tailscale-mcp 2026.3.18 → 2026.4.9-1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/CHANGELOG.md CHANGED
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
4
4
  This project uses [Calendar Versioning](https://calver.org/) (`YYYY.MM.DD.TS`).
5
5
 
6
6
 
7
+ ## v2026.04.09.1
8
+
9
+ - **Vault AppRole secret loading** (#44)
10
+ - New opportunistic loader reads `TAILSCALE_API_KEY` and `TAILSCALE_TAILNET` from HashiCorp Vault at startup
11
+ - Configured via `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` (optional `NAS_VAULT_KV_MOUNT`, default `kv`)
12
+ - KV v2 path: `<mount>/data/tailscale/api` — keys `api_key`, `tailnet`
13
+ - Precedence: `process.env` (explicit) > Vault — fully backwards compatible (silent no-op if `NAS_VAULT_ADDR` is unset)
14
+ - Vault errors log a single stderr line and never fatal — the server falls back to existing env vars
15
+ - Secret values are never logged; only the KV path name and a populated-count appear in diagnostics
16
+ - `createServer()` is now constructed inside `main()` after the Vault load, since it reads env synchronously via `createClientFromEnv()`
17
+ - No new runtime dependencies — uses global `fetch` (Node 20+)
18
+
7
19
  ## v2026.03.17.1
8
20
 
9
21
  - **Fix DERP map, log streaming, and tailnet lock 404 handling** (#42)
package/README.md CHANGED
@@ -123,9 +123,49 @@ All requests require `Authorization: Bearer <token>`. The server will not start
123
123
  | `TAILSCALE_TAILNET` | Yes | — | Tailnet name (e.g., `example.com` or your org name) |
124
124
  | `TAILSCALE_API_URL` | No | `https://api.tailscale.com` | API base URL (override for testing) |
125
125
  | `TAILSCALE_TIMEOUT` | No | `30000` | Request timeout in milliseconds |
126
+ | `NAS_VAULT_ADDR` | No | — | HashiCorp Vault URL, enables Vault AppRole loading (see below) |
127
+ | `NAS_VAULT_ROLE_ID` | No | — | Vault AppRole role_id |
128
+ | `NAS_VAULT_SECRET_ID` | No | — | Vault AppRole secret_id |
129
+ | `NAS_VAULT_KV_MOUNT` | No | `kv` | Vault KV v2 mount path |
126
130
 
127
131
  *\*Either `TAILSCALE_API_KEY` or both `TAILSCALE_OAUTH_CLIENT_ID` + `TAILSCALE_OAUTH_CLIENT_SECRET` must be set. OAuth takes priority when both are configured.*
128
132
 
133
+ ### Loading Secrets from HashiCorp Vault (AppRole)
134
+
135
+ If you run a central Vault instance, `mcp-tailscale` can fetch its credentials
136
+ at startup via AppRole instead of passing them through the MCP config:
137
+
138
+ ```sh
139
+ export NAS_VAULT_ADDR=https://vault.example.com
140
+ export NAS_VAULT_ROLE_ID=<role-id>
141
+ export NAS_VAULT_SECRET_ID=<secret-id>
142
+ # optional — defaults to "kv"
143
+ export NAS_VAULT_KV_MOUNT=kv
144
+ ```
145
+
146
+ The loader reads KV v2 at `<mount>/data/tailscale/api` and expects two keys:
147
+ `api_key` and `tailnet`. Example Vault write:
148
+
149
+ ```sh
150
+ vault kv put kv/tailscale/api \
151
+ api_key=tskey-api-test \
152
+ tailnet=your-tailnet-name
153
+ ```
154
+
155
+ **Precedence:** `process.env` (explicit) > Vault. If `NAS_VAULT_ADDR` is unset
156
+ the loader is a silent no-op — the server behaves exactly as before. On any
157
+ Vault error (network, auth, missing path), a single-line warning is written
158
+ to stderr and the server falls back to whatever env vars are already set.
159
+
160
+ **OAuth note:** the Vault loader only handles the API-key path. If you use
161
+ OAuth (`TAILSCALE_OAUTH_CLIENT_ID` / `TAILSCALE_OAUTH_CLIENT_SECRET`), set
162
+ those through the normal environment — they are not currently read from
163
+ Vault.
164
+
165
+ **Security:** secret values are never logged. Only the KV path name and a
166
+ populated-count appear in stderr diagnostics. Uses the global `fetch`
167
+ (Node 20+) — no new runtime dependencies.
168
+
129
169
  ### Authentication
130
170
 
131
171
  **API Key:** Create at `login.tailscale.com/admin/settings/keys`. The key needs read/write access to the resources you want to manage.
@@ -0,0 +1,42 @@
1
+ /**
2
+ * Opportunistic HashiCorp Vault AppRole secret loader.
3
+ *
4
+ * If `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` are set in
5
+ * the environment, this module logs in via AppRole, reads a KV v2 secret, and
6
+ * populates mapped keys into `process.env` — but only for env vars that are
7
+ * not already set. This means `process.env` (explicit shell/MCP config) takes
8
+ * precedence over Vault, which in turn takes precedence over `MCP_SECRETS_FILE`.
9
+ *
10
+ * Fully backwards compatible: if `NAS_VAULT_ADDR` is unset the loader is a
11
+ * silent no-op. On any Vault error (network, auth, missing path, malformed
12
+ * response) a single-line warning is written to stderr and the caller
13
+ * continues with whatever env vars are already populated — the server will
14
+ * then fail later with its usual "missing required env var" message.
15
+ *
16
+ * Security: secret values are NEVER logged. The KV path name may appear in
17
+ * stderr diagnostics. No runtime dependencies — uses global `fetch` (Node 20+).
18
+ */
19
+ export interface VaultLoaderOptions {
20
+ /**
21
+ * KV v2 path to read, e.g. "opnsense/bifrost". The loader will GET
22
+ * `<addr>/v1/<mount>/data/<path>`.
23
+ */
24
+ kvPath: string;
25
+ /**
26
+ * Map of KV secret key → target environment variable name.
27
+ * Only env vars that are currently undefined / empty will be populated.
28
+ */
29
+ mapping: Record<string, string>;
30
+ /** Optional process.env override (for tests). */
31
+ env?: NodeJS.ProcessEnv;
32
+ /** Optional fetch override (for tests). */
33
+ fetchImpl?: typeof fetch;
34
+ }
35
+ /**
36
+ * Log in via AppRole and fetch a KV v2 secret, populating mapped env vars.
37
+ *
38
+ * Silent no-op unless `NAS_VAULT_ADDR`, `NAS_VAULT_ROLE_ID`, and
39
+ * `NAS_VAULT_SECRET_ID` are all set.
40
+ */
41
+ export declare function loadFromVault(options: VaultLoaderOptions): Promise<void>;
42
+ //# sourceMappingURL=vault-loader.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"vault-loader.d.ts","sourceRoot":"","sources":["../../src/config/vault-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAcD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkE9E"}
@@ -0,0 +1,93 @@
1
+ /**
2
+ * Opportunistic HashiCorp Vault AppRole secret loader.
3
+ *
4
+ * If `NAS_VAULT_ADDR` + `NAS_VAULT_ROLE_ID` + `NAS_VAULT_SECRET_ID` are set in
5
+ * the environment, this module logs in via AppRole, reads a KV v2 secret, and
6
+ * populates mapped keys into `process.env` — but only for env vars that are
7
+ * not already set. This means `process.env` (explicit shell/MCP config) takes
8
+ * precedence over Vault, which in turn takes precedence over `MCP_SECRETS_FILE`.
9
+ *
10
+ * Fully backwards compatible: if `NAS_VAULT_ADDR` is unset the loader is a
11
+ * silent no-op. On any Vault error (network, auth, missing path, malformed
12
+ * response) a single-line warning is written to stderr and the caller
13
+ * continues with whatever env vars are already populated — the server will
14
+ * then fail later with its usual "missing required env var" message.
15
+ *
16
+ * Security: secret values are NEVER logged. The KV path name may appear in
17
+ * stderr diagnostics. No runtime dependencies — uses global `fetch` (Node 20+).
18
+ */
19
+ /**
20
+ * Log in via AppRole and fetch a KV v2 secret, populating mapped env vars.
21
+ *
22
+ * Silent no-op unless `NAS_VAULT_ADDR`, `NAS_VAULT_ROLE_ID`, and
23
+ * `NAS_VAULT_SECRET_ID` are all set.
24
+ */
25
+ export async function loadFromVault(options) {
26
+ const env = options.env ?? process.env;
27
+ const fetchFn = options.fetchImpl ?? fetch;
28
+ const addr = env["NAS_VAULT_ADDR"];
29
+ const roleId = env["NAS_VAULT_ROLE_ID"];
30
+ const secretId = env["NAS_VAULT_SECRET_ID"];
31
+ if (!addr || !roleId || !secretId) {
32
+ // Not configured — fully backwards compatible no-op.
33
+ return;
34
+ }
35
+ const mount = env["NAS_VAULT_KV_MOUNT"] || "kv";
36
+ const base = addr.replace(/\/+$/, "");
37
+ try {
38
+ // 1. AppRole login
39
+ const loginRes = await fetchFn(`${base}/v1/auth/approle/login`, {
40
+ method: "POST",
41
+ headers: { "Content-Type": "application/json" },
42
+ body: JSON.stringify({ role_id: roleId, secret_id: secretId }),
43
+ });
44
+ if (!loginRes.ok) {
45
+ warn(`vault AppRole login failed: HTTP ${loginRes.status}`);
46
+ return;
47
+ }
48
+ const loginJson = (await loginRes.json());
49
+ const token = loginJson.auth?.client_token;
50
+ if (!token) {
51
+ warn("vault AppRole login response missing client_token");
52
+ return;
53
+ }
54
+ // 2. KV v2 read
55
+ const kvUrl = `${base}/v1/${mount}/data/${options.kvPath}`;
56
+ const kvRes = await fetchFn(kvUrl, {
57
+ method: "GET",
58
+ headers: { "X-Vault-Token": token },
59
+ });
60
+ if (!kvRes.ok) {
61
+ warn(`vault KV read failed for ${options.kvPath}: HTTP ${kvRes.status}`);
62
+ return;
63
+ }
64
+ const kvJson = (await kvRes.json());
65
+ const data = kvJson.data?.data;
66
+ if (!data || typeof data !== "object") {
67
+ warn(`vault KV response for ${options.kvPath} missing data.data`);
68
+ return;
69
+ }
70
+ // 3. Populate env vars per mapping, respecting existing values
71
+ let populated = 0;
72
+ for (const [kvKey, envVar] of Object.entries(options.mapping)) {
73
+ const value = data[kvKey];
74
+ if (typeof value !== "string" || value.length === 0)
75
+ continue;
76
+ if (env[envVar] !== undefined && env[envVar] !== "")
77
+ continue;
78
+ env[envVar] = value;
79
+ populated += 1;
80
+ }
81
+ // Diagnostic only: path name + count, never values or key names.
82
+ warn(`vault loaded ${populated} value(s) from ${options.kvPath}`);
83
+ }
84
+ catch (err) {
85
+ const msg = err instanceof Error ? err.message : String(err);
86
+ warn(`vault load error for ${options.kvPath}: ${msg}`);
87
+ }
88
+ }
89
+ /** Single-line stderr diagnostic. Never writes secret values. */
90
+ function warn(msg) {
91
+ process.stderr.write(`[mcp vault-loader] ${msg}\n`);
92
+ }
93
+ //# sourceMappingURL=vault-loader.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"vault-loader.js","sourceRoot":"","sources":["../../src/config/vault-loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AA+BH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE3C,MAAM,IAAI,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAE5C,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClC,qDAAqD;QACrD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEtC,IAAI,CAAC;QACH,mBAAmB;QACnB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,wBAAwB,EAAE;YAC9D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,YAAY,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,mDAAmD,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,gBAAgB;QAChB,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,KAAK,SAAS,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE;YACjC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,4BAA4B,OAAO,CAAC,MAAM,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAqB,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,yBAAyB,OAAO,CAAC,MAAM,oBAAoB,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE;gBAAE,SAAS;YAC9D,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;QACD,iEAAiE;QACjE,IAAI,CAAC,gBAAgB,SAAS,kBAAkB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,IAAI,CAAC,wBAAwB,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;AACtD,CAAC"}
package/dist/index.js CHANGED
@@ -7,8 +7,21 @@ import { SSEServerTransport } from "@modelcontextprotocol/sdk/server/sse.js";
7
7
  import express from "express";
8
8
  import { validateTransportConfig, createAuthMiddleware } from "./transport.js";
9
9
  import { createServer } from "./server.js";
10
- const { server } = createServer();
10
+ import { loadFromVault } from "./config/vault-loader.js";
11
11
  async function main() {
12
+ // Opportunistic Vault AppRole secret loading. Silent no-op unless
13
+ // NAS_VAULT_ADDR + NAS_VAULT_ROLE_ID + NAS_VAULT_SECRET_ID are set.
14
+ // Precedence: process.env (explicit) > Vault. See src/config/vault-loader.ts.
15
+ await loadFromVault({
16
+ kvPath: "tailscale/api",
17
+ mapping: {
18
+ api_key: "TAILSCALE_API_KEY",
19
+ tailnet: "TAILSCALE_TAILNET",
20
+ },
21
+ });
22
+ // createServer() reads env synchronously via createClientFromEnv(),
23
+ // so it MUST be called AFTER loadFromVault() populates process.env.
24
+ const { server } = createServer();
12
25
  const config = validateTransportConfig(process.env);
13
26
  if (config.mode === "stdio") {
14
27
  const transport = new StdioServerTransport();
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;AAElC,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAyC,CAAC,CAAC;IAE1F,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEhD,+DAA+D;QAC/D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;QAE5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YAC3C,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAElD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YACjD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACxC,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,kEAAkE;IAClE,oEAAoE;IACpE,8EAA8E;IAC9E,MAAM,aAAa,CAAC;QAClB,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE;YACP,OAAO,EAAE,mBAAmB;YAC5B,OAAO,EAAE,mBAAmB;SAC7B;KACF,CAAC,CAAC;IAEH,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;IAElC,MAAM,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,GAAyC,CAAC,CAAC;IAE1F,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAEhD,+DAA+D;QAC/D,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;QAE5D,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YAC3C,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YAC3D,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;YAElD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YAC5C,CAAC,CAAC,CAAC;YAEH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAQ,EAAE,GAAQ,EAAE,EAAE;YACjD,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,SAAmB,CAAC;YAChD,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YACD,MAAM,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;YACxC,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
package/dist/server.d.ts CHANGED
@@ -15,7 +15,7 @@ export interface CreateServerOptions {
15
15
  middleware?: ToolMiddleware;
16
16
  /** Server name (default: "mcp-tailscale") */
17
17
  name?: string;
18
- /** Server version (default: "2026.3.18") */
18
+ /** Server version (default: "2026.4.9-1") */
19
19
  version?: string;
20
20
  }
21
21
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwB9D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,8BAA8B;IAC9B,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,kBAAkB,CAgFpB"}
1
+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAKnE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAC;AAC/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAwB9D;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,8EAA8E;IAC9E,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,+BAA+B;IAC/B,MAAM,EAAE,gBAAgB,CAAC;IACzB,8BAA8B;IAC9B,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACxC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAC1B,OAAO,CAAC,EAAE,mBAAmB,GAC5B,kBAAkB,CAgFpB"}
package/dist/server.js CHANGED
@@ -32,7 +32,7 @@ import { postureToolDefinitions, handlePostureTool, } from "./tools/posture.js";
32
32
  * });
33
33
  */
34
34
  export function createServer(options) {
35
- const { middleware, name = "mcp-tailscale", version = "2026.3.18", } = options ?? {};
35
+ const { middleware, name = "mcp-tailscale", version = "2026.4.9-1", } = options ?? {};
36
36
  // Assemble all tool definitions
37
37
  const allToolDefinitions = [
38
38
  ...deviceToolDefinitions,
@@ -1 +1 @@
1
- {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AA4B5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA6B;IAE7B,MAAM,EACJ,UAAU,EACV,IAAI,GAAG,eAAe,EACtB,OAAO,GAAG,WAAW,GACtB,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,gCAAgC;IAChC,MAAM,kBAAkB,GAAW;QACjC,GAAG,qBAAqB;QACxB,GAAG,kBAAkB;QACrB,GAAG,kBAAkB;QACrB,GAAG,kBAAkB;QACrB,GAAG,sBAAsB;QACzB,GAAG,0BAA0B;QAC7B,GAAG,mBAAmB;QACtB,GAAG,sBAAsB;QACzB,GAAG,sBAAsB;KACL,CAAC;IAEvB,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,qBAAqB;QACrC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,0BAA0B;QAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,mBAAmB;QACnC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEhD,8BAA8B;IAC9B,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IAErC,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,6BAA6B;IAC7B,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,kBAAkB;KAC1B,CAAC,CAAC,CAAC;IAEJ,wDAAwD;IACxD,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,QAAQ,EAAE,EAAE;iBAC7D;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAE1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AAC9D,CAAC"}
1
+ {"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EACL,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGjE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AA4B5B;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA6B;IAE7B,MAAM,EACJ,UAAU,EACV,IAAI,GAAG,eAAe,EACtB,OAAO,GAAG,YAAY,GACvB,GAAG,OAAO,IAAI,EAAE,CAAC;IAElB,gCAAgC;IAChC,MAAM,kBAAkB,GAAW;QACjC,GAAG,qBAAqB;QACxB,GAAG,kBAAkB;QACrB,GAAG,kBAAkB;QACrB,GAAG,kBAAkB;QACrB,GAAG,sBAAsB;QACzB,GAAG,0BAA0B;QAC7B,GAAG,mBAAmB;QACtB,GAAG,sBAAsB;QACzB,GAAG,sBAAsB;KACL,CAAC;IAEvB,yBAAyB;IACzB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAEpD,KAAK,MAAM,GAAG,IAAI,qBAAqB;QACrC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,kBAAkB;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,0BAA0B;QAC1C,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,mBAAmB;QACnC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,sBAAsB;QACtC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAEhD,8BAA8B;IAC9B,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IAErC,oBAAoB;IACpB,MAAM,MAAM,GAAG,IAAI,MAAM,CACvB,EAAE,IAAI,EAAE,OAAO,EAAE,EACjB,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;IAEF,6BAA6B;IAC7B,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;QAC5D,KAAK,EAAE,kBAAkB;KAC1B,CAAC,CAAC,CAAC;IAEJ,wDAAwD;IACxD,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3D,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,iBAAiB,QAAQ,EAAE,EAAE;iBAC7D;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QAE1D,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,OAAO,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,YAAY,EAAE,CAAC;AAC9D,CAAC"}
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "tailscale-mcp",
3
3
  "mcpName": "io.github.itunified-io/tailscale",
4
- "version": "2026.3.18",
4
+ "version": "2026.4.9-1",
5
5
  "description": "Secure MCP access for private infrastructure over Tailscale — 49 tools for devices, DNS, ACL, keys, users, webhooks, posture, and tailnet management via Tailscale API v2",
6
6
  "type": "module",
7
7
  "main": "dist/index.js",