@yawlabs/tailscale-mcp 0.2.1 → 0.4.0

package/README.md

@@ -3,7 +3,7 @@
 [![npm version](https://img.shields.io/npm/v/@yawlabs/tailscale-mcp)](https://www.npmjs.com/package/@yawlabs/tailscale-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
 [![GitHub stars](https://img.shields.io/github/stars/YawLabs/tailscale-mcp)](https://github.com/YawLabs/tailscale-mcp/stargazers)
-[![CI](https://github.com/YawLabs/tailscale-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/YawLabs/tailscale-mcp/actions/workflows/ci.yml)
+[![CI](https://github.com/YawLabs/tailscale-mcp/actions/workflows/ci.yml/badge.svg)](https://github.com/YawLabs/tailscale-mcp/actions/workflows/ci.yml) [![Release](https://github.com/YawLabs/tailscale-mcp/actions/workflows/release.yml/badge.svg)](https://github.com/YawLabs/tailscale-mcp/actions/workflows/release.yml)
 
 **Manage your Tailscale tailnet from Claude Code, Cursor, and any MCP client.** 81 tools + 4 resources. One env var. Works on first try.
 
@@ -17,6 +17,7 @@ Other Tailscale MCP servers were vibe-coded in a weekend and abandoned. This one
 - **Safe ACL updates** — uses ETags to prevent overwriting concurrent changes. No silent data loss.
 - **Tool annotations** — every tool declares `readOnlyHint`, `destructiveHint`, and `idempotentHint`, so MCP clients skip confirmation dialogs for safe operations.
 - **MCP Resources** — exposes tailnet status, device list, ACL policy, and DNS config as browsable resources.
+- **Instant startup** — ships as a single self-contained bundle with zero runtime dependencies. `npx` downloads ~150 KB and starts immediately — no 5-minute `node_modules` installs.
 - **Zero restarts** — the server always starts, even with missing credentials. Auth errors surface as clear tool-call errors, not silent crashes that force you to restart your AI assistant.
 - **One env var setup** — no config files, no setup wizards, no multi-step flows.
 - **Every tool verified** — no placeholder endpoints that 404. If it's in the tool list, it works.
@@ -33,8 +34,6 @@ export TAILSCALE_API_KEY="tskey-api-..."
 
 **2. Create `.mcp.json` in your project root**
 
-macOS / Linux / WSL:
-
 ```json
 {
   "mcpServers": {
@@ -46,20 +45,7 @@ macOS / Linux / WSL:
 }
 ```
 
-Windows:
-
-```json
-{
-  "mcpServers": {
-    "tailscale": {
-      "command": "cmd",
-      "args": ["/c", "npx", "-y", "@yawlabs/tailscale-mcp"]
-    }
-  }
-}
-```
-
-> **Tip:** This file is safe to commit — it contains no secrets. Teammates who set their own `TAILSCALE_API_KEY` will get the MCP server automatically.
+> **Tip:** This file is safe to commit — it contains no secrets. Teammates who set their own `TAILSCALE_API_KEY` will get the MCP server automatically. Works on macOS, Linux, and Windows — no platform-specific config needed.
 
 **3. Restart and approve**
 
@@ -201,8 +187,8 @@ MCP Resources expose read-only data that clients can browse without tool calls.
 
 | Tool | Description |
 |------|-------------|
-| `tailscale_get_tailnet_settings` | Get tailnet settings |
-| `tailscale_update_tailnet_settings` | Update tailnet settings |
+| `tailscale_get_tailnet_settings` | Get tailnet settings (HTTPS, device approval, key expiry, etc.) |
+| `tailscale_update_tailnet_settings` | Update tailnet settings (HTTPS certificates, approval, auto-updates, key expiry, posture, regional routing, network flow logging) |
 | `tailscale_get_contacts` | Get tailnet contacts |
 | `tailscale_set_contacts` | Set tailnet contacts |
 
@@ -329,6 +315,26 @@ MCP Resources expose read-only data that clients can browse without tool calls.
 
 </details>
 
+## GitOps: deploy ACLs from CI
+
+The recommended workflow for ACL management is to keep your policy in git and deploy it automatically on merge. This gives you code review, history, and no accidental overwrites from stale browser tabs.
+
+The `deploy-acl` CLI subcommand handles everything — ETag fetching, validation, and deployment — in a single command:
+
+```bash
+npx @yawlabs/tailscale-mcp deploy-acl tailscale/acl.json
+```
+
+Works with any CI system — just set `TAILSCALE_API_KEY` and `TAILSCALE_TAILNET` as env vars.
+
+**Optional:** Lock the Admin Console to prevent manual edits that drift from git:
+
+```
+> "Set aclsExternallyManagedOn to true and aclsExternalLink to our repo URL"
+```
+
+This shows a read-only banner in the Tailscale Admin Console pointing to your repo. Use the MCP for reads and one-off operations (audit logs, device management, investigations), and let CI handle ACL deployments.
+
 ## Requirements
 
 - Node.js 18 or higher