@yawlabs/tailscale-mcp 0.17.1 → 0.19.0

package/README.md

@@ -5,7 +5,7 @@
 [![GitHub stars](https://img.shields.io/github/stars/YawLabs/tailscale-mcp)](https://github.com/YawLabs/tailscale-mcp/stargazers)
 [![Release](https://img.shields.io/badge/release-local-blue)](./release.sh)
 
-**Ask your agent questions about your tailnet and have it act on the answers.** 94 admin-API tools + 6 optional local-CLI diagnostics + 4 resources spanning the [Tailscale v2 API](https://tailscale.com/api) — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
+**Ask your agent questions about your tailnet and have it act on the answers.** 97 admin-API tools + 6 optional local-CLI diagnostics + 1 always-on catalog tool + 4 resources spanning the [Tailscale v2 API](https://tailscale.com/api) — devices, ACLs, DNS, keys and trust credentials, users, invites, webhooks, log streaming, posture, services, and organization tailnets. Backed by 1100+ unit tests and an opt-in live-tailnet integration suite.
 
 Built and maintained by [Yaw Labs](https://yaw.sh).
 
@@ -104,29 +104,29 @@ That's it. Now ask your agent:
 
 ## Too many tools? Subset them.
 
-94 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
+97 tools is a lot. If you've already got a dozen MCP servers and your client is feeling heavy, trim what this one exposes. Three knobs, combinable:
+
+> The `env` blocks below show only the variable under discussion. Your credentials come from the environment, as set in [Quick start](#quick-start) — keep them in your shell profile rather than in the client's JSON config, which is world-readable on most systems and easy to commit by accident.
 
 ### Option 1: `TAILSCALE_PROFILE` (preset, easiest)
 
 ```json
 {
   "env": {
-    "TAILSCALE_API_KEY": "tskey-api-...",
     "TAILSCALE_PROFILE": "core"
   }
 }
 ```
 
 - **`minimal`** (20 tools) — `status`, `devices`, `audit`. Observe the tailnet, read the audit log.
-- **`core`** (49 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
-- **`full`** (94 tools, default) — everything. Same as omitting the env var.
+- **`core`** (52 tools) — adds `acl`, `dns`, `keys`, `users`. The day-to-day admin surface.
+- **`full`** (97 tools, default) — everything. Same as omitting the env var.
 
 ### Option 2: `TAILSCALE_TOOLS` (explicit group list)
 
 ```json
 {
   "env": {
-    "TAILSCALE_API_KEY": "tskey-api-...",
     "TAILSCALE_TOOLS": "devices,acl,dns,audit"
   }
 }
@@ -141,7 +141,6 @@ Valid group names: `status`, `devices`, `acl`, `dns`, `keys`, `users`, `tailnet`
 ```json
 {
   "env": {
-    "TAILSCALE_API_KEY": "tskey-api-...",
     "TAILSCALE_PROFILE": "core",
     "TAILSCALE_READONLY": "1"
   }
@@ -161,13 +160,151 @@ The server logs the active filter to stderr on startup:
 When both `TAILSCALE_PROFILE` and `TAILSCALE_TOOLS` are set, `TAILSCALE_TOOLS` wins. The banner marks the profile as overridden so the precedence is obvious at a glance — no need to guess which filter actually applied:
 
 ```
-@yawlabs/tailscale-mcp v0.12.0 ready (21 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)
+@yawlabs/tailscale-mcp v0.12.0 ready (22 tools, profile=core (overridden by TAILSCALE_TOOLS), groups=devices,acl)
 ```
 
 The "(overridden)" marker only fires for substantive profiles (`minimal` / `core`); `profile=full` is a no-op preset, so it's shown without the marker when `TAILSCALE_TOOLS` is also set.
 
 If you don't set any filter, startup prints a tip pointing you at the profiles.
 
+### And how the *agent* knows
+
+Everything above is stderr -- your MCP client's log. The model never sees it, so a
+withheld tool and a tool that was never built look identical from the agent's side.
+That is how an agent ends up working around a restriction instead of reporting it.
+
+`tailscale_tool_groups` closes that gap. It is **always registered**, whatever the
+filters say, and answers the question in-band:
+
+```
+> "Why can't you delete that device?"
+
+  tailscale_tool_groups({ toolName: "tailscale_delete_device" })
+
+  {
+    "tool": "tailscale_delete_device",
+    "available": false,
+    "group": "devices",
+    "kind": "write",
+    "reason": "TAILSCALE_WRITE_GROUPS is set to \"dns\", which does not grant writes here",
+    "toEnable": "add \"devices\" to TAILSCALE_WRITE_GROUPS (e.g. \"dns,devices\")"
+  }
+```
+
+It separates the three cases an agent otherwise cannot tell apart:
+
+| Case | What the agent should do |
+|---|---|
+| No such tool exists, under any configuration | Find another approach -- no setting will produce it |
+| Exists, but its group is not loaded | Report `toEnable` to you; do not work around it |
+| Exists and loaded, but writes are withheld there | Same -- the fix is yours, not a workaround |
+
+Called with no arguments it lists every group with its availability and, for anything
+withheld, the exact environment change that would restore it. It reads no network and
+needs no credentials, so it works even when the server is misconfigured.
+
+## Scoping writes to areas
+
+`TAILSCALE_WRITE_GROUPS` names the areas an agent may **write** to. Everything else stays readable:
+
+```json
+{
+  "env": {
+    "TAILSCALE_WRITE_GROUPS": "devices,keys"
+  }
+}
+```
+
+That serves all 47 read tools plus the 18 writes in `devices` and `keys`, and withholds the other 38 writes — the ACL, DNS, users, webhooks, posture, services, invites, org-tailnets and log-streaming writes are simply not registered. Unset means no write gate, which is the shipped default.
+
+> **Read this first: this filters the tool list, not your API token.** The server still holds one credential with full tailnet authority in every configuration. An agent that also has a shell can `curl api.tailscale.com` with that same token and do everything this knob withheld. Scope the Tailscale OAuth client itself to the areas you actually need — that bound survives outside this process; this one does not. `TAILSCALE_WRITE_GROUPS` is the low-friction complement to credential scoping, not a replacement for it.
+
+### What a grant actually contains
+
+Group names are the same ones `TAILSCALE_TOOLS` uses. Writes per group:
+
+| Group | Writes | Group | Writes |
+|---|---|---|---|
+| `devices` | 13 | `webhooks` | 5 |
+| `invites` | 7 | `posture` | 3 |
+| `dns` | 6 | `services` | 3 |
+| `keys` | 5 | `tailnet` | 3 |
+| `users` | 5 | `log-streaming` | 3 |
+| `org-tailnets` | 2 | `acl` | 1 |
+
+`status`, `audit` and the opt-in `local-cli` group contain no writes at all, so granting them does nothing.
+
+**`devices` is the widest grant, and the one most likely to be set.** In a compose file `write=devices` reads like "device admin", but it hands over `delete_device`, `set_devices_authorized`, `expire_device`, `deauthorize_device`, `set_device_routes`, `set_device_tags` and `update_device_key` alongside `rename_device`. There is no finer setting: an honest "safe subset" of `devices` is `rename_device` alone, and a knob whose useful value is one tool is not a knob.
+
+### Three grants are tailnet-admin-equivalent
+
+`keys`, `users` and `acl` are not blocked — CI key rotation legitimately needs `keys` — but grant them knowing:
+
+- **`keys`** — `tailscale_create_key` mints an OAuth client with whatever scopes the caller asks for, including `acl`. That credential outlives the agent's session and is not subject to this or any other setting here.
+- **`users`** — `tailscale_update_user_role` accepts `owner`.
+- **`acl`** — `tailscale_update_acl` rewrites policy for every principal in the tailnet.
+
+The server prints this on startup when your grant includes one of them.
+
+### What it does and does not bound
+
+It bounds **where** an agent may write. It does not bound **severity within** a granted area: inside a granted group, writes run unattended, including the grant-direction ones. Pair it with `TAILSCALE_REQUIRE_APPROVAL=1` when a human is at the keyboard — but understand that for an unattended agent that pairing contributes nothing, because a never-prompt client *denies* those calls rather than prompting.
+
+### Precedence, and what happens when you get it wrong
+
+| Situation | Result |
+|---|---|
+| Unset, empty, whitespace, or commas-only | No write gate. `-e VAR` with no value must not silently revoke every write. |
+| `TAILSCALE_READONLY=1` also set | Readonly wins; banner says `readonly (TAILSCALE_WRITE_GROUPS ignored)`. |
+| A name is misspelled (`devises`) | **Grants nothing** and names the typo. Unlike `TAILSCALE_TOOLS`, there is no fallback — a typo'd write grant that fell back would hand over all 56 writes at the moment you were restricting them. |
+| Partly misspelled (`devices,dnss`) | Grants the valid half, warns about the rest. |
+| A granted group is not loaded by `TAILSCALE_TOOLS` / `TAILSCALE_PROFILE` | The grant has no effect; a separate warning says so, since the name is not a typo. |
+| `none`, `all`, `off`, `*` | Not reserved words — they are unknown group names, so they grant nothing. Use `TAILSCALE_READONLY=1` for no writes, or leave this unset for all writes. The server points you at the right spelling. |
+
+Names are case-sensitive, matching `TAILSCALE_TOOLS`.
+
+**The upgrade contract:** upgrading this package can never widen the set of *areas* an agent may write to. A new group is in nobody's grant until a human types its name. It can, however, add tools inside an area you already granted — a pinned test makes that a reviewed line in the diff rather than a silent change.
+
+The startup banner shows what applied:
+
+```
+@yawlabs/tailscale-mcp v0.19.0 ready (59 tools, write=devices,keys)
+```
+
+## Requiring approval on irreversible tools
+
+`readOnlyHint` / `destructiveHint` are *advisory* — the MCP spec says clients MUST treat annotations as untrusted, and most don't gate on them. `TAILSCALE_REQUIRE_APPROVAL=1` adds a stronger signal that supported clients enforce:
+
+```json
+{
+  "env": {
+    "TAILSCALE_REQUIRE_APPROVAL": "1"
+  }
+}
+```
+
+Nine tools are then advertised with `_meta["anthropic/requiresUserInteraction"]`, which forces a confirmation prompt even when an allow-rule would otherwise auto-approve the call:
+
+| Tool | Why it's on the list |
+|---|---|
+| `tailscale_update_acl` | Can lock every device out of the tailnet; the previous HuJSON (comments included) is gone unless you captured it |
+| `tailscale_delete_device` | The device must re-enroll |
+| `tailscale_delete_user` | No undelete |
+| `tailscale_delete_tailnet` | Destroys an entire tailnet |
+| `tailscale_delete_key` | The secret is never returned again |
+| `tailscale_delete_oauth_app` | Same |
+| `tailscale_delete_webhook` | Same |
+| `tailscale_delete_log_stream_config` | Same |
+| `tailscale_delete_posture_integration` | Same |
+
+The line drawn is **"this server cannot undo it with information you still hold"**, which is narrower than the 23 tools annotated `destructiveHint: true`. `tailscale_suspend_user` is deliberately *excluded* — `tailscale_restore_user` reverses it. So are `tailscale_deauthorize_device` (reversed by `tailscale_authorize_device`) and the replace-all setters, which all have a `get_*` counterpart you can read before writing.
+
+**Opt-in on purpose, and read this before turning it on.** In a client mode that never prompts (an unattended agent, a CI run), the flag causes those calls to be **denied** rather than run. That is the right default when a human is at the keyboard and the wrong one when nobody is, so it stays off unless you set it.
+
+Requires a client that honors the annotation; Claude Code added support in v2.1.199. Clients that don't recognize it ignore it, so setting the variable is never worse than leaving it off.
+
+Separately and always on, five tools whose response size scales with the tailnet rather than with the request — `tailscale_list_devices`, `tailscale_list_users`, `tailscale_get_acl`, `tailscale_get_audit_log`, `tailscale_get_network_flow_logs` — declare `_meta["anthropic/maxResultSizeChars"]`, so a large-but-legitimate result stays inline instead of being truncated into a file reference the agent has to read back mid-task.
+
 ## Using with mcp.hosting / mcph
 
 If you run this server through [mcp.hosting](https://mcp.hosting) (via the `@yawlabs/mcph` local agent), the two filtering layers compose cleanly:
@@ -227,7 +364,7 @@ Set `TAILSCALE_LOCAL_CLI=1` (in your shell or `.mcp.json` `env` block) to add si
 
 Requirements: the `tailscale` binary must be in `PATH`. If it's installed somewhere unusual, set `TAILSCALE_BINARY` to its absolute path. The MCP server doesn't need root to run these — they're all diagnostic, not state-mutating. Operations that would need elevation (`tailscale up`, `set --advertise-routes`, `lock sign`) are deliberately not exposed.
 
-When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (100 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 94.
+When opt-in is on, the startup banner reflects it: `@yawlabs/tailscale-mcp v0.13.3 ready (103 tools, local-cli=on)` — the 6 local CLI tools are additive on top of the default 97.
 
 ## Resources (4)
 
@@ -240,7 +377,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | ACL Policy | `tailscale://tailnet/acl` | Full ACL policy (HuJSON preserved) |
 | DNS Config | `tailscale://tailnet/dns` | Nameservers, search paths, split DNS, MagicDNS |
 
-## Tools (94 + 6 opt-in)
+## Tools (97 + 6 opt-in)
 
 <details>
 <summary><strong>Status</strong> (1 tool)</summary>
@@ -277,7 +414,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 </details>
 
 <details>
-<summary><strong>ACL / Policy</strong> (4 tools) — with HuJSON formatting preservation and ETag safety</summary>
+<summary><strong>ACL / Policy</strong> (5 tools) — with HuJSON formatting preservation and ETag safety</summary>
 
 | Tool | Description |
 |------|-------------|
@@ -285,6 +422,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | `tailscale_update_acl` | Update ACL policy (requires ETag for safe concurrent edits) |
 | `tailscale_validate_acl` | Validate a policy without applying it |
 | `tailscale_preview_acl` | Preview rules that would apply to a user or IP |
+| `tailscale_diff_acl_access` | Compare a proposed policy against the live one — who gains and loses access |
 
 </details>
 
@@ -308,7 +446,7 @@ MCP Resources expose read-only data clients can browse without a tool call.
 </details>
 
 <details>
-<summary><strong>Keys / Trust Credentials</strong> (7 tools) — covers auth keys, OAuth clients, federated identities, and OAuth apps</summary>
+<summary><strong>Keys / Trust Credentials</strong> (9 tools) — covers auth keys, OAuth clients, federated identities, and OAuth apps</summary>
 
 | Tool | Description |
 |------|-------------|
@@ -319,6 +457,8 @@ MCP Resources expose read-only data clients can browse without a tool call.
 | `tailscale_update_key` | Update a key's description, scopes, tags, or federated claim settings |
 | `tailscale_create_oauth_app` | Create an OAuth App for third-party device provisioning (Tailscale alpha) |
 | `tailscale_get_oauth_app` | Get an OAuth App's name, redirect URIs, and scopes |
+| `tailscale_list_oauth_apps` | List every OAuth App registered in the tailnet |
+| `tailscale_delete_oauth_app` | Delete an OAuth App, revoking its ability to provision devices |
 
 </details>
 
@@ -536,13 +676,13 @@ This shows a read-only banner in the Tailscale Admin Console pointing to your re
 
 ## Running on oam.js (optional)
 
-[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 94 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
+[oam.js](https://oamjs.org) runs this server unmodified. Verified against oam 0.9.0: full MCP handshake, all 97 tools, all 4 resources, identical error messages, and a clean stdout protocol stream — from the shipped bundle *and* straight from the TypeScript source with no build step.
 
 **oam 0.9.0 is the minimum.** Older releases ran `child_process.execFile` arguments through a shell, re-splitting them on whitespace and executing shell metacharacters inside an argument. This server shells out to the `tailscale` binary across its local-CLI tools, so that was a reachable bug rather than a theoretical one. The launcher enforces the floor: given an older oam it falls back to Node and says so on stderr, and `TAILSCALE_MCP_RUNTIME=oam` turns that into a hard error.
 
 ### Sandboxing (opt-in)
 
-Set `TAILSCALE_MCP_SANDBOX=1` to run under oam's `--permission` model: network restricted to `api.tailscale.com` and `login.tailscale.com`, filesystem denied. Child-process stays granted because the local-CLI tools shell out to the `tailscale` binary, which is also why `PATH` remains in the environment allow-list.
+Set `TAILSCALE_MCP_SANDBOX=1` to run under oam's `--permission` model: network restricted to `api.tailscale.com` -- the only host the bundle contacts, including the OAuth token exchange -- and filesystem denied. Child-process stays granted because the local-CLI tools shell out to the `tailscale` binary, which is also why `PATH` remains in the environment allow-list.
 
 It is opt-in rather than default because a wrong grant does not fail loudly. oam denies a non-granted environment variable by making it **absent** from `process.env` rather than throwing, so an under-granted `TAILSCALE_API_KEY` reads as "unauthenticated" rather than "denied". The env allow-list in the launcher is derived from what the shipped bundle actually reads -- if you add a new `process.env` lookup, extend that list with it.
 
@@ -551,8 +691,7 @@ It is opt-in rather than default because a wrong grant does not fail loudly. oam
   "mcpServers": {
     "tailscale": {
       "command": "oam",
-      "args": ["run", "/path/to/tailscale-mcp/dist/index.js"],
-      "env": { "TAILSCALE_API_KEY": "tskey-api-..." }
+      "args": ["run", "/path/to/tailscale-mcp/dist/index.js"]
     }
   }
 }

package/bin/tailscale-mcp.mjs

@@ -24,7 +24,8 @@
  *
  * THE `--permission` SANDBOX (oam 0.9.0+, opt-in)
  * `TAILSCALE_MCP_SANDBOX=1` runs the server under oam's permission model:
- * network limited to the control-plane hosts, filesystem denied.
+ * network limited to the one host the bundle actually calls
+ * (api.tailscale.com), filesystem denied.
  *
  * Child-process is granted unconditionally because the local-CLI tools shell out
  * to the `tailscale` binary; that is also why PATH stays in the env grant, since
@@ -49,6 +50,7 @@
  *   TAILSCALE_MCP_RUNTIME=oam    require oam; fail loudly if it is missing
  *   TAILSCALE_MCP_RUNTIME=node   never use oam
  *   TAILSCALE_MCP_RUNTIME=auto   prefer oam, silently fall back (default)
+ *   anything else                warns on stderr, then behaves as auto
  *   TAILSCALE_MCP_SANDBOX=1      run oam under --permission (oam 0.9.0+)
  *   OAM_BIN=/path/to/oam     explicit binary, checked before any discovery
  */
@@ -156,7 +158,16 @@ function atLeast(v, min) {
 function sandboxFlags() {
   if (process.env.TAILSCALE_MCP_SANDBOX !== "1") return [];
 
-  const hosts = ["api.tailscale.com","login.tailscale.com"];
+  // ONE host, deliberately. Every outbound request the bundle makes targets
+  // api.tailscale.com: BASE_URL, the OAuth token exchange, and the absolute-URL
+  // allow-list that refuses to send credentials anywhere else. login.tailscale.com
+  // was granted here as well until an audit found no code path that contacts it
+  // -- console.tailscale.com appears in error TEXT, never as a request target.
+  // An unused grant is the one kind of over-permission nothing ever surfaces:
+  // removing it cannot break a call that was never made, and keeping it widens
+  // the sandbox for no behaviour. launcher.test.ts pins this list exactly so a
+  // future host lands as a reviewed diff rather than a quiet widening.
+  const hosts = ["api.tailscale.com"];
 
   const netFlag = `--allow-net=${hosts.join(",")}`;
 
@@ -166,7 +177,27 @@ function sandboxFlags() {
   // meant the local-CLI tool group silently failed to register under the
   // sandbox even though --allow-child-process is granted below precisely so
   // those tools can shell out.
-  const env = ["PATH","TAILSCALE_API_KEY","TAILSCALE_BINARY","TAILSCALE_DEBUG","TAILSCALE_EXTRA_POSTURE_PROVIDERS","TAILSCALE_EXTRA_WEBHOOK_EVENTS","TAILSCALE_LOCAL_CLI","TAILSCALE_MAX_CONCURRENT","TAILSCALE_OAUTH_CLIENT_ID","TAILSCALE_OAUTH_CLIENT_SECRET","TAILSCALE_OAUTH_TAILNET","TAILSCALE_PROFILE","TAILSCALE_READONLY","TAILSCALE_REQUEST_BUDGET_MS","TAILSCALE_RETRY_BASE_DELAY_MS","TAILSCALE_TAILNET","TAILSCALE_TOOLS"];
+  const env = [
+    "PATH",
+    "TAILSCALE_API_KEY",
+    "TAILSCALE_BINARY",
+    "TAILSCALE_DEBUG",
+    "TAILSCALE_EXTRA_POSTURE_PROVIDERS",
+    "TAILSCALE_EXTRA_WEBHOOK_EVENTS",
+    "TAILSCALE_LOCAL_CLI",
+    "TAILSCALE_MAX_CONCURRENT",
+    "TAILSCALE_OAUTH_CLIENT_ID",
+    "TAILSCALE_OAUTH_CLIENT_SECRET",
+    "TAILSCALE_OAUTH_TAILNET",
+    "TAILSCALE_PROFILE",
+    "TAILSCALE_READONLY",
+    "TAILSCALE_REQUEST_BUDGET_MS",
+    "TAILSCALE_REQUIRE_APPROVAL",
+    "TAILSCALE_RETRY_BASE_DELAY_MS",
+    "TAILSCALE_TAILNET",
+    "TAILSCALE_TOOLS",
+    "TAILSCALE_WRITE_GROUPS",
+  ];
 
   const flags = ["--permission", netFlag, `--allow-env=${env.join(",")}`];
   flags.push("--allow-child-process");
@@ -231,7 +262,23 @@ async function runInProcess() {
   await import(SERVER_URL.href);
 }
 
-const mode = (process.env.TAILSCALE_MCP_RUNTIME ?? "auto").toLowerCase();
+// Every value below is compared against `mode` after lowercasing, so an
+// unrecognized one matched nothing and fell through to the auto branch --
+// `TAILSCALE_MCP_RUNTIME=nod` silently PREFERRED oam on a box that has it,
+// which is the opposite of what was asked for. Same handling as index.ts gives
+// an unknown subcommand: auto is still the right landing place, it just stops
+// being silent. An empty value is treated as unset, since `FOO=$UNSET` in a
+// wrapper script is how it usually gets there.
+const RUNTIMES = ["auto", "node", "oam"];
+const requested = process.env.TAILSCALE_MCP_RUNTIME;
+const mode = (requested ?? "auto").toLowerCase();
+if (requested && !RUNTIMES.includes(mode)) {
+  // Echo what was SET, not the lowercased form, so the typo is recognisable in
+  // the host's log next to the config line that produced it.
+  await errSync(
+    `tailscale-mcp: unrecognized TAILSCALE_MCP_RUNTIME "${requested}" -- known values: ${RUNTIMES.join(", ")}. Using auto.\n`,
+  );
+}
 
 if (mode === "node") {
   await runInProcess();
@@ -259,7 +306,8 @@ if (mode === "node") {
       const { writeSync } = await import("node:fs");
       writeSync(
         2,
-        "tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but no runnable oam binary was found.\n" + shimNote +
+        "tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but no runnable oam binary was found.\n" +
+          shimNote +
           "Install from https://oamjs.org, set OAM_BIN=/path/to/oam, or use TAILSCALE_MCP_RUNTIME=node.\n",
       );
       process.exit(1);
@@ -280,7 +328,7 @@ if (mode === "node") {
       ? `${oam} is oam ${found.join(".")}, older than ${min}`
       : `${oam} could not be run, or did not report a version this launcher understands`;
     const remedy = found
-      ? "Run \`oam self-update\`, or use TAILSCALE_MCP_RUNTIME=node.\n"
+      ? "Run `oam self-update`, or use TAILSCALE_MCP_RUNTIME=node.\n"
       : "Check that it is an executable oam binary for this platform, or use TAILSCALE_MCP_RUNTIME=node.\n";
     if (mode === "oam") {
       await errSync(`tailscale-mcp: TAILSCALE_MCP_RUNTIME=oam but ${detail}.\n${remedy}`);
@@ -337,7 +385,6 @@ if (mode === "node") {
     }
 
     if (child) {
-
       // If oam cannot be executed at all (deleted between the stat and the spawn,
       // wrong arch, permission), fall back rather than failing the whole server.
       // `spawned` prevents falling back AFTER the child started, which would