MCP server for Tailscale network monitoring and security — devices, ACLs, DNS, keys, users, audit logs
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"tailscale-blade-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# tailscale-blade-mcp An MCP server that gives AI agents structured access to Tailscale tailnets. Built for the [Model Context Protocol](https://modelcontextprotocol.io) with security visibility and token efficiency as first-class design goals. ## Why this exists Tailscale exposes a clean REST API (v2) for managing devices, ACL policies, DNS, auth keys, users, and audit logs. This MCP wraps it with the guardrails that automated agents need: - **Security-first tool set** — 19 tools focused on what network security agents actually need: device inventory, key expiry auditing, ACL review + apply, route approval, DNS hygiene. Not a thin wrapper around every endpoint. - **Token-efficient output** — compact pipe-delimited format. A 20-device tailnet in ~40 tokens per device. Devices flagged with `KEY_EXPIRY_OFF`, `KEY_EXPIRED`, `UPDATE_AVAILABLE`, `UNAUTHORIZED`, `OFFLINE` at a glance. - **Write-gated mutations** — device authorization, tagging, key management, route approval, and ACL apply require explicit opt-in via `TAILSCALE_WRITE_ENABLED=true`. Destructive operations (delete device, revoke key) additionally require per-call `confirm=true`; ACL apply defaults to optimistic-concurrency (`If-Match`) so it won't silently clobber a concurrent edit. - **SecOps visibility** — ACL policy summary shows groups, rules, SSH rules, and tag owners. Audit log shows who changed what. Key listing flags reusable keys and expiry status. ## How this differs from other Tailscale MCPs | | tailscale-blade-mcp | HexSleeves/tailscale-mcp | jaxxstorm/tailscale-mcp | |---|---|---|---| | **Focus** | Monitoring + security (19 tools) | Management (~15 tools) | Read-only (~5 tools) | | **Design for** | LLM agents (token-efficient) | Claude Code | General MCP | | **Output** | Pipe-delimited, compact | Full JSON | Full JSON | | **Write safety** | Dual-gated (env + confirm) | Direct writes | Read-only | | **Audit log** | Yes | No | No | | **ACL summary** | Parsed groups/rules/SSH/tags | Raw JSO…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.