tailscale-mcp 2026.3.18 → 2026.4.9-1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +12 -0
- package/README.md +40 -0
- package/dist/config/vault-loader.d.ts +42 -0
- package/dist/config/vault-loader.d.ts.map +1 -0
- package/dist/config/vault-loader.js +93 -0
- package/dist/config/vault-loader.js.map +1 -0
- package/dist/index.js +14 -1
- package/dist/index.js.map +1 -1
- package/dist/server.d.ts +1 -1
- package/dist/server.d.ts.map +1 -1
- package/dist/server.js +1 -1
- package/dist/server.js.map +1 -1
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
|
|
|
4
4
|
This project uses [Calendar Versioning](https://calver.org/) (`YYYY.MM.DD.TS`).
|
|
5
5
|
|
|
6
6
|
|
|
7
|
+
## v2026.04.09.1
|
|
8
|
+
|
|
9
|
+
- **Vault AppRole secret loading** (#44)
|
|
10
|
+
- New opportunistic loader reads `TAILSCALE_API_KEY` and `TAILSCALE_TAILNET` from HashiCorp Vault at startup
|
|
11
|
+
- Configured via `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` (optional `NAS_VAULT_KV_MOUNT`, default `kv`)
|
|
12
|
+
- KV v2 path: `<mount>/data/tailscale/api` — keys `api_key`, `tailnet`
|
|
13
|
+
- Precedence: `process.env` (explicit) > Vault — fully backwards compatible (silent no-op if `NAS_VAULT_ADDR` is unset)
|
|
14
|
+
- Vault errors log a single stderr line and never fatal — the server falls back to existing env vars
|
|
15
|
+
- Secret values are never logged; only the KV path name and a populated-count appear in diagnostics
|
|
16
|
+
- `createServer()` is now constructed inside `main()` after the Vault load, since it reads env synchronously via `createClientFromEnv()`
|
|
17
|
+
- No new runtime dependencies — uses global `fetch` (Node 20+)
|
|
18
|
+
|
|
7
19
|
## v2026.03.17.1
|
|
8
20
|
|
|
9
21
|
- **Fix DERP map, log streaming, and tailnet lock 404 handling** (#42)
|
package/README.md
CHANGED
|
@@ -123,9 +123,49 @@ All requests require `Authorization: Bearer <token>`. The server will not start
|
|
|
123
123
|
| `TAILSCALE_TAILNET` | Yes | — | Tailnet name (e.g., `example.com` or your org name) |
|
|
124
124
|
| `TAILSCALE_API_URL` | No | `https://api.tailscale.com` | API base URL (override for testing) |
|
|
125
125
|
| `TAILSCALE_TIMEOUT` | No | `30000` | Request timeout in milliseconds |
|
|
126
|
+
| `NAS_VAULT_ADDR` | No | — | HashiCorp Vault URL, enables Vault AppRole loading (see below) |
|
|
127
|
+
| `NAS_VAULT_ROLE_ID` | No | — | Vault AppRole role_id |
|
|
128
|
+
| `NAS_VAULT_SECRET_ID` | No | — | Vault AppRole secret_id |
|
|
129
|
+
| `NAS_VAULT_KV_MOUNT` | No | `kv` | Vault KV v2 mount path |
|
|
126
130
|
|
|
127
131
|
*\*Either `TAILSCALE_API_KEY` or both `TAILSCALE_OAUTH_CLIENT_ID` + `TAILSCALE_OAUTH_CLIENT_SECRET` must be set. OAuth takes priority when both are configured.*
|
|
128
132
|
|
|
133
|
+
### Loading Secrets from HashiCorp Vault (AppRole)
|
|
134
|
+
|
|
135
|
+
If you run a central Vault instance, `mcp-tailscale` can fetch its credentials
|
|
136
|
+
at startup via AppRole instead of passing them through the MCP config:
|
|
137
|
+
|
|
138
|
+
```sh
|
|
139
|
+
export NAS_VAULT_ADDR=https://vault.example.com
|
|
140
|
+
export NAS_VAULT_ROLE_ID=<role-id>
|
|
141
|
+
export NAS_VAULT_SECRET_ID=<secret-id>
|
|
142
|
+
# optional — defaults to "kv"
|
|
143
|
+
export NAS_VAULT_KV_MOUNT=kv
|
|
144
|
+
```
|
|
145
|
+
|
|
146
|
+
The loader reads KV v2 at `<mount>/data/tailscale/api` and expects two keys:
|
|
147
|
+
`api_key` and `tailnet`. Example Vault write:
|
|
148
|
+
|
|
149
|
+
```sh
|
|
150
|
+
vault kv put kv/tailscale/api \
|
|
151
|
+
api_key=tskey-api-test \
|
|
152
|
+
tailnet=your-tailnet-name
|
|
153
|
+
```
|
|
154
|
+
|
|
155
|
+
**Precedence:** `process.env` (explicit) > Vault. If `NAS_VAULT_ADDR` is unset
|
|
156
|
+
the loader is a silent no-op — the server behaves exactly as before. On any
|
|
157
|
+
Vault error (network, auth, missing path), a single-line warning is written
|
|
158
|
+
to stderr and the server falls back to whatever env vars are already set.
|
|
159
|
+
|
|
160
|
+
**OAuth note:** the Vault loader only handles the API-key path. If you use
|
|
161
|
+
OAuth (`TAILSCALE_OAUTH_CLIENT_ID` / `TAILSCALE_OAUTH_CLIENT_SECRET`), set
|
|
162
|
+
those through the normal environment — they are not currently read from
|
|
163
|
+
Vault.
|
|
164
|
+
|
|
165
|
+
**Security:** secret values are never logged. Only the KV path name and a
|
|
166
|
+
populated-count appear in stderr diagnostics. Uses the global `fetch`
|
|
167
|
+
(Node 20+) — no new runtime dependencies.
|
|
168
|
+
|
|
129
169
|
### Authentication
|
|
130
170
|
|
|
131
171
|
**API Key:** Create at `login.tailscale.com/admin/settings/keys`. The key needs read/write access to the resources you want to manage.
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Opportunistic HashiCorp Vault AppRole secret loader.
|
|
3
|
+
*
|
|
4
|
+
* If `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` are set in
|
|
5
|
+
* the environment, this module logs in via AppRole, reads a KV v2 secret, and
|
|
6
|
+
* populates mapped keys into `process.env` — but only for env vars that are
|
|
7
|
+
* not already set. This means `process.env` (explicit shell/MCP config) takes
|
|
8
|
+
* precedence over Vault, which in turn takes precedence over `MCP_SECRETS_FILE`.
|
|
9
|
+
*
|
|
10
|
+
* Fully backwards compatible: if `NAS_VAULT_ADDR` is unset the loader is a
|
|
11
|
+
* silent no-op. On any Vault error (network, auth, missing path, malformed
|
|
12
|
+
* response) a single-line warning is written to stderr and the caller
|
|
13
|
+
* continues with whatever env vars are already populated — the server will
|
|
14
|
+
* then fail later with its usual "missing required env var" message.
|
|
15
|
+
*
|
|
16
|
+
* Security: secret values are NEVER logged. The KV path name may appear in
|
|
17
|
+
* stderr diagnostics. No runtime dependencies — uses global `fetch` (Node 20+).
|
|
18
|
+
*/
|
|
19
|
+
export interface VaultLoaderOptions {
|
|
20
|
+
/**
|
|
21
|
+
* KV v2 path to read, e.g. "opnsense/bifrost". The loader will GET
|
|
22
|
+
* `<addr>/v1/<mount>/data/<path>`.
|
|
23
|
+
*/
|
|
24
|
+
kvPath: string;
|
|
25
|
+
/**
|
|
26
|
+
* Map of KV secret key → target environment variable name.
|
|
27
|
+
* Only env vars that are currently undefined / empty will be populated.
|
|
28
|
+
*/
|
|
29
|
+
mapping: Record<string, string>;
|
|
30
|
+
/** Optional process.env override (for tests). */
|
|
31
|
+
env?: NodeJS.ProcessEnv;
|
|
32
|
+
/** Optional fetch override (for tests). */
|
|
33
|
+
fetchImpl?: typeof fetch;
|
|
34
|
+
}
|
|
35
|
+
/**
|
|
36
|
+
* Log in via AppRole and fetch a KV v2 secret, populating mapped env vars.
|
|
37
|
+
*
|
|
38
|
+
* Silent no-op unless `NAS_VAULT_ADDR`, `NAS_VAULT_ROLE_ID`, and
|
|
39
|
+
* `NAS_VAULT_SECRET_ID` are all set.
|
|
40
|
+
*/
|
|
41
|
+
export declare function loadFromVault(options: VaultLoaderOptions): Promise<void>;
|
|
42
|
+
//# sourceMappingURL=vault-loader.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vault-loader.d.ts","sourceRoot":"","sources":["../../src/config/vault-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAcD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE9E"}
|
|
@@ -0,0 +1,93 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Opportunistic HashiCorp Vault AppRole secret loader.
|
|
3
|
+
*
|
|
4
|
+
* If `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` are set in
|
|
5
|
+
* the environment, this module logs in via AppRole, reads a KV v2 secret, and
|
|
6
|
+
* populates mapped keys into `process.env` — but only for env vars that are
|
|
7
|
+
* not already set. This means `process.env` (explicit shell/MCP config) takes
|
|
8
|
+
* precedence over Vault, which in turn takes precedence over `MCP_SECRETS_FILE`.
|
|
9
|
+
*
|
|
10
|
+
* Fully backwards compatible: if `NAS_VAULT_ADDR` is unset the loader is a
|
|
11
|
+
* silent no-op. On any Vault error (network, auth, missing path, malformed
|
|
12
|
+
* response) a single-line warning is written to stderr and the caller
|
|
13
|
+
* continues with whatever env vars are already populated — the server will
|
|
14
|
+
* then fail later with its usual "missing required env var" message.
|
|
15
|
+
*
|
|
16
|
+
* Security: secret values are NEVER logged. The KV path name may appear in
|
|
17
|
+
* stderr diagnostics. No runtime dependencies — uses global `fetch` (Node 20+).
|
|
18
|
+
*/
|
|
19
|
+
/**
|
|
20
|
+
* Log in via AppRole and fetch a KV v2 secret, populating mapped env vars.
|
|
21
|
+
*
|
|
22
|
+
* Silent no-op unless `NAS_VAULT_ADDR`, `NAS_VAULT_ROLE_ID`, and
|
|
23
|
+
* `NAS_VAULT_SECRET_ID` are all set.
|
|
24
|
+
*/
|
|
25
|
+
export async function loadFromVault(options) {
|
|
26
|
+
const env = options.env ?? process.env;
|
|
27
|
+
const fetchFn = options.fetchImpl ?? fetch;
|
|
28
|
+
const addr = env["NAS_VAULT_ADDR"];
|
|
29
|
+
const roleId = env["NAS_VAULT_ROLE_ID"];
|
|
30
|
+
const secretId = env["NAS_VAULT_SECRET_ID"];
|
|
31
|
+
if (!addr || !roleId || !secretId) {
|
|
32
|
+
// Not configured — fully backwards compatible no-op.
|
|
33
|
+
return;
|
|
34
|
+
}
|
|
35
|
+
const mount = env["NAS_VAULT_KV_MOUNT"] || "kv";
|
|
36
|
+
const base = addr.replace(/\/+$/, "");
|
|
37
|
+
try {
|
|
38
|
+
// 1. AppRole login
|
|
39
|
+
const loginRes = await fetchFn(`${base}/v1/auth/approle/login`, {
|
|
40
|
+
method: "POST",
|
|
41
|
+
headers: { "Content-Type": "application/json" },
|
|
42
|
+
body: JSON.stringify({ role_id: roleId, secret_id: secretId }),
|
|
43
|
+
});
|
|
44
|
+
if (!loginRes.ok) {
|
|
45
|
+
warn(`vault AppRole login failed: HTTP ${loginRes.status}`);
|
|
46
|
+
return;
|
|
47
|
+
}
|
|
48
|
+
const loginJson = (await loginRes.json());
|
|
49
|
+
const token = loginJson.auth?.client_token;
|
|
50
|
+
if (!token) {
|
|
51
|
+
warn("vault AppRole login response missing client_token");
|
|
52
|
+
return;
|
|
53
|
+
}
|
|
54
|
+
// 2. KV v2 read
|
|
55
|
+
const kvUrl = `${base}/v1/${mount}/data/${options.kvPath}`;
|
|
56
|
+
const kvRes = await fetchFn(kvUrl, {
|
|
57
|
+
method: "GET",
|
|
58
|
+
headers: { "X-Vault-Token": token },
|
|
59
|
+
});
|
|
60
|
+
if (!kvRes.ok) {
|
|
61
|
+
warn(`vault KV read failed for ${options.kvPath}: HTTP ${kvRes.status}`);
|
|
62
|
+
return;
|
|
63
|
+
}
|
|
64
|
+
const kvJson = (await kvRes.json());
|
|
65
|
+
const data = kvJson.data?.data;
|
|
66
|
+
if (!data || typeof data !== "object") {
|
|
67
|
+
warn(`vault KV response for ${options.kvPath} missing data.data`);
|
|
68
|
+
return;
|
|
69
|
+
}
|
|
70
|
+
// 3. Populate env vars per mapping, respecting existing values
|
|
71
|
+
let populated = 0;
|
|
72
|
+
for (const [kvKey, envVar] of Object.entries(options.mapping)) {
|
|
73
|
+
const value = data[kvKey];
|
|
74
|
+
if (typeof value !== "string" || value.length === 0)
|
|
75
|
+
continue;
|
|
76
|
+
if (env[envVar] !== undefined && env[envVar] !== "")
|
|
77
|
+
continue;
|
|
78
|
+
env[envVar] = value;
|
|
79
|
+
populated += 1;
|
|
80
|
+
}
|
|
81
|
+
// Diagnostic only: path name + count, never values or key names.
|
|
82
|
+
warn(`vault loaded ${populated} value(s) from ${options.kvPath}`);
|
|
83
|
+
}
|
|
84
|
+
catch (err) {
|
|
85
|
+
const msg = err instanceof Error ? err.message : String(err);
|
|
86
|
+
warn(`vault load error for ${options.kvPath}: ${msg}`);
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
/** Single-line stderr diagnostic. Never writes secret values. */
|
|
90
|
+
function warn(msg) {
|
|
91
|
+
process.stderr.write(`[mcp vault-loader] ${msg}\n`);
|
|
92
|
+
}
|
|
93
|
+
//# sourceMappingURL=vault-loader.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"vault-loader.js","sourceRoot":"","sources":["../../src/config/vault-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA+BH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,qDAAqD;QACrD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,wBAAwB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,gBAAgB;QAChB,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,KAAK,SAAS,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE;YACjC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,4BAA4B,OAAO,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAqB,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,yBAAyB,OAAO,CAAC,MAAM,oBAAoB,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;gBAAE,SAAS;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,iEAAiE;QACjE,IAAI,CAAC,gBAAgB,SAAS,kBAAkB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,wBAAwB,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACtD,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -7,8 +7,21 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
|
|
|
7
7
|
import express from "express";
|
|
8
8
|
import { validateTransportConfig, createAuthMiddleware } from "./transport.js";
|
|
9
9
|
import { createServer } from "./server.js";
|
|
10
|
-
|
|
10
|
+
import { loadFromVault } from "./config/vault-loader.js";
|
|
11
11
|
async function main() {
|
|
12
|
+
// Opportunistic Vault AppRole secret loading. Silent no-op unless
|
|
13
|
+
// NAS_VAULT_ADDR + NAS_VAULT_ROLE_ID + NAS_VAULT_SECRET_ID are set.
|
|
14
|
+
// Precedence: process.env (explicit) > Vault. See src/config/vault-loader.ts.
|
|
15
|
+
await loadFromVault({
|
|
16
|
+
kvPath: "tailscale/api",
|
|
17
|
+
mapping: {
|
|
18
|
+
api_key: "TAILSCALE_API_KEY",
|
|
19
|
+
tailnet: "TAILSCALE_TAILNET",
|
|
20
|
+
},
|
|
21
|
+
});
|
|
22
|
+
// createServer() reads env synchronously via createClientFromEnv(),
|
|
23
|
+
// so it MUST be called AFTER loadFromVault() populates process.env.
|
|
24
|
+
const { server } = createServer();
|
|
12
25
|
const config = validateTransportConfig(process.env);
|
|
13
26
|
if (config.mode === "stdio") {
|
|
14
27
|
const transport = new StdioServerTransport();
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,kEAAkE;IAClE,oEAAoE;IACpE,8EAA8E;IAC9E,MAAM,aAAa,CAAC;QAClB,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE;YACP,OAAO,EAAE,mBAAmB;YAC5B,OAAO,EAAE,mBAAmB;SAC7B;KACF,CAAC,CAAC;IAEH,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAyC,CAAC,CAAC;IAE1F,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEhD,+DAA+D;QAC/D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;QAE5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YAC3C,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAElD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YACjD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACxC,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/server.d.ts
CHANGED
|
@@ -15,7 +15,7 @@ export interface CreateServerOptions {
|
|
|
15
15
|
middleware?: ToolMiddleware;
|
|
16
16
|
/** Server name (default: "mcp-tailscale") */
|
|
17
17
|
name?: string;
|
|
18
|
-
/** Server version (default: "2026.
|
|
18
|
+
/** Server version (default: "2026.4.9-1") */
|
|
19
19
|
version?: string;
|
|
20
20
|
}
|
|
21
21
|
/**
|
package/dist/server.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwB9D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwB9D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,8BAA8B;IAC9B,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,kBAAkB,CAgFpB"}
|
package/dist/server.js
CHANGED
|
@@ -32,7 +32,7 @@ import { postureToolDefinitions, handlePostureTool, } from "./tools/posture.js";
|
|
|
32
32
|
* });
|
|
33
33
|
*/
|
|
34
34
|
export function createServer(options) {
|
|
35
|
-
const { middleware, name = "mcp-tailscale", version = "2026.
|
|
35
|
+
const { middleware, name = "mcp-tailscale", version = "2026.4.9-1", } = options ?? {};
|
|
36
36
|
// Assemble all tool definitions
|
|
37
37
|
const allToolDefinitions = [
|
|
38
38
|
...deviceToolDefinitions,
|
package/dist/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AA4B5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA6B;IAE7B,MAAM,EACJ,UAAU,EACV,IAAI,GAAG,eAAe,EACtB,OAAO,GAAG,
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AA4B5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA6B;IAE7B,MAAM,EACJ,UAAU,EACV,IAAI,GAAG,eAAe,EACtB,OAAO,GAAG,YAAY,GACvB,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,gCAAgC;IAChC,MAAM,kBAAkB,GAAW;QACjC,GAAG,qBAAqB;QACxB,GAAG,kBAAkB;QACrB,GAAG,kBAAkB;QACrB,GAAG,kBAAkB;QACrB,GAAG,sBAAsB;QACzB,GAAG,0BAA0B;QAC7B,GAAG,mBAAmB;QACtB,GAAG,sBAAsB;QACzB,GAAG,sBAAsB;KACL,CAAC;IAEvB,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,qBAAqB;QACrC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,0BAA0B;QAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,mBAAmB;QACnC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEhD,8BAA8B;IAC9B,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IAErC,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,6BAA6B;IAC7B,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,kBAAkB;KAC1B,CAAC,CAAC,CAAC;IAEJ,wDAAwD;IACxD,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,QAAQ,EAAE,EAAE;iBAC7D;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAE1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AAC9D,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "tailscale-mcp",
|
|
3
3
|
"mcpName": "io.github.itunified-io/tailscale",
|
|
4
|
-
"version": "2026.
|
|
4
|
+
"version": "2026.4.9-1",
|
|
5
5
|
"description": "Secure MCP access for private infrastructure over Tailscale — 49 tools for devices, DNS, ACL, keys, users, webhooks, posture, and tailnet management via Tailscale API v2",
|
|
6
6
|
"type": "module",
|
|
7
7
|
"main": "dist/index.js",
|