@yawlabs/tailscale-mcp 0.1.6 → 0.2.1

package/dist/tools/workload-identity.js

@@ -0,0 +1,105 @@
+import { z } from "zod";
+import { apiDelete, apiGet, apiPatch, apiPost, encPath, getTailnet } from "../api.js";
+export const workloadIdentityTools = [
+    {
+        name: "tailscale_list_workload_identities",
+        description: "List all federated workload identity providers configured for your tailnet. Workload identities allow CI/CD pipelines and automated systems to authenticate using OIDC federation.",
+        annotations: {
+            title: "List workload identities",
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        inputSchema: z.object({}),
+        handler: async () => {
+            return apiGet(`/tailnet/${getTailnet()}/workload-identity/providers`);
+        },
+    },
+    {
+        name: "tailscale_get_workload_identity",
+        description: "Get details for a specific workload identity provider.",
+        annotations: {
+            title: "Get workload identity",
+            readOnlyHint: true,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        inputSchema: z.object({
+            providerId: z.string().describe("The workload identity provider ID"),
+        }),
+        handler: async (input) => {
+            return apiGet(`/tailnet/${getTailnet()}/workload-identity/providers/${encPath(input.providerId)}`);
+        },
+    },
+    {
+        name: "tailscale_create_workload_identity",
+        description: "Create a new workload identity provider for OIDC federation. Enables CI/CD systems (GitHub Actions, GitLab CI, etc.) to authenticate to your tailnet without static credentials.",
+        annotations: {
+            title: "Create workload identity",
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: false,
+            openWorldHint: true,
+        },
+        inputSchema: z.object({
+            name: z.string().describe("A human-readable name for this provider"),
+            issuerUrl: z
+                .string()
+                .describe("The OIDC issuer URL (e.g. 'https://token.actions.githubusercontent.com' for GitHub Actions)"),
+            audience: z.string().optional().describe("Expected audience claim in the OIDC token"),
+            claimMappings: z
+                .record(z.string(), z.string())
+                .optional()
+                .describe("Map of Tailscale attributes to OIDC token claims (e.g. { 'tag': 'repository' })"),
+        }),
+        handler: async (input) => {
+            return apiPost(`/tailnet/${getTailnet()}/workload-identity/providers`, input);
+        },
+    },
+    {
+        name: "tailscale_update_workload_identity",
+        description: "Update an existing workload identity provider's configuration.",
+        annotations: {
+            title: "Update workload identity",
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        inputSchema: z.object({
+            providerId: z.string().describe("The workload identity provider ID to update"),
+            name: z.string().optional().describe("Updated human-readable name"),
+            audience: z.string().optional().describe("Updated expected audience claim"),
+            claimMappings: z.record(z.string(), z.string()).optional().describe("Updated claim mappings"),
+        }),
+        handler: async (input) => {
+            const { providerId, ...body } = input;
+            const cleanBody = {};
+            for (const [key, value] of Object.entries(body)) {
+                if (value !== undefined)
+                    cleanBody[key] = value;
+            }
+            return apiPatch(`/tailnet/${getTailnet()}/workload-identity/providers/${encPath(providerId)}`, cleanBody);
+        },
+    },
+    {
+        name: "tailscale_delete_workload_identity",
+        description: "Delete a workload identity provider. This is irreversible — any CI/CD pipelines using this provider will lose access.",
+        annotations: {
+            title: "Delete workload identity",
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: true,
+        },
+        inputSchema: z.object({
+            providerId: z.string().describe("The workload identity provider ID to delete"),
+        }),
+        handler: async (input) => {
+            return apiDelete(`/tailnet/${getTailnet()}/workload-identity/providers/${encPath(input.providerId)}`);
+        },
+    },
+];
+//# sourceMappingURL=workload-identity.js.map

package/dist/tools/workload-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workload-identity.js","sourceRoot":"","sources":["../../src/tools/workload-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEtF,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,oLAAoL;QACtL,WAAW,EAAE;YACX,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,OAAO,MAAM,CAAC,YAAY,UAAU,EAAE,8BAA8B,CAAC,CAAC;QACxE,CAAC;KACF;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,WAAW,EAAE,wDAAwD;QACrE,WAAW,EAAE;YACX,KAAK,EAAE,uBAAuB;YAC9B,YAAY,EAAE,IAAI;YAClB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACrE,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAA6B,EAAE,EAAE;YAC/C,OAAO,MAAM,CAAC,YAAY,UAAU,EAAE,gCAAgC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACrG,CAAC;KACF;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,kLAAkL;QACpL,WAAW,EAAE;YACX,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,KAAK;YACrB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;YACpE,SAAS,EAAE,CAAC;iBACT,MAAM,EAAE;iBACR,QAAQ,CAAC,6FAA6F,CAAC;YAC1G,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,2CAA2C,CAAC;YACrF,aAAa,EAAE,CAAC;iBACb,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;iBAC9B,QAAQ,EAAE;iBACV,QAAQ,CAAC,iFAAiF,CAAC;SAC/F,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAKf,EAAE,EAAE;YACH,OAAO,OAAO,CAAC,YAAY,UAAU,EAAE,8BAA8B,EAAE,KAAK,CAAC,CAAC;QAChF,CAAC;KACF;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EAAE,gEAAgE;QAC7E,WAAW,EAAE;YACX,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;YAC9E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,6BAA6B,CAAC;YACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,iCAAiC,CAAC;YAC3E,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,wBAAwB,CAAC;SAC9F,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAKf,EAAE,EAAE;YACH,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;YACtC,MAAM,SAAS,GAA4B,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAClD,CAAC;YACD,OAAO,QAAQ,CAAC,YAAY,UAAU,EAAE,gCAAgC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAC5G,CAAC;KACF;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,WAAW,EACT,uHAAuH;QACzH,WAAW,EAAE;YACX,KAAK,EAAE,0BAA0B;YACjC,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,IAAI;YACrB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB;QACD,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,6CAA6C,CAAC;SAC/E,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,KAA6B,EAAE,EAAE;YAC/C,OAAO,SAAS,CAAC,YAAY,UAAU,EAAE,gCAAgC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxG,CAAC;KACF;CACO,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/tailscale-mcp",
-  "version": "0.1.6",
+  "version": "0.2.1",
   "description": "Tailscale MCP server for managing your tailnet from AI assistants",
   "license": "MIT",
   "author": "YawLabs <contact@yaw.sh>",
@@ -30,13 +30,17 @@
     "dev": "tsc --watch",
     "start": "node dist/index.js",
     "test": "node --test dist/**/*.test.js",
+    "test:ci": "npm run build && npm test",
+    "lint": "biome check src/",
+    "lint:fix": "biome check --write src/",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.12.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "zod": "^3.24.4"
   },
   "devDependencies": {
+    "@biomejs/biome": "^1.9.4",
     "@types/node": "^22.15.2",
     "typescript": "^5.8.3"
   },