Tailnetport

io.github.CloudCorpRecordsPublished by GitHub account CloudCorpRecordsv0.1.0Updated Nov 3, 2026

Tailscale tailnet admin via one router tool: devices, keys, ACL, DNS, and users.

VerifiedSTDIODesktop only

Overview

Tailnetport's local MCP server; no sign-in required; STDIO.

No AI overview yet: these facts come from the registry entry and the server itself.

Installation

In SourceWeft

  1. Open Tailnetport in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

tailnetport

tailnetport administers a Tailscale tailnet through a single action-router tool. One call names an action — list devices, inspect one device or its routes, read keys, the ACL policy, DNS settings or users, authorize a device, or delete one — and the router maps it to the Tailscale API v2. One binary serves a command-line interface and a stdio MCP server.

An API key is required. Set TAILSCALE_API_KEY in the environment; without it, every network action fails before a request is made. TAILSCALE_TAILNET selects the tailnet and defaults to - (the tailnet the key belongs to).

Deletion is double-gated: the delete_device action only runs when the call carries confirm: true and the environment sets TAILSCALE_ALLOW_DESTRUCTIVE=true. Either gate missing refuses the delete before any request.

Install

bash
npx @reneturcios/tailnetport devices

Or run the container image:

bash
docker run -i -e TAILSCALE_API_KEY=... ghcr.io/cloudcorprecords/tailnetport

The container defaults to the MCP server (see below). Pass CLI arguments to use it as a CLI instead.

CLI

bash
tailnetport devicestailnetport device 12345tailnetport device-routes 12345tailnetport keystailnetport acltailnetport dnstailnetport userstailnetport helptailnetport authorize-device 12345tailnetport delete-device 12345 --confirm   # also needs TAILSCALE_ALLOW_DESTRUCTIVE=true
tailnetport --version

Commands print the upstream JSON payload; help prints the local action list and makes no request. Exit codes: 0 on success, 1 when a call fails (including an upstream API error or a refused gate), 2 for usage errors.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

bash
npx -y @reneturcios/tailnetport mcp

MCP client configuration:

json
{  "mcpServers": {    "tailnetport": {      "command": "npx",      "args": ["-y", "@reneturcios/tailnetport", "mcp"],      "env": {        "TAILSCALE_API_KEY": "tskey-...",        "TAILSCALE_TAILNET": "-"      }    }  }}

Add TAILSCALE_ALLOW_DESTRUCTIVE: "true" to that env only if you want the server to be able to delete devices (each delete still needs confirm: true in the call).

Tool

One tool, tailscale, routes on its action argument:

ActionExtra inputWhat it does
devices—List devices in the tailnet.
deviceid (required)Get one device.
device_routesid (required)Get the routes advertised by one device.
keys—List API keys for the tailnet.
acl—Get the tailnet ACL policy.
dns—Get DNS nameservers and preferences for the tailnet.
users—List users in the tailnet.
help—Return the local action documentation; no API request.
authorize_deviceid (required)Authorize one device.
delete_deviceid and confirm: true (both required)Delete one device. Also requires TAILSCALE_ALLOW_DESTRUCTIVE=true.

Development

bash
npm installnpm run build   # tsc -> dist/npm test        # node test runner over test/*.test.ts, no network (fake fetch fixtures)npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Source: README.md at commit 6d9b1df

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.0LatestNov 3, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts