@yawlabs/tailscale-mcp 0.12.7 → 0.12.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -7
- package/dist/index.js +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -5,7 +5,7 @@
|
|
|
5
5
|
[](https://github.com/YawLabs/tailscale-mcp/stargazers)
|
|
6
6
|
[](./release.sh)
|
|
7
7
|
|
|
8
|
-
**Ask your agent questions about your tailnet and have it act on the answers.**
|
|
8
|
+
**Ask your agent questions about your tailnet and have it act on the answers.** 89 admin-API tools + 4 optional local-CLI diagnostics + 4 resources covering the full [Tailscale v2 API](https://tailscale.com/api). Backed by 700+ unit tests and an opt-in live-tailnet integration suite.
|
|
9
9
|
|
|
10
10
|
Built and maintained by [Yaw Labs](https://yaw.sh).
|
|
11
11
|
|
|
@@ -35,7 +35,7 @@ Reasonable question. Both have their place. Where this MCP is better:
|
|
|
35
35
|
- **Typed tool surface, not string parsing.** Every tool has a Zod-validated input schema and a structured response. No brittle `tailscale status --json | jq` pipelines that break when the schema evolves.
|
|
36
36
|
- **Cross-client, no user rewriting.** A Claude Code skill only loads in Claude Code. An MCP server works in Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, and anything else that speaks MCP. Version bumps ship through `npx` — users don't re-author their skill when Tailscale adds an endpoint.
|
|
37
37
|
- **Safe-by-default writes.** Every tool declares `readOnlyHint` / `destructiveHint` / `idempotentHint` so clients can skip confirmation on reads and require it on mutations. A skill that shells out to the CLI can't express that.
|
|
38
|
-
- **Real tests.**
|
|
38
|
+
- **Real tests.** 700+ unit tests covering every tool's input validation, API shape, and error handling. Plus an opt-in live-tailnet integration suite (`RUN_INTEGRATION_TESTS=1` + a tailnet API key) for shape-drift detection. Most skills are short markdown prompts without their own test layer — if the vendor changes output format, nothing catches it for you.
|
|
39
39
|
|
|
40
40
|
If you already have a skill that covers your 10% of Tailscale workflows, great — keep it. The MCP is for the other 90%.
|
|
41
41
|
|
|
@@ -43,7 +43,7 @@ If you already have a skill that covers your 10% of Tailscale workflows, great
|
|
|
43
43
|
|
|
44
44
|
Fair critique from Reddit: a new repo claiming "actively maintained" with no visible tests is worth exactly zero trust. Here's what's actually verifiable:
|
|
45
45
|
|
|
46
|
-
- **
|
|
46
|
+
- **700+ tests** (`node --test`) covering every tool's input validation, API shape, and error handling. Run `npm test` to see them pass locally.
|
|
47
47
|
- **Local release flow** via [`release.sh`](./release.sh): lint + test + bump + tag + push + npm publish + MCP Registry publish, all from the workstation. No CI workflow to babysit.
|
|
48
48
|
- **Dependabot alerts** surface on this repo and get fixed, not ignored.
|
|
49
49
|
- **Every tool verified against the live API.** If it's in the tool list, it calls a real endpoint that exists in the current v2 API. No placeholder 404 tools.
|
|
@@ -104,7 +104,7 @@ That's it. Now ask your agent:
|
|
|
104
104
|
|
|
105
105
|
## Too many tools? Subset them.
|
|
106
106
|
|
|
107
|
-
|
|
107
|
+
89 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
|
|
108
108
|
|
|
109
109
|
### Option 1: `TAILSCALE_PROFILE` (preset, easiest)
|
|
110
110
|
|
|
@@ -119,7 +119,7 @@ That's it. Now ask your agent:
|
|
|
119
119
|
|
|
120
120
|
- **`minimal`** (20 tools) — `status`, `devices`, `audit`. Observe the tailnet, read the audit log.
|
|
121
121
|
- **`core`** (47 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
|
|
122
|
-
- **`full`** (
|
|
122
|
+
- **`full`** (89 tools, default) — everything. Same as omitting the env var.
|
|
123
123
|
|
|
124
124
|
### Option 2: `TAILSCALE_TOOLS` (explicit group list)
|
|
125
125
|
|
|
@@ -221,7 +221,7 @@ Set `TAILSCALE_LOCAL_CLI=1` (in your shell or `.mcp.json` `env` block) to add fo
|
|
|
221
221
|
|
|
222
222
|
Requirements: the `tailscale` binary must be in `PATH`. If it's installed somewhere unusual, set `TAILSCALE_BINARY` to its absolute path. The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
|
|
223
223
|
|
|
224
|
-
When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.10.9 ready (
|
|
224
|
+
When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.10.9 ready (89 tools, local-cli=on)`.
|
|
225
225
|
|
|
226
226
|
## Resources (4)
|
|
227
227
|
|
|
@@ -234,7 +234,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
|
|
|
234
234
|
| ACL Policy | `tailscale://tailnet/acl` | Full ACL policy (HuJSON preserved) |
|
|
235
235
|
| DNS Config | `tailscale://tailnet/dns` | Nameservers, search paths, split DNS, MagicDNS |
|
|
236
236
|
|
|
237
|
-
## Tools (
|
|
237
|
+
## Tools (89 + 4 opt-in)
|
|
238
238
|
|
|
239
239
|
<details>
|
|
240
240
|
<summary><strong>Status</strong> (1 tool)</summary>
|
package/dist/index.js
CHANGED
|
@@ -33706,7 +33706,7 @@ var webhookTools = [
|
|
|
33706
33706
|
];
|
|
33707
33707
|
|
|
33708
33708
|
// src/index.ts
|
|
33709
|
-
var version2 = true ? "0.12.
|
|
33709
|
+
var version2 = true ? "0.12.8" : resolveVersionFallback();
|
|
33710
33710
|
var subcommand = process.argv[2];
|
|
33711
33711
|
if (subcommand === "deploy-acl") {
|
|
33712
33712
|
const filePath = process.argv[3];
|