@yawlabs/tailscale-mcp 0.17.1 → 0.18.0

package/README.md

@@ -5,7 +5,7 @@
 [![GitHub stars](https://img.shields.io/github/stars/YawLabs/tailscale-mcp)](https://github.com/YawLabs/tailscale-mcp/stargazers)
 [![Release](https://img.shields.io/badge/release-local-blue)](./release.sh)
 
-**Ask your agent questions about your tailnet and have it act on the answers.** 94 admin-API tools + 6 optional local-CLI diagnostics + 4 resources spanning the [Tailscale v2 API](https://tailscale.com/api) — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
+**Ask your agent questions about your tailnet and have it act on the answers.** 96 admin-API tools + 6 optional local-CLI diagnostics + 4 resources spanning the [Tailscale v2 API](https://tailscale.com/api) — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
 
 Built and maintained by [Yaw Labs](https://yaw.sh).
 
@@ -104,7 +104,7 @@ That's it. Now ask your agent:
 
 ## Too many tools? Subset them.
 
-94 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
+96 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
 
 ### Option 1: `TAILSCALE_PROFILE` (preset, easiest)
 
@@ -118,8 +118,8 @@ That's it. Now ask your agent:
 ```
 
 - **`minimal`** (20 tools) — `status`, `devices`, `audit`. Observe the tailnet, read the audit log.
-- **`core`** (49 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
-- **`full`** (94 tools, default) — everything. Same as omitting the env var.
+- **`core`** (51 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
+- **`full`** (96 tools, default) — everything. Same as omitting the env var.
 
 ### Option 2: `TAILSCALE_TOOLS` (explicit group list)
 
@@ -227,7 +227,7 @@ Set `TAILSCALE_LOCAL_CLI=1` (in your shell or `.mcp.json` `env` block) to add si
 
 Requirements: the `tailscale` binary must be in `PATH`. If it's installed somewhere unusual, set `TAILSCALE_BINARY` to its absolute path. The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
 
-When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (100 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 94.
+When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (102 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 96.
 
 ## Resources (4)
 
@@ -240,7 +240,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | ACL Policy | `tailscale://tailnet/acl` | Full ACL policy (HuJSON preserved) |
 | DNS Config | `tailscale://tailnet/dns` | Nameservers, search paths, split DNS, MagicDNS |
 
-## Tools (94 + 6 opt-in)
+## Tools (96 + 6 opt-in)
 
 <details>
 <summary><strong>Status</strong> (1 tool)</summary>
@@ -308,7 +308,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 </details>
 
 <details>
-<summary><strong>Keys / Trust Credentials</strong> (7 tools) — covers auth keys, OAuth clients, federated identities, and OAuth apps</summary>
+<summary><strong>Keys / Trust Credentials</strong> (9 tools) — covers auth keys, OAuth clients, federated identities, and OAuth apps</summary>
 
 | Tool | Description |
 |------|-------------|
@@ -319,6 +319,8 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | `tailscale_update_key` | Update a key's description, scopes, tags, or federated claim settings |
 | `tailscale_create_oauth_app` | Create an OAuth App for third-party device provisioning (Tailscale alpha) |
 | `tailscale_get_oauth_app` | Get an OAuth App's name, redirect URIs, and scopes |
+| `tailscale_list_oauth_apps` | List every OAuth App registered in the tailnet |
+| `tailscale_delete_oauth_app` | Delete an OAuth App, revoking its ability to provision devices |
 
 </details>
 
@@ -536,13 +538,13 @@ This shows a read-only banner in the Tailscale Admin Console pointing to your re
 
 ## Running on oam.js (optional)
 
-[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 94 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
+[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 96 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
 
 **oam 0.9.0 is the minimum.** Older releases ran `child_process.execFile` arguments through a shell, re-splitting them on whitespace and executing shell metacharacters inside an argument. This server shells out to the `tailscale` binary across its local-CLI tools, so that was a reachable bug rather than a theoretical one. The launcher enforces the floor: given an older oam it falls back to Node and says so on stderr, and `TAILSCALE_MCP_RUNTIME=oam` turns that into a hard error.
 
 ### Sandboxing (opt-in)
 
-Set `TAILSCALE_MCP_SANDBOX=1` to run under oam's `--permission` model: network restricted to `api.tailscale.com` and `login.tailscale.com`, filesystem denied. Child-process stays granted because the local-CLI tools shell out to the `tailscale` binary, which is also why `PATH` remains in the environment allow-list.
+Set `TAILSCALE_MCP_SANDBOX=1` to run under oam's `--permission` model: network restricted to `api.tailscale.com` -- the only host the bundle contacts, including the OAuth token exchange -- and filesystem denied. Child-process stays granted because the local-CLI tools shell out to the `tailscale` binary, which is also why `PATH` remains in the environment allow-list.
 
 It is opt-in rather than default because a wrong grant does not fail loudly. oam denies a non-granted environment variable by making it **absent** from `process.env` rather than throwing, so an under-granted `TAILSCALE_API_KEY` reads as "unauthenticated" rather than "denied". The env allow-list in the launcher is derived from what the shipped bundle actually reads -- if you add a new `process.env` lookup, extend that list with it.
 

package/bin/tailscale-mcp.mjs

@@ -24,7 +24,8 @@
  *
  * THE `--permission` SANDBOX (oam 0.9.0+, opt-in)
  * `TAILSCALE_MCP_SANDBOX=1` runs the server under oam's permission model:
- * network limited to the control-plane hosts, filesystem denied.
+ * network limited to the one host the bundle actually calls
+ * (api.tailscale.com), filesystem denied.
  *
  * Child-process is granted unconditionally because the local-CLI tools shell out
  * to the `tailscale` binary; that is also why PATH stays in the env grant, since
@@ -49,6 +50,7 @@
  *   TAILSCALE_MCP_RUNTIME=oam    require oam; fail loudly if it is missing
  *   TAILSCALE_MCP_RUNTIME=node   never use oam
  *   TAILSCALE_MCP_RUNTIME=auto   prefer oam, silently fall back (default)
+ *   anything else                warns on stderr, then behaves as auto
  *   TAILSCALE_MCP_SANDBOX=1      run oam under --permission (oam 0.9.0+)
  *   OAM_BIN=/path/to/oam     explicit binary, checked before any discovery
  */
@@ -156,7 +158,16 @@ function atLeast(v, min) {
 function sandboxFlags() {
   if (process.env.TAILSCALE_MCP_SANDBOX !== "1") return [];
 
-  const hosts = ["api.tailscale.com","login.tailscale.com"];
+  // ONE host, deliberately. Every outbound request the bundle makes targets
+  // api.tailscale.com: BASE_URL, the OAuth token exchange, and the absolute-URL
+  // allow-list that refuses to send credentials anywhere else. login.tailscale.com
+  // was granted here as well until an audit found no code path that contacts it
+  // -- console.tailscale.com appears in error TEXT, never as a request target.
+  // An unused grant is the one kind of over-permission nothing ever surfaces:
+  // removing it cannot break a call that was never made, and keeping it widens
+  // the sandbox for no behaviour. launcher.test.ts pins this list exactly so a
+  // future host lands as a reviewed diff rather than a quiet widening.
+  const hosts = ["api.tailscale.com"];
 
   const netFlag = `--allow-net=${hosts.join(",")}`;
 
@@ -166,7 +177,25 @@ function sandboxFlags() {
   // meant the local-CLI tool group silently failed to register under the
   // sandbox even though --allow-child-process is granted below precisely so
   // those tools can shell out.
-  const env = ["PATH","TAILSCALE_API_KEY","TAILSCALE_BINARY","TAILSCALE_DEBUG","TAILSCALE_EXTRA_POSTURE_PROVIDERS","TAILSCALE_EXTRA_WEBHOOK_EVENTS","TAILSCALE_LOCAL_CLI","TAILSCALE_MAX_CONCURRENT","TAILSCALE_OAUTH_CLIENT_ID","TAILSCALE_OAUTH_CLIENT_SECRET","TAILSCALE_OAUTH_TAILNET","TAILSCALE_PROFILE","TAILSCALE_READONLY","TAILSCALE_REQUEST_BUDGET_MS","TAILSCALE_RETRY_BASE_DELAY_MS","TAILSCALE_TAILNET","TAILSCALE_TOOLS"];
+  const env = [
+    "PATH",
+    "TAILSCALE_API_KEY",
+    "TAILSCALE_BINARY",
+    "TAILSCALE_DEBUG",
+    "TAILSCALE_EXTRA_POSTURE_PROVIDERS",
+    "TAILSCALE_EXTRA_WEBHOOK_EVENTS",
+    "TAILSCALE_LOCAL_CLI",
+    "TAILSCALE_MAX_CONCURRENT",
+    "TAILSCALE_OAUTH_CLIENT_ID",
+    "TAILSCALE_OAUTH_CLIENT_SECRET",
+    "TAILSCALE_OAUTH_TAILNET",
+    "TAILSCALE_PROFILE",
+    "TAILSCALE_READONLY",
+    "TAILSCALE_REQUEST_BUDGET_MS",
+    "TAILSCALE_RETRY_BASE_DELAY_MS",
+    "TAILSCALE_TAILNET",
+    "TAILSCALE_TOOLS",
+  ];
 
   const flags = ["--permission", netFlag, `--allow-env=${env.join(",")}`];
   flags.push("--allow-child-process");
@@ -231,7 +260,23 @@ async function runInProcess() {
   await import(SERVER_URL.href);
 }
 
-const mode = (process.env.TAILSCALE_MCP_RUNTIME ?? "auto").toLowerCase();
+// Every value below is compared against `mode` after lowercasing, so an
+// unrecognized one matched nothing and fell through to the auto branch --
+// `TAILSCALE_MCP_RUNTIME=nod` silently PREFERRED oam on a box that has it,
+// which is the opposite of what was asked for. Same handling as index.ts gives
+// an unknown subcommand: auto is still the right landing place, it just stops
+// being silent. An empty value is treated as unset, since `FOO=$UNSET` in a
+// wrapper script is how it usually gets there.
+const RUNTIMES = ["auto", "node", "oam"];
+const requested = process.env.TAILSCALE_MCP_RUNTIME;
+const mode = (requested ?? "auto").toLowerCase();
+if (requested && !RUNTIMES.includes(mode)) {
+  // Echo what was SET, not the lowercased form, so the typo is recognisable in
+  // the host's log next to the config line that produced it.
+  await errSync(
+    `tailscale-mcp: unrecognized TAILSCALE_MCP_RUNTIME "${requested}" -- known values: ${RUNTIMES.join(", ")}. Using auto.\n`,
+  );
+}
 
 if (mode === "node") {
   await runInProcess();
@@ -259,7 +304,8 @@ if (mode === "node") {
       const { writeSync } = await import("node:fs");
       writeSync(
         2,
-        "tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but no runnable oam binary was found.\n" + shimNote +
+        "tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but no runnable oam binary was found.\n" +
+          shimNote +
           "Install from https://oamjs.org, set OAM_BIN=/path/to/oam, or use TAILSCALE_MCP_RUNTIME=node.\n",
       );
       process.exit(1);
@@ -280,7 +326,7 @@ if (mode === "node") {
       ? `${oam} is oam ${found.join(".")}, older than ${min}`
       : `${oam} could not be run, or did not report a version this launcher understands`;
     const remedy = found
-      ? "Run \`oam self-update\`, or use TAILSCALE_MCP_RUNTIME=node.\n"
+      ? "Run `oam self-update`, or use TAILSCALE_MCP_RUNTIME=node.\n"
       : "Check that it is an executable oam binary for this platform, or use TAILSCALE_MCP_RUNTIME=node.\n";
     if (mode === "oam") {
       await errSync(`tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but ${detail}.\n${remedy}`);
@@ -337,7 +383,6 @@ if (mode === "node") {
     }
 
     if (child) {
-
       // If oam cannot be executed at all (deleted between the stat and the spawn,
       // wrong arch, permission), fall back rather than failing the whole server.
       // `spawned` prevents falling back AFTER the child started, which would

package/dist/index.js

@@ -31035,6 +31035,11 @@ async function getOAuthAccessToken(clientId, clientSecret) {
   })();
   return oauthRefreshPromise;
 }
+function invalidateOAuthTokenOnUnauthorized(authorizationHeader) {
+  if (!oauthToken) return;
+  if (authorizationHeader !== `Bearer ${oauthToken.access_token}`) return;
+  oauthToken = null;
+}
 async function getAuthHeader() {
   const config2 = getAuthConfig();
   if (config2.kind === "apiKey") {
@@ -31130,14 +31135,17 @@ function getRetryBaseDelayMs() {
 }
 async function withConcurrencyLimit(fn) {
   const limit = getConcurrencyLimit();
-  if (limit === 0) return fn();
+  if (limit === 0) return fn(0);
+  let queuedForMs = 0;
   if (inFlight >= limit) {
+    const queueStartedAt = Date.now();
     await new Promise((resolve) => concurrencyQueue.push(resolve));
+    queuedForMs = Date.now() - queueStartedAt;
   } else {
     inFlight++;
   }
   try {
-    return await fn();
+    return await fn(queuedForMs);
   } finally {
     const next = concurrencyQueue.shift();
     if (next) {
@@ -31188,6 +31196,15 @@ function describeTransportError(err, method, attemptTimeoutMs) {
   }
   return `${method} request failed: ${String(err)}`;
 }
+function describeBudgetExhaustion(budgetMs, queuedForMs, lastTransportError) {
+  if (lastTransportError) {
+    return `${lastTransportError}; request budget of ${budgetMs}ms exhausted before next attempt could begin.`;
+  }
+  if (queuedForMs > 0) {
+    return `Request budget of ${budgetMs}ms exhausted before attempt could begin: ${queuedForMs}ms of it was spent waiting for a free slot under TAILSCALE_MAX_CONCURRENT, so no request was ever sent. Raise TAILSCALE_MAX_CONCURRENT or TAILSCALE_REQUEST_BUDGET_MS -- this is queueing, not a network fault.`;
+  }
+  return `Request budget of ${budgetMs}ms exhausted before attempt could begin.`;
+}
 async function apiRequest(method, path, body, options) {
   const headers = {};
   if (options?.accept) {
@@ -31217,7 +31234,7 @@ async function apiRequest(method, path, body, options) {
   debugLog(`${method} ${url2}`);
   const isRetryable = RETRYABLE_METHODS.has(method.toUpperCase());
   const requestBudgetMs = getRequestBudgetMs();
-  return withConcurrencyLimit(async () => {
+  return withConcurrencyLimit(async (queuedForMs) => {
     headers.Authorization = await getAuthHeader();
     let res;
     let lastTransportError;
@@ -31227,7 +31244,7 @@ async function apiRequest(method, path, body, options) {
         return {
           ok: false,
           status: 0,
-          error: lastTransportError ? `${lastTransportError}; request budget of ${requestBudgetMs}ms exhausted before next attempt could begin.` : `Request budget of ${requestBudgetMs}ms exhausted before attempt could begin.`
+          error: describeBudgetExhaustion(requestBudgetMs, queuedForMs, lastTransportError)
         };
       }
       const attemptTimeoutMs = Math.min(REQUEST_TIMEOUT_MS, remaining);
@@ -31268,6 +31285,9 @@ async function apiRequest(method, path, body, options) {
     const etag = response.headers.get("etag") || void 0;
     const elapsed = Date.now() - startedAt;
     debugLog(`  <- ${response.status} (${elapsed}ms)`);
+    if (response.status === 401) {
+      invalidateOAuthTokenOnUnauthorized(headers.Authorization);
+    }
     try {
       if (options?.acceptRaw) {
         const rawBody = await response.text();
@@ -31442,6 +31462,18 @@ function filterTools(groups, options) {
 }
 
 // src/tools/acl.ts
+var ETAG_FOOTER_MARKER = "// ETag: ";
+function stripEtagFooter(body) {
+  const lines = body.split("\n");
+  let cut = lines.length;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i].trim();
+    if (line === "") continue;
+    if (!line.startsWith("//")) break;
+    if (line.startsWith(ETAG_FOOTER_MARKER)) cut = i;
+  }
+  return lines.slice(0, cut).join("\n");
+}
 var aclTools = [
   {
     name: "tailscale_get_acl",
@@ -31462,12 +31494,12 @@ var aclTools = [
       if (res.ok && res.etag) {
         const footer = [
           "",
-          `// ETag: ${res.etag}`,
+          `${ETAG_FOOTER_MARKER}${res.etag}`,
           "// Pass this ETag to tailscale_update_acl when updating the policy.",
           "// (HuJSON treats // as a comment \u2014 safe to leave in or strip before re-submitting.)",
           ""
         ].join("\n");
-        return { ...res, rawBody: `${res.rawBody ?? ""}${footer}` };
+        return { ...res, rawBody: `${stripEtagFooter(res.rawBody ?? "")}${footer}` };
       }
       return res;
     }
@@ -31478,7 +31510,10 @@ var aclTools = [
     annotations: {
       title: "Update ACL policy",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Overwrites the whole policy file in one call, and a bad push can lock
+      // every device out of the tailnet -- the widest blast radius of any write
+      // here, so clients must gate it rather than auto-approve it.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -31486,8 +31521,16 @@ var aclTools = [
       policy: external_exports.string().describe(
         "The full ACL policy text. Preserve existing formatting, comments, and structure. Only modify the specific parts that need to change."
       ),
-      etag: external_exports.string().describe("The ETag from tailscale_get_acl. Required to prevent concurrent edit conflicts.")
+      etag: external_exports.string().trim().min(1, "etag must not be empty -- an empty ETag would send this overwrite with no concurrency guard.").describe("The ETag from tailscale_get_acl. Required to prevent concurrent edit conflicts.")
     }),
+    // `.trim().min(1)`, not a bare `z.string()`: apiRequest sets If-Match behind
+    // `if (options?.ifMatch)`, so an empty etag is falsy there and the header is
+    // omitted entirely -- the write then overwrites a concurrent admin edit instead
+    // of coming back 412, on the widest-blast-radius write in the package, with
+    // no diagnostic anywhere. `.trim()` is load-bearing for the same reason it is
+    // on tailnets.ts's ids: a bare `.min(1)` accepts " ", which is truthy, so the
+    // header goes out carrying a precondition that cannot match any real ETag --
+    // a confusing 412 instead of a local validation error naming the field.
     handler: async (input) => {
       return apiPost(`/tailnet/${getTailnet()}/acl`, void 0, {
         rawBody: input.policy,
@@ -31805,7 +31848,9 @@ var deviceTools = [
     annotations: {
       title: "Set device routes",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: the routes array is the new enabled set, so `[]` silently
+      // withdraws every subnet the device currently routes.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -31890,7 +31935,9 @@ var deviceTools = [
     annotations: {
       title: "Set device tags",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: `[]` strips every ACL tag, which can drop the device out of
+      // the policy rules that grant it access.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -31969,7 +32016,7 @@ var deviceTools = [
       const failed = {};
       for (const { deviceId, res } of results) {
         if (res.ok) succeeded.push(deviceId);
-        else failed[deviceId] = { status: res.status, error: res.error ?? `HTTP ${res.status}` };
+        else failed[deviceId] = { status: res.status, error: res.error || `HTTP ${res.status}` };
       }
       const failedCount = Object.keys(failed).length;
       if (failedCount === unique.length) {
@@ -32053,7 +32100,9 @@ var dnsTools = [
     annotations: {
       title: "Set nameservers",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: `[]` clears tailnet DNS resolution rather than leaving the
+      // current nameservers in place.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32085,7 +32134,8 @@ var dnsTools = [
     annotations: {
       title: "Set DNS search paths",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all: `[]` clears every configured search domain.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32119,7 +32169,9 @@ var dnsTools = [
     annotations: {
       title: "Set split DNS",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all (PUT): every domain absent from the map is dropped, so `{}`
+      // clears the whole split DNS config. The PATCH sibling below merges instead.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32206,7 +32258,9 @@ var dnsTools = [
     annotations: {
       title: "Set DNS configuration (unified)",
       readOnlyHint: false,
-      destructiveHint: false,
+      // Replace-all across every DNS setting at once -- a superset of the wipe
+      // the individual setters above can do.
+      destructiveHint: true,
       idempotentHint: true,
       openWorldHint: true
     },
@@ -32663,6 +32717,48 @@ var keyTools = [
     handler: async (input) => {
       return apiGet(`/tailnet/${getTailnet()}/oauth-apps/${encPath(input.appId)}`);
     }
+  },
+  {
+    name: "tailscale_list_oauth_apps",
+    description: "List the OAuth Apps registered in your tailnet (Tailscale alpha). Returns an `oauthApps` array describing each app (id, name, redirect URIs, scopes). Client secrets are NOT included -- a secret is only returned once, by tailscale_create_oauth_app at creation time. This is how you recover the id of an app you did not record; pass that id to tailscale_delete_oauth_app to revoke it.",
+    annotations: {
+      title: "List OAuth apps",
+      readOnlyHint: true,
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    // No limit/cursor: the live endpoint takes no parameters and returns the
+    // whole collection. Advertising pagination the API ignores would let a
+    // caller believe it had paged through the list when it had not.
+    inputSchema: external_exports.object({}),
+    handler: async () => {
+      return apiGet(`/tailnet/${getTailnet()}/oauth-apps`);
+    }
+  },
+  {
+    name: "tailscale_delete_oauth_app",
+    description: "Delete an OAuth App (Tailscale alpha). This is irreversible: the app's client secret stops working immediately and any integration using it loses its device-enrollment path, so no further device can be authorized through it. Devices already enrolled stay in the tailnet, exactly as they do when the auth key that added them is deleted. Use tailscale_list_oauth_apps to find the id.",
+    annotations: {
+      title: "Delete OAuth app",
+      readOnlyHint: false,
+      destructiveHint: true,
+      idempotentHint: true,
+      openWorldHint: true
+    },
+    inputSchema: external_exports.object({
+      // `.trim().min(1)` rather than the bare `.min(1)` on
+      // tailscale_get_oauth_app's appId, for the reason tailnets.ts spells out
+      // on tailscale_delete_tailnet: a bare min(1) accepts " ", which encPath
+      // then sends as the literal segment "%20". On a read that costs a wasted
+      // round-trip; on an irreversible revoke it returns a 404 that reads like
+      // the app is already gone. Trimming at the schema makes it a validation
+      // error instead.
+      appId: external_exports.string().trim().min(1).describe("The OAuth app ID to delete (see tailscale_list_oauth_apps)")
+    }),
+    handler: async (input) => {
+      return apiDelete(`/tailnet/${getTailnet()}/oauth-apps/${encPath(input.appId)}`);
+    }
   }
 ];
 
@@ -32866,8 +32962,8 @@ var logStreamingTools = [
         apiGet(`/tailnet/${getTailnet()}/logging/network/stream`)
       ]);
       const errors = {};
-      if (!configuration.ok) errors.configuration = configuration.error ?? `HTTP ${configuration.status}`;
-      if (!network.ok) errors.network = network.error ?? `HTTP ${network.status}`;
+      if (!configuration.ok) errors.configuration = configuration.error || `HTTP ${configuration.status}`;
+      if (!network.ok) errors.network = network.error || `HTTP ${network.status}`;
       if (!configuration.ok && !network.ok) {
         return {
           ok: false,
@@ -33353,8 +33449,8 @@ function composeTailnetStatusData(devicesRes, settingsRes, extras = {}) {
     settings: settingsRes.ok ? settingsRes.data : null
   };
   const errors = {};
-  if (!devicesRes.ok) errors.devices = devicesRes.error ?? `HTTP ${devicesRes.status}`;
-  if (!settingsRes.ok) errors.settings = settingsRes.error ?? `HTTP ${settingsRes.status}`;
+  if (!devicesRes.ok) errors.devices = devicesRes.error || `HTTP ${devicesRes.status}`;
+  if (!settingsRes.ok) errors.settings = settingsRes.error || `HTTP ${settingsRes.status}`;
   if (Object.keys(errors).length > 0) data.errors = errors;
   return data;
 }
@@ -33486,7 +33582,7 @@ var tailnetTools = [
       const failed = {};
       for (const { contactType, res } of results) {
         if (res.ok) applied[contactType] = res.data;
-        else failed[contactType] = { status: res.status, error: res.error ?? `HTTP ${res.status}` };
+        else failed[contactType] = { status: res.status, error: res.error || `HTTP ${res.status}` };
       }
       const hasFailed = Object.keys(failed).length > 0;
       const hasApplied = Object.keys(applied).length > 0;
@@ -33573,7 +33669,7 @@ var tailnetsTools = [
   },
   {
     name: "tailscale_delete_tailnet",
-    description: "Permanently delete a tailnet. This is IRREVERSIBLE and removes every device, user, ACL, and key in it.\n\nBy default it acts on the tailnet the current credentials point at (TAILSCALE_TAILNET, or TAILSCALE_OAUTH_TAILNET when targeting an API-only tailnet). Pass `tailnet` to name a different one -- e.g. an id returned by tailscale_list_org_tailnets -- which requires credentials scoped to reach it; UNVERIFIED against a live tailnet, so expect a 403/404 if your token cannot. You must always pass `confirmTailnet` matching the effective target exactly; the call is refused locally otherwise. Intended for tearing down API-only tailnets created by tailscale_create_org_tailnet.",
+    description: "Permanently delete a tailnet. This is IRREVERSIBLE and removes every device, user, ACL, and key in it.\n\nBy default it acts on the tailnet the current credentials point at (TAILSCALE_TAILNET, or TAILSCALE_OAUTH_TAILNET when targeting an API-only tailnet). Pass `tailnet` to name a different one -- e.g. an id returned by tailscale_list_org_tailnets -- which requires credentials scoped to reach it; UNVERIFIED against a live tailnet, so expect a 403/404 if your token cannot. You must always pass `confirmTailnet` matching the effective target exactly; the call is refused locally otherwise. That check is a typo guard, not an authorization gate: when you also pass `tailnet` you are supplying both halves of the comparison, so it proves only that they agree -- it is a genuine second look only on the omit-`tailnet` path, where the value has to match the operator's environment. Restricting who may delete at all is TAILSCALE_READONLY / TAILSCALE_TOOLS, which drop this tool from the server entirely. Intended for tearing down API-only tailnets created by tailscale_create_org_tailnet.",
     annotations: {
       title: "Delete tailnet",
       readOnlyHint: false,
@@ -33586,7 +33682,7 @@ var tailnetsTools = [
         "Tailnet to delete (e.g. an id from tailscale_list_org_tailnets). Omit to target the configured tailnet. Requires credentials scoped to reach it."
       ),
       confirmTailnet: external_exports.string().trim().min(1).describe(
-        "Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A deliberate second look before an irreversible org-wide delete."
+        "Must exactly match the effective target -- `tailnet` when given, otherwise the configured tailnet (TAILSCALE_TAILNET / TAILSCALE_OAUTH_TAILNET). A typo guard, not an authorization gate: on the explicit-`tailnet` path the caller writes both halves of the comparison, so it proves only self-agreement. It is a real second look only when `tailnet` is omitted and the value has to match the operator's environment."
       )
     }),
     // `.trim().min(1)` on both fields, not just `.min(1)`: a bare min(1) accepts
@@ -33604,8 +33700,9 @@ var tailnetsTools = [
         );
       }
       if (input.confirmTailnet !== target) {
+        const source = input.tailnet?.trim() ? "tailnet you named" : "configured tailnet";
         throw new Error(
-          `confirmTailnet ${JSON.stringify(input.confirmTailnet)} does not match the configured tailnet ${JSON.stringify(target)}. Refusing to delete.`
+          `confirmTailnet ${JSON.stringify(input.confirmTailnet)} does not match the ${source} ${JSON.stringify(target)}. Refusing to delete.`
         );
       }
       return apiDelete(`/tailnet/${encPath(target)}`);
@@ -34011,7 +34108,7 @@ async function tailnetStatusResource(uri) {
 }
 async function tailnetDevicesResource(uri) {
   const res = await apiGet(`/tailnet/${getTailnet()}/devices`);
-  const text = res.ok ? JSON.stringify(res.data, null, 2) : JSON.stringify({ error: res.error ?? `HTTP ${res.status}` }, null, 2);
+  const text = res.ok ? JSON.stringify(res.data, null, 2) : JSON.stringify({ error: res.error || `HTTP ${res.status}` }, null, 2);
   return { contents: [{ uri: uri.href, text, mimeType: "application/json" }] };
 }
 async function tailnetAclResource(uri) {
@@ -34019,7 +34116,7 @@ async function tailnetAclResource(uri) {
   if (res.ok) {
     return { contents: [{ uri: uri.href, text: res.rawBody ?? "", mimeType: "application/hujson" }] };
   }
-  const lines = `Error: ${res.error ?? `HTTP ${res.status}`}`.split("\n");
+  const lines = `Error: ${res.error || `HTTP ${res.status}`}`.split("\n");
   const text = `${lines.map((l) => `// ${l}`).join("\n")}
 `;
   return { contents: [{ uri: uri.href, text, mimeType: "application/hujson" }] };
@@ -34038,16 +34135,16 @@ async function tailnetDnsResource(uri) {
     preferences: preferences.ok ? preferences.data : null
   };
   const errors = {};
-  if (!nameservers.ok) errors.nameservers = nameservers.error ?? `HTTP ${nameservers.status}`;
-  if (!searchPaths.ok) errors.searchPaths = searchPaths.error ?? `HTTP ${searchPaths.status}`;
-  if (!splitDns.ok) errors.splitDns = splitDns.error ?? `HTTP ${splitDns.status}`;
-  if (!preferences.ok) errors.preferences = preferences.error ?? `HTTP ${preferences.status}`;
+  if (!nameservers.ok) errors.nameservers = nameservers.error || `HTTP ${nameservers.status}`;
+  if (!searchPaths.ok) errors.searchPaths = searchPaths.error || `HTTP ${searchPaths.status}`;
+  if (!splitDns.ok) errors.splitDns = splitDns.error || `HTTP ${splitDns.status}`;
+  if (!preferences.ok) errors.preferences = preferences.error || `HTTP ${preferences.status}`;
   if (Object.keys(errors).length > 0) data.errors = errors;
   return { contents: [{ uri: uri.href, text: JSON.stringify(data, null, 2), mimeType: "application/json" }] };
 }
 
 // src/index.ts
-var version2 = true ? "0.17.1" : resolveVersionFallback();
+var version2 = true ? "0.18.0" : resolveVersionFallback();
 var subcommand = process.argv[2];
 var cliSubcommandHandled = false;
 if (subcommand === "deploy-acl" || subcommand === "validate-acl") {
@@ -34104,7 +34201,7 @@ if (!cliSubcommandHandled) {
   }
   if (unknownProfile) {
     console.error(
-      `@yawlabs/tailscale-mcp: TAILSCALE_PROFILE="${unknownProfile}" is not a known profile. Valid profiles: minimal, core, full. Falling back to no profile filter.`
+      `@yawlabs/tailscale-mcp: TAILSCALE_PROFILE="${unknownProfile}" is not a known profile. Valid profiles: ${Object.keys(PROFILES).join(", ")}. Falling back to no profile filter.`
     );
   }
   const server = new McpServer({
@@ -34165,7 +34262,7 @@ if (!cliSubcommandHandled) {
     const coreCount = profileCount(PROFILES.core);
     const minimalCount = profileCount(PROFILES.minimal);
     console.error(
-      `@yawlabs/tailscale-mcp: tip \u2014 set TAILSCALE_PROFILE=core (${coreCount} tools) or =minimal (${minimalCount}) to load a smaller tool surface. See README.`
+      `@yawlabs/tailscale-mcp: tip -- set TAILSCALE_PROFILE=core (${coreCount} tools) or =minimal (${minimalCount}) to load a smaller tool surface. See README.`
     );
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yawlabs/tailscale-mcp",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "mcpName": "io.github.YawLabs/tailscale-mcp",
   "description": "Tailscale MCP server for managing your tailnet from AI assistants",
   "license": "MIT",
@@ -35,8 +35,9 @@
     "start": "node dist/index.js",
     "test": "npm run build && node --test-timeout=300000 --test \"dist/**/*.test.js\"",
     "test:ci": "npm run test",
-    "lint": "biome check src/",
-    "lint:fix": "biome check --write src/",
+    "test:coverage": "npm run build && node --test-timeout=300000 --experimental-test-coverage --test-coverage-exclude=\"**/*.test.js\" --test-coverage-exclude=\"**/dist/index.js\" --test \"dist/**/*.test.js\"",
+    "lint": "biome check src/ bin/ scripts/ build.mjs",
+    "lint:fix": "biome check --write src/ bin/ scripts/ build.mjs",
     "check:oam": "oam check src/index.ts",
     "build:binary": "node scripts/build-binary.mjs",
     "build:binary:oam": "node scripts/build-binary-oam.mjs",