• READ
  • WRITE
  • AUDIT
  • REVIEW

How to update Tailscale ACL policies with your AI

Connect your AI to your Tailscale account to manage network permissions through chat. Once connected, your agent handles the HuJSON syntax for you.

Ask AI about this page

Short answer

Can I update my Tailscale ACLs using AI?

Yes. Your AI pulls your current HuJSON policy, modifies the rules according to your request, and pushes the changes back to your tailnet. You get precise network control without manually editing JSON files.

Where every change lands.

The outcomes of your requests.

Depending on what you ask, your AI will perform one of these four actions.

READ

Current policy view

The AI pulls your existing HuJSON configuration so it knows exactly what rules are currently active in your tailnet.

WRITE

Applied policy updates

Your agent pushes new or modified HuJSON rules directly to Tailscale to change how devices interact.

AUDIT

Security gap analysis

The AI reviews your current access rules to find overly permissive settings or unused permissions.

REVIEW

Human approval required

For any policy changes, the AI presents the proposed HuJSON block for you to check before it applies the update.

The workflow

What your AI does when the request arrives.

The AI handles the heavy lifting of parsing and applying complex HuJSON structures.

  1. Fetch current rules

    The AI starts by pulling your existing Tailscale access control list to understand your current network topology.

    get_tailnet_acl

  2. Draft new policy

    Your agent calculates the necessary HuJSON changes to add, remove, or modify specific user and device permissions.

    get_tailnet_acl

  3. Apply the update

    Once you approve the logic, the AI sends the updated HuJSON configuration to your tailnet.

    update_tailnet_acl

  4. Verify connectivity

    The AI confirms the new rules are active by checking the updated state of your tailnet ACL.

    get_tailnet_acl

Try it

Copy these to start.

Use these prompts to begin managing your tailnet.

Starting points

Replace the bracketed text with your specific device names, user tags, or group names.

Tailscale Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_rCjYDxccyBQHR5o8xMpQrvp3OV1s24bpVdqdPLwd/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Tailscale capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "tailscale-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_rCjYDxccyBQHR5o8xMpQrvp3OV1s24bpVdqdPLwd/mcp"
    }
  }
}
Copy into chat04

  • Show me my current Tailscale ACL policy.

  • Add a rule to allow the 'dev-group' tag to access the 'production-server' tag.

  • Restrict access so only 'user@example.com' can reach the 'database' machine.

  • Remove all access rules for the 'guest-wifi' tag.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Tailscale once, then ask.

You only need to authenticate once. Your credentials stay encrypted, and you can immediately start managing your network through your preferred AI client.

Connect Tailscale to your AI

FAQ

How this task behaves.

  • 01

    Can the AI delete my entire ACL policy?

    No. The AI only performs the specific modifications you request. It cannot wipe your configuration unless you explicitly tell it to remove all rules.

  • 02

    Does the AI handle the HuJSON syntax for me?

    Yes. You describe the access you want in plain English, and the AI handles the HuJSON formatting and syntax.

  • 03

    Will the AI apply changes without my permission?

    No. The AI presents the proposed changes for your review. You must confirm the update before it is pushed to your tailnet.

  • 04

    Can the AI create new Tailscale users?

    No. This MCP only manages access control policies. It cannot create or delete users in your Tailscale account.

  • 05

    Can the AI manage Tailscale exit nodes?

    No. The available tools are limited to reading and updating ACL policies.

  • More questions about Tailscale? The Connector page answers them. See everything the Tailscale Connector can do

Connect Tailscale to Claude, Cursor, ChatGPT & more