@yawlabs/tailscale-mcp 0.12.6 → 0.12.8

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@yawlabs/tailscale-mcp)](https://www.npmjs.com/package/@yawlabs/tailscale-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![GitHub stars](https://img.shields.io/github/stars/YawLabs/tailscale-mcp)](https://github.com/YawLabs/tailscale-mcp/stargazers)
-[![CI](https://github.com/YawLabs/tailscale-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/YawLabs/tailscale-mcp/actions/workflows/ci.yml) [![Release](https://github.com/YawLabs/tailscale-mcp/actions/workflows/release.yml/badge.svg)](https://github.com/YawLabs/tailscale-mcp/actions/workflows/release.yml)
+[![Release](https://img.shields.io/badge/release-local-blue)](./release.sh)
 
 **Ask your agent questions about your tailnet and have it act on the answers.** 89 admin-API tools + 4 optional local-CLI diagnostics + 4 resources covering the full [Tailscale v2 API](https://tailscale.com/api). Backed by 700+ unit tests and an opt-in live-tailnet integration suite.
 
@@ -44,10 +44,7 @@ If you already have a skill that covers your 10% of Tailscale workflows, great
 Fair critique from Reddit: a new repo claiming "actively maintained" with no visible tests is worth exactly zero trust. Here's what's actually verifiable:
 
 - **700+ tests** (`node --test`) covering every tool's input validation, API shape, and error handling. Run `npm test` to see them pass locally.
-- **3 CI workflows** on GitHub Actions:
-  - [`ci.yml`](.github/workflows/ci.yml) — lint + typecheck + build + unit tests on every push and PR.
-  - [`integration.yml`](.github/workflows/integration.yml) — read-only live-API smoke tests against a real tailnet. Wired up with three triggers (nightly schedule, every tag push via `release.yml`, manual dispatch); skips gracefully when no test-tailnet secret is configured, so forks aren't blocked.
-  - [`release.yml`](.github/workflows/release.yml) — publishes to npm from a signed tag.
+- **Local release flow** via [`release.sh`](./release.sh): lint + test + bump + tag + push + npm publish + MCP Registry publish, all from the workstation. No CI workflow to babysit.
 - **Dependabot alerts** surface on this repo and get fixed, not ignored.
 - **Every tool verified against the live API.** If it's in the tool list, it calls a real endpoint that exists in the current v2 API. No placeholder 404 tools.
 
@@ -224,7 +221,7 @@ Set `TAILSCALE_LOCAL_CLI=1` (in your shell or `.mcp.json` `env` block) to add fo
 
 Requirements: the `tailscale` binary must be in `PATH`. If it's installed somewhere unusual, set `TAILSCALE_BINARY` to its absolute path. The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
 
-When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.10.9 ready (93 tools, local-cli=on)`.
+When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.10.9 ready (89 tools, local-cli=on)`.
 
 ## Resources (4)
 

package/dist/index.js

@@ -6885,6 +6885,9 @@ var require_dist = __commonJS({
   }
 });
 
+// src/index.ts
+import { createRequire } from "node:module";
+
 // node_modules/zod/v3/helpers/util.js
 var util;
 (function(util2) {
@@ -31054,7 +31057,12 @@ function validateAndSanitizeDescription(value) {
   );
 }
 function formatAuthError(status, apiBody) {
-  const usingOAuth = !process.env.TAILSCALE_API_KEY && !!process.env.TAILSCALE_OAUTH_CLIENT_ID;
+  let usingOAuth = false;
+  try {
+    usingOAuth = getAuthConfig().kind === "oauth";
+  } catch {
+    usingOAuth = false;
+  }
   const headline = status === 401 ? "Authentication failed (HTTP 401)." : "Authorization failed (HTTP 403): the request was authenticated but not permitted for this resource.";
   const cause = status === 401 ? usingOAuth ? "  - OAuth client credentials are invalid or lack required scopes" : "  - API key has expired or been revoked" : usingOAuth ? "  - OAuth client is missing a scope required for this endpoint" : "  - API key lacks the permission required for this endpoint";
   const lines = [headline, "", "Possible causes:", cause];
@@ -31135,7 +31143,8 @@ function compute429DelayMs(retryAfter, attempt) {
     }
     const asDate = Date.parse(retryAfter);
     if (Number.isFinite(asDate)) {
-      return Math.max(0, Math.min(asDate - Date.now(), MAX_429_DELAY_MS));
+      const delta = asDate - Date.now();
+      if (delta > 0) return Math.min(delta, MAX_429_DELAY_MS);
     }
   }
   const base = Math.min(DEFAULT_429_DELAY_MS * 2 ** attempt, MAX_429_DELAY_MS);
@@ -31238,6 +31247,23 @@ async function apiDelete(path, options) {
 }
 
 // src/cli.ts
+function parseValidationError(rawBody) {
+  const trimmed = rawBody?.trim();
+  if (!trimmed) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return trimmed;
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return trimmed;
+  }
+  const obj = parsed;
+  if (typeof obj.message === "string" && obj.message.length > 0) return obj.message;
+  if (typeof obj.error === "string" && obj.error.length > 0) return obj.error;
+  return void 0;
+}
 async function deployAcl(filePath) {
   let policy;
   try {
@@ -31261,8 +31287,9 @@ async function deployAcl(filePath) {
     console.error(`ACL validation failed: ${validateRes.error}`);
     process.exit(1);
   }
-  if (validateRes.rawBody?.trim()) {
-    console.error(`ACL validation failed: ${extractErrorMessage(validateRes.rawBody.trim())}`);
+  const validationError = parseValidationError(validateRes.rawBody);
+  if (validationError) {
+    console.error(`ACL validation failed: ${validationError}`);
     process.exit(1);
   }
   const deployRes = await apiPost(`/tailnet/${getTailnet()}/acl`, void 0, {
@@ -31306,9 +31333,11 @@ function filterTools(groups, options) {
   }
   const parsedTools = options.tools ? options.tools.split(",").map((s) => s.trim()).filter(Boolean) : null;
   const explicitTools2 = parsedTools && parsedTools.length > 0 ? parsedTools : null;
-  const effectiveGroups = explicitTools2 ?? profileGroups ?? null;
+  const explicitToolsAllUnknown = explicitTools2?.every((g) => !validNames.has(g)) ?? false;
+  const effectiveExplicitTools = explicitToolsAllUnknown ? null : explicitTools2;
+  const effectiveGroups = effectiveExplicitTools ?? profileGroups ?? null;
   const enabledGroups = effectiveGroups ? new Set(effectiveGroups) : null;
-  const unknownGroups2 = enabledGroups ? [...enabledGroups].filter((g) => !validNames.has(g)) : [];
+  const unknownGroups2 = explicitTools2 ? explicitTools2.filter((g) => !validNames.has(g)) : enabledGroups ? [...enabledGroups].filter((g) => !validNames.has(g)) : [];
   const readonly2 = parseReadonlyFlag(options.readonly);
   const out = [];
   for (const [name, tools] of Object.entries(groups)) {
@@ -31320,9 +31349,10 @@ function filterTools(groups, options) {
   }
   const result = { tools: out, unknownGroups: unknownGroups2 };
   if (unknownProfile2) result.unknownProfile = unknownProfile2;
-  if (profileGroups && !explicitTools2) result.profileGroups = profileGroups;
-  if (explicitTools2) result.explicitTools = explicitTools2;
+  if (profileGroups && !effectiveExplicitTools) result.profileGroups = profileGroups;
+  if (effectiveExplicitTools) result.explicitTools = effectiveExplicitTools;
   if (profileWouldFilter2) result.profileWouldFilter = true;
+  if (explicitToolsAllUnknown) result.toolsAllUnknown = true;
   return result;
 }
 
@@ -31863,7 +31893,7 @@ var deviceTools = [
     inputSchema: external_exports.object({
       deviceId: external_exports.string().describe("The device ID"),
       attributeKey: external_exports.string().describe("The attribute key (must start with 'custom:', e.g. 'custom:lastAuditDate')"),
-      value: external_exports.string().describe("The attribute value"),
+      value: external_exports.union([external_exports.string(), external_exports.number(), external_exports.boolean()]).describe("The attribute value (string, number, or boolean)"),
       expiry: external_exports.string().optional().describe(
         "Optional expiry time in RFC3339 format (e.g. '2026-12-01T00:00:00Z'). Attribute is automatically removed after expiry."
       )
@@ -31957,7 +31987,7 @@ var deviceTools = [
   },
   {
     name: "tailscale_set_devices_authorized",
-    description: "Authorize or deauthorize multiple devices in one call. Each device's POST runs in parallel; per-device errors are returned alongside the successes so a partial failure doesn't lose the work that succeeded. Common use: authorize a batch of newly-enrolled CI hosts, or deauthorize a group of devices flagged by a security review.",
+    description: "Authorize or deauthorize multiple devices in one call. Each device's POST runs in parallel; per-device errors are returned alongside the successes so a partial failure doesn't lose the work that succeeded. On partial failure the call still returns success (ok) with data: { authorized, succeeded, failed } -- inspect data.failed for the per-device errors. Common use: authorize a batch of newly-enrolled CI hosts, or deauthorize a group of devices flagged by a security review.",
     annotations: {
       title: "Set devices authorized (bulk)",
       readOnlyHint: false,
@@ -32023,7 +32053,7 @@ var deviceTools = [
       ).describe(
         'Map of device ID to attribute config map (e.g. { "12345": { "custom:compliant": { "value": "true" } }, "67890": { "custom:compliant": { "value": false, "expiry": "2026-12-01T00:00:00Z" } } }). Pass null as the config to delete an attribute.'
       ),
-      comment: external_exports.string().optional().describe("Optional comment added to the audit log explaining why attributes are being set (max 200 chars)")
+      comment: external_exports.string().max(200).optional().describe("Optional comment added to the audit log explaining why attributes are being set (max 200 chars)")
     }),
     handler: async (input) => {
       const invalidKeys = [];
@@ -33056,15 +33086,15 @@ var postureTools = [
       cloudId: external_exports.string().optional().describe("Updated cloud identifier (e.g. 'us-1', 'global', or provider FQDN)")
     }),
     handler: async (input) => {
-      const { integrationId, ...body } = input;
       const cleanBody = {};
-      for (const [key, value] of Object.entries(body)) {
-        if (value !== void 0) cleanBody[key] = value;
-      }
+      if (input.clientId !== void 0) cleanBody.clientId = input.clientId;
+      if (input.clientSecret !== void 0) cleanBody.clientSecret = input.clientSecret;
+      if (input.tenantId !== void 0) cleanBody.tenantId = input.tenantId;
+      if (input.cloudId !== void 0) cleanBody.cloudId = input.cloudId;
       if (Object.keys(cleanBody).length === 0) {
         throw new Error("No fields to update. Provide at least one of: clientId, clientSecret, tenantId, cloudId.");
       }
-      return apiPatch(`/posture/integrations/${encPath(integrationId)}`, cleanBody);
+      return apiPatch(`/posture/integrations/${encPath(input.integrationId)}`, cleanBody);
     }
   },
   {
@@ -33676,7 +33706,7 @@ var webhookTools = [
 ];
 
 // src/index.ts
-var version2 = true ? "0.12.6" : (await null).createRequire(import.meta.url)("../package.json").version;
+var version2 = true ? "0.12.8" : resolveVersionFallback();
 var subcommand = process.argv[2];
 if (subcommand === "deploy-acl") {
   const filePath = process.argv[3];
@@ -33717,7 +33747,8 @@ var {
   unknownGroups,
   unknownProfile,
   explicitTools,
-  profileWouldFilter
+  profileWouldFilter,
+  toolsAllUnknown
 } = filterTools(toolGroups, {
   tools: process.env.TAILSCALE_TOOLS,
   readonly: process.env.TAILSCALE_READONLY,
@@ -33725,8 +33756,9 @@ var {
 });
 if (unknownGroups.length > 0) {
   const validNames = Object.keys(toolGroups);
+  const fallbackNote = toolsAllUnknown ? " Every requested group was unknown, so TAILSCALE_TOOLS was ignored and the default tool set was loaded instead." : "";
   console.error(
-    `@yawlabs/tailscale-mcp: TAILSCALE_TOOLS includes unknown group(s): ${unknownGroups.join(", ")}. Valid groups: ${validNames.join(", ")}`
+    `@yawlabs/tailscale-mcp: TAILSCALE_TOOLS includes unknown group(s): ${unknownGroups.join(", ")}. Valid groups: ${validNames.join(", ")}.${fallbackNote}`
   );
 }
 if (unknownProfile) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/tailscale-mcp",
-  "version": "0.12.6",
+  "version": "0.12.8",
   "mcpName": "io.github.YawLabs/tailscale-mcp",
   "description": "Tailscale MCP server for managing your tailnet from AI assistants",
   "license": "MIT",