一台MCP（模型上下文协议）服务器，独立启用了Tailscale和Aperture服务。Tailscale默认在/tailscale/mcp启用;Aperture配置和定价管理在/aperture/mcp时选择加入。启用的服务共享可流式HTTP端口，并使用Tailscale授权进行细粒度访问控制。

特色

• 可流式HTTP传输：通过Tailscale在同一监听器和端口上提供/tailscale/mcp]和选择加入/aperture/mcp]，并可选HTTPS和单独选择加入的回环HTTP
• 全面的Tailscale集成：供应商Tailscale OpenAPI快照的完整映射覆盖
• 选择加入光圈集成：启用--aperture，支持五种类型配置和定价工具，明确确认和ETag保护以替换配置
• Alpha 组织 API：列出组织尾网，创建仅支持 API 的尾网，并仅删除带有保护工具的显式配置尾网
• OAuth 授予授权：带有[[T5]的细粒度MCP访问控制

Tailscale MCP Server

An MCP (Model Context Protocol) server with independently enabled Tailscale and Aperture services. Tailscale defaults to enabled at /tailscale/mcp; Aperture configuration and pricing management is opt-in at /aperture/mcp. Enabled services share Streamable HTTP ports and use Tailscale grants for fine-grained access control.

Features

• Streamable HTTP Transport: Serves /tailscale/mcp and opt-in /aperture/mcp on the same listener and port via Tailscale, with optional HTTPS and separately opt-in loopback HTTP
• Comprehensive Tailscale Integration: Full mapped coverage of the vendored Tailscale OpenAPI snapshot
• Opt-In Aperture Integration: Enable with --aperture for five typed configuration and pricing tools, with explicit confirmation and ETag protection for configuration replacement
• Alpha Organization APIs: List organization tailnets, create API-only tailnets, and delete only the explicitly configured tailnet with guarded tools
• OAuth Grants Authorization: Fine-grained MCP access control with jaxxstorm.com/cap/mcp
• Single Credential Startup: Uses TAILSCALE_OAUTH_TOKEN for tsnet startup and, when Tailscale MCP is enabled, Admin API access
• Workload Identity: Explicit Kubernetes projected-token, AWS STS, and GCP attached-service-account providers, with legacy inline/file federation and OAuth credentials preserved
• Configurable tsnet State: Stores tsnet state on the filesystem by default, with optional Kubernetes Secret or AWS SSM state stores
• Legacy stdio Compatibility: Deprecated Tailscale-only stdio mode remains available for older local clients; Aperture requires HTTP

Quick Start

export TAILSCALE_OAUTH_TOKEN='{"type":"oauth","clientId":"k123...","clientSecret":"tskey-client-...","scopes":["all"]}'
export TAILSCALE_TAILNET="yourtailnet.com"
export TS_ADVERTISE_TAGS="tag:mcp-server"
./ts-mcp

You can also provide the OAuth client ID separately:

export TAILSCALE_OAUTH_TOKEN="tskey-client-..."
export TAILSCALE_OAUTH_CLIENT_ID="k123..."
export TAILSCALE_TAILNET="yourtailnet.com"
export TS_ADVERTISE_TAGS="tag:mcp-server"
./ts-mcp

The default endpoint is http://.yourtailnet.ts.net:8080/tailscale/mcp; no loopback listener opens by default. Enable Aperture with --aperture=true (or --aperture) to also serve http://.yourtailnet.ts.net:8080/aperture/mcp. Use --tls for tailnet HTTPS (default port 443 for enabled paths, requiring tailnet HTTPS support). Certificate issuance can publish the node’s DNS name in certificate transparency logs.