action":"devices"}`.
15
16	Status: operational RMCP upstream-client server. Write-capable for device
17	authorization; destructive device deletion requires both server opt-in and
18	caller confirmation. HTTP MCP supports loopback dev mode, static bearer tokens,
19	and Google OAuth through `lab-auth`.
20
21	Not for: replacing the Tailscale admin console, bypassing Tailscale account
22	permissions, operating multiple unrelated tailnets from one trust boundary,
23	storing API keys for callers, arbitrary WireGuard control, or passing Tailscale
24	API keys through MCP tool arguments.
25
26	## Contents
27
28	- [Naming](#naming)
29	- [Capabilities And Boundaries](#capabilities-and-boundaries)
30	- [Install](#install)
31	- [Quickstart](#quickstart)
32	- [Client Configuration](#client-configuration)
33	- [Runtime Surfaces](#runtime-surfaces)
34	- [MCP Tool Reference](#mcp-tool-reference)
35	- [CLI Reference](#cli-reference)
36	- [Configuration](#configuration)
37	- [Authentication](#authentication)
38	- [Safety And Trust Model](#safety-and-trust-model)
39	- [Architecture](#architecture)
40	- [Distribution Contract](#distribution-contract)
41	- [Development](#development)
42	- [Verification](#verification)
43	- [Deployment](#deployment)
44	- [Troubleshooting](#troubleshooting)
45	- [Related Servers](#related-servers)
46	- [Documentation](#documentation)
47	- [License](#license)
48
49	## Naming
50
51	\| Surface \| This repo \|
52	\|---\|---\|
53	\| Repository \| `tailscale-rmcp` \|
54	\| Rust crate \| `tailscale-rmcp` \|
55	\| Binary / CLI \| `rtailscale` \|
56	\| npm package \| `tailscale-rmcp` \|
57	\| npm binary aliases \| `tailscale-rmcp`, `rtailscale` \|
58	\| MCP tool \| `tailscale` \|
59	\| Config home \| `~/.tailscale-mcp` on hosts, `/data` in containers \|
60	\| Env prefixes \| `TAILSCALE_`, `TAILSCALE_MCP_`, `TAILSCALE_RMCP_*` for npm launcher controls \|
61
62	The repo, crate, and npm package use the RMCP family name. The shipped binary is
63	`rtailscale` to avoid shadowing the official `tailscale` CLI.
64
65	## Capabilities And Boundaries
66
67	- List devices and inspect a single device by node ID or legacy numeric device
68	ID.
69	- Read subnet routes, API keys, ACL policy, DNS/MagicDNS settings, and tailnet
70	users.
71	- Authorize a device for the tailnet.
72	- Delete a device only when `TAILSCALE_ALLOW_DESTRUCTIVE=true` and the caller
73	also passes explicit confirmation.
74	- Provide setup and doctor commands for local plugin/runtime checks.
75
76	\| This repo owns \| Tailscale owns \| Explicitly out of scope \|
77	\|---\|---\|---\|
78	\| MCP/CLI projection, request validation, HTTP MCP auth policy, response shaping, setup checks, and destructive gates. \| Tailnet state, device identities, ACL semantics, DNS behavior, API key issuance, user membership, and upstream authorization. \| Replacing the admin console, storing caller credentials, multi-tailnet tenancy, arbitrary WireGuard control, policy editing beyond exposed actions, and local Tailscale daemon management. \|
79
80	## Install
81
82	\| Path \| Command \| Best for \| Notes \|
83	\|---\|---\|---\|---\|
84	\| npm / npx \| `npx -y tailscale-rmcp --help` \| Local MCP clients and quick trials. \| Downloads the matching `rtailscale` binary from GitHub Releases. \|
85	\| Release installer \| `curl -fsSL https://raw.githubusercontent.com/jmagar/rtailscale/main/scripts/install.sh \\| bash` \| Host installs without Node. \| Installs `rtailscale` for the current Linux host. \|
86	\| Docker / Compose \| `docker compose up -d` \| Shared HTTP MCP deployments. \| Reads `.env` and exposes container port `40040`. \|
87	\| Build from source \| `cargo build --release` \| Development and audits. \| Produces `target/release/rtailscale`. \|
88	\| Plugin \| `claude plugin install plugins/tailscale` \| Claude Code local plugin setup from this checkout. \| Uses the packaged setup hook, skill, and local runtime metadata. \|
89
90	### npm / npx
91
92	Run the stdio MCP server or CLI without a manual binary install:
93
94	```bash
95	npx -y tailscale-rmcp --help
96	npx -y tailscale-rmcp mcp
97	npx -y tailscale-rmcp devices --json
98	```
99
100	The npm package downloads `rtailscale` during `postinstall`. Override download
101	behavior only when testing packaging:
102
103	\| Variable \| Purpose \|
104	\|---\|---\|
105	\| `TAILSCALE_RMCP_SKIP_DOWNLOAD=1` \| Skip postinstall binary download. \|
106	\| `TAILSCALE_RMCP_VERSION` or `TAILSCALE_RMCP_BINARY_VERSION` \| Select the GitHub Release tag. \|
107	\| `TAILSCALE_RMCP_REPO` \| Select the GitHub repo used for release downloads. \|
108	\| `TAILSCALE_RMCP_RELEASE_BASE_URL` \| Select a custom release base URL. \|
109
110	### Build From Source
111
112	```bash
113	git clone https://github.com/jmag

6 picks

Type

rtailscale

How to install rtailscale?

Related

rtailscale

How to install rtailscale?

Related