# Tailscale MCP for AI Agents AI Agent Connect > Tailscale MCP. Manage your mesh network, update ACL policies, and handle auth keys directly from your AI agent. ## Overview - **Category:** loved-by-devs - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_rCjYDxccyBQHR5o8xMpQrvp3OV1s24bpVdqdPLwd/ai-agent-connect - **Tags:** vpn, zero-trust, mesh-network, network-security, acl, remote-access ## Description This Connector connects your private mesh network to your AI client so you can manage your infrastructure through plain English. Instead of hunting through the admin console to find a specific node or mess with complex HuJSON files, you just tell your agent what to do. You can audit users, rotate auth keys, and organize your fleet with tags without ever leaving your chat window. It's a huge help when you're using the Vinkius catalog to coordinate multiple tools because it keeps your network management in the same flow as your development work. You get a network admin that actually understands your specific tailnet context. You don't have to remember specific command syntax or navigate nested menus. Your agent handles the heavy lifting of interacting with the API while you focus on the actual work of maintaining a secure, zero-trust environment. If you're tired of jumping between tabs to check who has access to what, this tool puts those controls right in your chat interface. You can quickly see who's joined, verify their permissions, and kick out old devices in seconds. It turns a manual, multi-step process into a conversation, making it much easier to keep your private network organized and secure as your fleet grows. ## Tools ### delete_device Permanently remove a decommissioned node from your tailnet. It helps keep your device list clean and accurate. ### get_device Pull specific data about a node in your network. It's useful for checking the status of a remote machine. ### get_tailnet_acl View your current HuJSON policy rules. This is the first step to checking who has access to what. ### get_auth_key Fetch the details of a specific authentication key. Use this to check the status of your existing keys. ### get_user Look up the profile information for a specific tailnet member. This is great for auditing your team's access. ### list_auth_keys See every auth key currently active in your tailnet. Use this to keep track of your automated access points. ### list_tailnet_devices Get a full list of all nodes currently joined to your network. This provides a quick overview of your entire fleet. ### authorize_device Give a new machine permission to join your network. This makes onboarding new hardware much faster. ### create_auth_key Generate a new key for automated node joining. You'll use this for CI/CD pipelines or ephemeral access. ### delete_auth_key Remove an old or compromised key from your system. This keeps your network secure from unauthorized access. ### list_users Pull a list of all users within your tailnet. It's a fast way to see who's currently on your network. ### update_tailnet_acl Modify your HuJSON policy files to change access rules. You can update permissions without opening the web console. ### update_device_tags Change the tags on your existing network devices. This helps you organize your fleet into logical groups. ## Prompt Examples **Prompt:** ``` List all devices in the tailnet 'mycompany.com'. ``` **Response:** ``` I've pulled the device list for mycompany.com. You have 12 active nodes right now. Here are a few of the main ones: * **web-server-01** (ID: 14023) * **dev-laptop** (ID: 15092) * **backup-storage** (ID: 18820) Would you like me to pull the specific details for any of these? ``` **Prompt:** ``` Show me the current ACL policy for my default tailnet. ``` **Response:** ``` Fetching your current HuJSON policy... Here is the ACL for your default tailnet: **Groups:** * Admin * Developers * Production * Guest **Rules:** * Admin has full access. * Developers can access dev-nodes. * Production is restricted to web-servers. * Guests have no access. Do you want to update any of these rules? ``` **Prompt:** ``` Create a new reusable auth key for the tailnet 'example.com'. ``` **Response:** ``` I've created a new reusable auth key for example.com. **Key ID:** `key-abc123xyz` Please save this ID somewhere secure right now. It won't be shown again for security reasons. ``` ## Capabilities ### Audit tailnet users List all members of your network and pull specific profile details for security checks. ### Update access rules Modify HuJSON policy files to change permissions for different groups or devices. ### Automate node joining Create and manage auth keys to allow machines to join your network without manual intervention. ### Organize device fleet Apply and update tags on your nodes to keep your infrastructure organized. ### Prune old hardware Identify and delete decommissioned devices from your network using their unique IDs. ## Use Cases ### Automating CI/CD Node Access A DevOps engineer needs to give a new build server access to the network. They ask the agent to create_auth_key and then authorize the device automatically. ### Rapid Security Audits A security lead wants to know who has access to production. They ask the agent to get_tailnet_acl and list_users to verify the current permissions. ### Cleaning Up Decommissioned Hardware An IT admin needs to remove 50 old laptops from the network. They ask the agent to list_tailnet_devices and delete_device for each old ID. ### Dynamic Group Tagging A developer wants to move a server from the staging group to production. They ask the agent to update_device_tags to change its label. ## Benefits - Stop switching tabs by using list_tailnet_devices to see your entire fleet in one place. - Update security rules instantly with update_tailnet_acl without touching the web console. - Simplify your CI/CD pipelines by using create_auth_key to automate node onboarding. - Maintain a clean network by using delete_device to remove old hardware from your list. - Speed up security audits by using list_users and get_user to verify team permissions. ## How It Works The bottom line is you get a conversational interface for your entire zero-trust network infrastructure. 1. Subscribe to this Connector and provide your Tailscale API Key. 2. Connect your preferred AI client like Claude or Cursor. 3. Ask your agent to perform tasks like listing devices or updating ACLs. ## Frequently Asked Questions **Can the Tailscale MCP manage my network security?** Yes, it allows you to update your HuJSON policy files and manage access rules through natural language, making it easier to maintain a zero-trust environment. **How do I use the Tailscale MCP to audit my users?** You can simply ask your agent to list all users or fetch the profile of a specific member to see who is currently on your network. **Can I automate my CI/CD with the Tailscale MCP?** Yes, you can use it to create auth keys for automated node joining, which is perfect for setting up automated build servers or ephemeral environments. **Does the Tailscale MCP work with my current ACLs?** It connects directly to your existing Tailscale configuration, allowing you to view and modify your current policies without overwriting your setup. **How does the Tailscale MCP help with device cleanup?** It lets you identify decommissioned hardware and delete those specific nodes from your tailnet using their unique IDs to keep your fleet list clean. **Is the Tailscale MCP safe for managing my private network?** It uses your official Tailscale API keys, ensuring that all actions performed by your AI agent are authenticated and governed by your existing security settings. **Can I update my network's security policy (ACL) using this server?** Yes! You can use `get_tailnet_acl` to view the current HuJSON policy and `update_tailnet_acl` to apply changes directly to your tailnet configuration. **How do I authorize a new device that is pending approval?** Use the `authorize_device` tool with the specific `device_id` and set the `authorized` parameter to true. This allows you to manage node entry without the admin console. **Is it possible to generate temporary authentication keys for my servers?** Absolutely. Use the `create_auth_key` tool. You can optionally provide capabilities like 'ephemeral' or 'reusable' in the JSON payload to define how the key should behave.