MCP (Model Context Protocol) 서버는 독립적으로 Tailscale 및 가늠구멍 서비스를 가능하게 합니다. /tailscale/mcp]; 가늠구멍 윤곽과 가격 관리는 /aperture/mcp]에 있는 opt-in입니다. Enabled 서비스는 Streamable HTTP 포트를 공유하고 고급 액세스 제어를위한 Tailscale 보조금을 사용합니다.

특징

• Streamable HTTP Transport: Serves /tailscale/mcp 및 opt-in /aperture/mcp]과 같은 청취자 및 포트를 통해 tailscale, 옵션 HTTPS 및 별도의 선택 루프백 HTTP
• **Comprehensive Tailscale 통합 **: 공급 업체의 풀 매핑 된 Tailscale OpenAPI 스냅 샷
• **Opt-In 가늠구멍 통합 **: 구성 교체를 위한 명시한 확인 및 ETag 보호와 더불어 5가지 유형의 구성과 가격 공구를 위한 --aperture에 사용 가능 *Alpha 조직 APIs: 목록 조직 tailnets, API-only tailnets를 만들고, 감시한 공구를 가진 명시적으로 형성된 tailnet만 삭제하십시오
• **OAuth Grants Authorization **: jaxxstorm.com/cap/mcp를 가진 정밀한 곡물 MCP 접근 제한

Tailscale MCP Server

An MCP (Model Context Protocol) server with independently enabled Tailscale and Aperture services. Tailscale defaults to enabled at /tailscale/mcp; Aperture configuration and pricing management is opt-in at /aperture/mcp. Enabled services share Streamable HTTP ports and use Tailscale grants for fine-grained access control.

Features

• Streamable HTTP Transport: Serves /tailscale/mcp and opt-in /aperture/mcp on the same listener and port via Tailscale, with optional HTTPS and separately opt-in loopback HTTP
• Comprehensive Tailscale Integration: Full mapped coverage of the vendored Tailscale OpenAPI snapshot
• Opt-In Aperture Integration: Enable with --aperture for five typed configuration and pricing tools, with explicit confirmation and ETag protection for configuration replacement
• Alpha Organization APIs: List organization tailnets, create API-only tailnets, and delete only the explicitly configured tailnet with guarded tools
• OAuth Grants Authorization: Fine-grained MCP access control with jaxxstorm.com/cap/mcp
• Single Credential Startup: Uses TAILSCALE_OAUTH_TOKEN for tsnet startup and, when Tailscale MCP is enabled, Admin API access
• Workload Identity: Explicit Kubernetes projected-token, AWS STS, and GCP attached-service-account providers, with legacy inline/file federation and OAuth credentials preserved
• Configurable tsnet State: Stores tsnet state on the filesystem by default, with optional Kubernetes Secret or AWS SSM state stores
• Legacy stdio Compatibility: Deprecated Tailscale-only stdio mode remains available for older local clients; Aperture requires HTTP

Quick Start

export TAILSCALE_OAUTH_TOKEN='{"type":"oauth","clientId":"k123...","clientSecret":"tskey-client-...","scopes":["all"]}'
export TAILSCALE_TAILNET="yourtailnet.com"
export TS_ADVERTISE_TAGS="tag:mcp-server"
./ts-mcp

You can also provide the OAuth client ID separately:

export TAILSCALE_OAUTH_TOKEN="tskey-client-..."
export TAILSCALE_OAUTH_CLIENT_ID="k123..."
export TAILSCALE_TAILNET="yourtailnet.com"
export TS_ADVERTISE_TAGS="tag:mcp-server"
./ts-mcp

The default endpoint is http://.yourtailnet.ts.net:8080/tailscale/mcp; no loopback listener opens by default. Enable Aperture with --aperture=true (or --aperture) to also serve http://.yourtailnet.ts.net:8080/aperture/mcp. Use --tls for tailnet HTTPS (default port 443 for enabled paths, requiring tailnet HTTPS support). Certificate issuance can publish the node’s DNS name in certificate transparency logs.