The Tailscale connector lets your AI agent act in each user's Tailscale account. Each user connects their own Tailscale access token once, and Scalekit sends it with every call, so your agent never handles credentials. It comes with 41 tools.
- Tools
- 41
- What they doRead · write · destructive
- 22 · 16 · 322 read16 write3 destructive
- Users sign in with
- Access token
Setup
Install the SDK
Terminal window npm install @scalekit-sdk/node dotenvTerminal window pip install scalekit-sdk-python python-dotenvSet your credentials
Add your Scalekit credentials to your
.envfile. Find values in app.scalekit.com > Developers > API Credentials..env SCALEKIT_ENVIRONMENT_URL=<your-environment-url>SCALEKIT_CLIENT_ID=<your-client-id>SCALEKIT_CLIENT_SECRET=<your-client-secret>Create the Tailscale connection
In AgentKit > Connections, create a Tailscale connection. The name you give it is the
connection_nameyour code passes. See Configure connections.Authorize a user and make your first call
quickstart.mts import { ScalekitClient } from '@scalekit-sdk/node'import 'dotenv/config'import { createInterface } from 'node:readline/promises'const scalekit = new ScalekitClient(process.env.SCALEKIT_ENVIRONMENT_URL,process.env.SCALEKIT_CLIENT_ID,process.env.SCALEKIT_CLIENT_SECRET,)const actions = scalekit.actionsconst connector = 'tailscale'const identifier = 'user_123'// Generate an authorization link for the userconst { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier })console.log('Authorize Tailscale:', link)const rl = createInterface({ input: process.stdin, output: process.stdout })await rl.question('Press Enter after authorizing...')rl.close()// Make your first callconst result = await actions.executeTool({connector,identifier,toolName: 'tailscale_get_contacts',toolInput: {},})console.log(result)Terminal window npx tsx quickstart.mtsquickstart.py import osfrom scalekit import ScalekitClientfrom dotenv import load_dotenvload_dotenv()scalekit_client = ScalekitClient(env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),client_id=os.getenv("SCALEKIT_CLIENT_ID"),client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"),)actions = scalekit_client.actionsconnection_name = "tailscale"identifier = "user_123"# Generate an authorization link for the userlink_response = actions.get_authorization_link(connection_name=connection_name,identifier=identifier,)print("Authorize Tailscale:", link_response.link)input("Press Enter after authorizing...")# Make your first callresult = actions.execute_tool(tool_input={},tool_name="tailscale_get_contacts",connection_name=connection_name,identifier=identifier,)print(result)Terminal window python quickstart.pyEach user opens the link once and enters their Tailscale credentials there. See Authorize a user for the full flow and statuses.
Tools
Pass the exact name toexecute_tooltailscale_get_configuration_audit_logsRetrieve configuration audit log entries, the record of admin changes to a tailnet, for a time window.Read-onlyGet Configuration Audit Logs
Retrieve configuration audit log entries, the record of admin changes to a tailnet, for a time window. Returns a logs array with one entry per configuration change, including when it happened, who made it and what changed. Use get_configuration_audit_logs to see who changed settings, ACLs or devices. Use get_network_flow_logs for traffic data.
Inputs
endstringrequired- End Time as an RFC 3339 timestamp, for example '2026-10-01T00:00:00Z'. Logs older than the retention window (30 days) are trimmed to the window.
startstringrequired- Start Time as an RFC 3339 timestamp, for example '2026-10-01T00:00:00Z'. Logs older than the retention window (30 days) are trimmed to the window.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_contactsRetrieve the account, support and security contact emails of a tailnet.Read-onlyGet Contacts
Retrieve the account, support and security contact emails of a tailnet. Returns account, support and security objects, each with email, fallbackEmail and needsVerification. Use get_contacts to read contact emails. Use update_contact to change one.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_deviceRetrieve the details of one device, including addresses, tags, OS, client version, key expiry and connection state.Read-onlyGet Device
Retrieve the details of one device, including addresses, tags, OS, client version, key expiry and connection state. Returns the device object; pass fields=all to also include enabledRoutes, advertisedRoutes, clientConnectivity and postureIdentity. Use get_device when you already know the device ID. Use list_devices to discover IDs.
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
fieldsstring- Which fields to return: 'default' omits routes, clientConnectivity and postureIdentity; 'all' returns every field.one of
defaultall
tailscale_get_device_routesRetrieve the subnet routes a device advertises and the subset that is enabled.Read-onlyGet Device Routes
Retrieve the subnet routes a device advertises and the subset that is enabled. Returns advertisedRoutes and enabledRoutes, each an array of CIDR strings. Use get_device_routes before set_device_routes to see which advertised routes still need approval.
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
tailscale_get_dns_configurationRetrieve the full DNS configuration of a tailnet in one call.Read-onlyGet DNS Configuration
Retrieve the full DNS configuration of a tailnet in one call. Returns nameservers, splitDNS, searchPaths and preferences (including magicDNS and overrideLocalDNS). Use get_dns_configuration for a complete snapshot. Use the narrower get_dns_nameservers, get_split_dns or get_dns_search_paths for one part.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_dns_nameserversRetrieve the global DNS nameservers configured for a tailnet.Read-onlyGet DNS Nameservers
Retrieve the global DNS nameservers configured for a tailnet. Returns dns (an array of nameserver IP addresses) and magicDNS (whether MagicDNS is on). Use get_dns_nameservers to read the global resolvers. Use get_split_dns for per-domain resolvers.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_dns_preferencesRetrieve the DNS preferences of a tailnet.Read-onlyGet DNS Preferences
Retrieve the DNS preferences of a tailnet. Returns magicDNS, a boolean that says whether MagicDNS is enabled. Use get_dns_preferences to check MagicDNS. Use set_dns_preferences to change it.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_dns_search_pathsRetrieve the DNS search paths configured for a tailnet.Read-onlyGet DNS Search Paths
Retrieve the DNS search paths configured for a tailnet. Returns searchPaths, an array of domain suffixes. Use get_dns_search_paths to read the search domains. Use set_dns_search_paths to change them.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_keyRetrieve the details of one auth key, API access token or OAuth client.Read-onlyGet Key
Retrieve the details of one auth key, API access token or OAuth client. Returns id, description, created, expires, revoked, invalid and capabilities; the secret key value is never returned after creation. Use get_key when you know the key ID. Use list_keys to discover IDs.
Inputs
key_idstringrequired- ID of the key, as returned by list_keys or create_auth_key, for example 'kABC123CNTRL'.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_network_flow_logsRetrieve network flow log entries for a time window.Read-onlyGet Network Flow Logs
Retrieve network flow log entries for a time window. Network flow logging must be enabled for the tailnet. Returns a logs array; each entry has logged, nodeId, start, end, virtualTraffic, subnetTraffic, exitTraffic and physicalTraffic. Use get_network_flow_logs to inspect traffic between devices. Use get_configuration_audit_logs for admin changes. Large windows return a lot of data, so keep the range short.
Inputs
endstringrequired- End Time as an RFC 3339 timestamp, for example '2026-10-01T00:00:00Z'. Logs older than the retention window (30 days) are trimmed to the window.
startstringrequired- Start Time as an RFC 3339 timestamp, for example '2026-10-01T00:00:00Z'. Logs older than the retention window (30 days) are trimmed to the window.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_policy_fileRetrieve the tailnet's current access control policy file as JSON.Read-onlyGet Policy File
Retrieve the tailnet's current access control policy file as JSON. Returns the policy object with sections such as acls, grants, groups, hosts, tagOwners, autoApprovers, ssh and tests; with details=true the response also lists warnings and errors. Use get_policy_file to read the current policy before changing it with update_policy_file.
Inputs
detailsboolean- Set to true to also return warnings and errors found in the policy file, such as references to users that no longer exist.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_split_dnsRetrieve the split DNS settings of a tailnet, the map from domain to the nameservers that resolve it.Read-onlyGet Split DNS
Retrieve the split DNS settings of a tailnet, the map from domain to the nameservers that resolve it. Returns an object whose keys are domains and whose values are arrays of nameserver addresses. Use get_split_dns to read per-domain resolvers. Use get_dns_nameservers for the global resolvers.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_tailnet_settingsRetrieve the settings of a tailnet such as device approval, key expiry duration, auto updates and HTTPS.Read-onlyGet Tailnet Settings
Retrieve the settings of a tailnet such as device approval, key expiry duration, auto updates and HTTPS. Returns fields including devicesApprovalOn, devicesAutoUpdatesOn, devicesKeyDurationDays, usersApprovalOn, networkFlowLoggingOn, httpsEnabled and routeSelection. Use get_tailnet_settings to read configuration. Use update_tailnet_settings to change it.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_get_userRetrieve one user's profile, role, status and device count.Read-onlyGet User
Retrieve one user's profile, role, status and device count. Returns id, displayName, loginName, role, status, type, tailnetId, deviceCount, created, lastSeen and currentlyConnected. Use get_user when you know the user ID. Use list_users to find IDs.
Inputs
user_idstringrequired- ID of the user, as returned by list_users, for example 'u123456CNTRL'.
tailscale_get_user_inviteRetrieve one user invitation.Read-onlyGet User Invite
Retrieve one user invitation. Returns id, role, email, tailnetId, inviterId, lastEmailSentAt and inviteUrl when present. Use get_user_invite when you know the invite ID. Use list_user_invites to find IDs.
Inputs
user_invite_idstringrequired- ID of the user invite, as returned by list_user_invites or create_user_invites, for example '29214'.
tailscale_list_devicesList every device in a tailnet with its addresses, hostname, OS, tags, authorization state and last-seen time.Read-onlyList Devices
List every device in a tailnet with its addresses, hostname, OS, tags, authorization state and last-seen time. Returns a devices array; each entry has id, nodeId, name, hostname, addresses, user, tags, os, clientVersion, authorized, lastSeen and keyExpiryDisabled. Use list_devices to browse or find a device ID. Use get_device for one device's full details.
Inputs
fieldsstring- Which device fields to return: 'default' omits enabledRoutes, advertisedRoutes, clientConnectivity and postureIdentity; 'all' returns every field.one of
defaultall tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_list_keysList the auth keys, API access tokens and OAuth clients in a tailnet.Read-onlyList Keys
List the auth keys, API access tokens and OAuth clients in a tailnet. Returns a keys array of entries with id and, depending on the key, description, created, expires and capabilities. Use list_keys to find a key ID. Use get_key for the full details of one key.
Inputs
allboolean- Set to true to list keys for every user in the tailnet instead of only keys owned by the token's user. Requires an admin token.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_list_user_invitesList the open invitations that let people join a tailnet.Read-onlyList User Invites
List the open invitations that let people join a tailnet. Returns an array of invites; each has id, role, email, inviterId, lastEmailSentAt and, when applicable, inviteUrl. Use list_user_invites to find an invite ID. Use create_user_invites to send new invitations.
Inputs
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_list_usersList the users in a tailnet, optionally filtered by type or role.Read-onlyList Users
List the users in a tailnet, optionally filtered by type or role. Returns a users array; each entry has id, displayName, loginName, role, status, type, deviceCount, created and lastSeen. Use list_users to browse or find a user ID. Use get_user for one user.
Inputs
rolestring- Only return users with this role: owner, member, admin, it-admin, network-admin, billing-admin or auditor.one of
ownermemberadminit-adminnetwork-adminbilling-adminauditor tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
- typestring- Only return users of this type: 'member' for users that belong to the tailnet, or 'shared' for users with access through device sharing.one of
membershared
tailscale_preview_policy_rule_matchesShow which rules in a policy file apply to a given user or to an IP address and port, without saving the policy.Read-onlyPreview Policy Rule Matches
Show which rules in a policy file apply to a given user or to an IP address and port, without saving the policy. Returns matches (each with users, ports and lineNumber) plus the type and previewFor values echoed back. Use preview_policy_rule_matches to see the effect of a draft policy. Use validate_policy_file to check a policy for errors.
Inputs
policyobjectrequired- The complete tailnet policy file as a JSON object, using the same sections as the admin console policy editor such as acls, grants, groups, hosts, tagOwners, autoApprovers, ssh, nodeAttrs and tests. Example: {"acls": [{"action": "accept", "src": ["*"], "dst": ["*:*"]}]}. It is evaluated but not saved.
preview_forstringrequired- The value to match rules against: a user's email such as 'user1@example.com' when type is 'user', or an IP and port such as '10.0.0.1:80' when type is 'ipport'.
typestringrequired- Kind of value given in preview_for: 'user' for a user's email or 'ipport' for an IP address and port.one of
useripport tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_run_policy_testsRun access tests against the tailnet's current saved policy file without changing it.Read-onlyRun Policy Tests
Run access tests against the tailnet's current saved policy file without changing it. Returns an empty body or an object without a message when every test passes; otherwise an object with a message and a data array naming the failing tests. Use run_policy_tests to check expected allow and deny outcomes. Use validate_policy_file to test a draft policy instead.
Inputs
testsarrayrequired- List of access tests to run, each an object with src and the accept and/or deny destinations, for example [{"src": "user1@example.com", "accept": ["example-host-1:22"], "deny": ["example-host-2:100"]}].
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_validate_policy_fileCheck that a draft policy file parses and passes its own tests, without saving it.Read-onlyValidate Policy File
Check that a draft policy file parses and passes its own tests, without saving it. Returns an empty body or an object without a message when the policy is valid; otherwise an object with a message and a data array describing the errors, warnings or failing tests. Use validate_policy_file before update_policy_file. Use run_policy_tests to test the current saved policy instead.
Inputs
policyobjectrequired- The complete tailnet policy file as a JSON object, using the same sections as the admin console policy editor such as acls, grants, groups, hosts, tagOwners, autoApprovers, ssh, nodeAttrs and tests. Example: {"acls": [{"action": "accept", "src": ["*"], "dst": ["*:*"]}]}. It is validated but not saved.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_create_auth_keyCreate an auth key that lets new devices join the tailnet.WriteCreate Auth Key
Create an auth key that lets new devices join the tailnet. Returns the new key's id, the secret key value (shown only once), created and expires times, and the capabilities granted. Use create_auth_key to onboard devices or CI jobs. Use delete_key to revoke a key. Store the returned key securely; it cannot be retrieved again.
Inputs
descriptionstring- Short note on what the key is for, up to 50 letters, digits, spaces or hyphens, for example 'ci-runner-key'.
ephemeralboolean- Set to true if devices registered with this key are ephemeral and are removed automatically after going offline.default
false expiry_secondsinteger- Seconds until the key expires, for example 86400 for one day. Defaults to 90 days when omitted.
preauthorizedboolean- Set to true if devices registered with this key skip manual approval when device approval is enabled.default
false reusableboolean- Set to true if the key can register more than one device. Defaults to a single-use key.default
false tagsarray- Tags applied to devices that register with this key, for example ["tag:ci"]. Each tag must start with 'tag:' and be owned in the policy file. Required when the token comes from an OAuth client.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_create_user_invitesInvite one person to join the tailnet with a chosen role, by email or as a shareable link.WriteCreate User Invite
Invite one person to join the tailnet with a chosen role, by email or as a shareable link. Returns an array with the created invite: id, role, email, tailnetId, inviterId, lastEmailSentAt and inviteUrl when no email was sent or the email is outside the tailnet domain. Use create_user_invites to onboard users. Use delete_user_invite to withdraw an invitation.
Inputs
emailstring- Email address to send the invite to, for example 'user@example.com'. If left blank no email is sent and the response contains an invite URL to share manually.
rolestring- Role the invited user receives when they accept: member, admin, it-admin, network-admin, billing-admin or auditor. Defaults to member.one of
memberadminit-adminnetwork-adminbilling-adminauditor tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_expire_device_keyExpire a device's node key so the device must re-authenticate before it can use the tailnet again.WriteExpire Device Key
Expire a device's node key so the device must re-authenticate before it can use the tailnet again. Returns an empty JSON object on success. Use expire_device_key to force a device to log in again. Use delete_device to remove the device entirely.
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
tailscale_rename_deviceSet the machine name of a device, which becomes its MagicDNS name.WriteRename Device
Set the machine name of a device, which becomes its MagicDNS name. Returns an empty JSON object on success. Use rename_device to change a device's name. Names must be valid DNS labels.
- Idempotent
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
namestringrequired- New machine name for the device, a valid DNS label such as 'web-server-1'. Do not include the tailnet domain suffix.
tailscale_set_device_keyTurn node key expiry on or off for a device.WriteUpdate Device Key Settings
Turn node key expiry on or off for a device. Returns an empty JSON object on success. Use set_device_key to stop a device's key from ever expiring or to restore expiry. Use expire_device_key to expire the key now.
- Idempotent
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
key_expiry_disabledbooleanrequired- Set to true so the device's key never expires, or false to re-enable key expiry.
tailscale_set_device_routesSet which of a device's advertised subnet routes are enabled.WriteSet Device Routes
Set which of a device's advertised subnet routes are enabled. The list replaces the current enabled routes; an empty list disables all. Returns advertisedRoutes and enabledRoutes after the change. Use set_device_routes to approve or revoke subnet routes. Use get_device_routes to read the current state first. Routes must already be advertised by the device.
- Idempotent
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
routesarrayrequired- Complete list of subnet routes to enable, as CIDR strings, for example ["10.0.0.0/16", "192.168.1.0/24"]. Routes not in this list become disabled; pass an empty array to disable all routes.
tailscale_set_dns_nameserversReplace the global DNS nameservers for a tailnet.WriteSet DNS Nameservers
Replace the global DNS nameservers for a tailnet. An empty list removes them. Returns dns (the nameservers now set) and magicDNS (whether MagicDNS is on). Use set_dns_nameservers to change global resolvers. Use update_split_dns or set_split_dns for per-domain resolvers. Removing all nameservers automatically turns MagicDNS off.
- Idempotent
Inputs
dnsarrayrequired- Complete list of nameserver IP addresses to use, for example ["8.8.8.8", "1.1.1.1"]. An empty array clears the list.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_set_dns_preferencesTurn MagicDNS on or off for a tailnet.WriteSet DNS Preferences
Turn MagicDNS on or off for a tailnet. Returns magicDNS with the new status. Use set_dns_preferences to toggle MagicDNS. Turning it on fails unless at least one global nameserver is set.
- Idempotent
Inputs
magic_dnsbooleanrequired- Set to true to enable MagicDNS or false to disable it.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_set_dns_search_pathsReplace the DNS search paths for a tailnet.WriteSet DNS Search Paths
Replace the DNS search paths for a tailnet. An empty list clears them. Returns searchPaths, the search domains now set. Use set_dns_search_paths to change search domains. Use get_dns_search_paths to read them first.
- Idempotent
Inputs
search_pathsarrayrequired- Complete list of DNS search domains, for example ["corp.example.com", "example.net"]. An empty array clears the list.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_set_split_dnsReplace the entire split DNS map of a tailnet.WriteSet Split DNS
Replace the entire split DNS map of a tailnet. Domains you leave out are removed. Returns the split DNS map now in effect. Use set_split_dns to overwrite all split DNS settings. Use update_split_dns to change only some domains.
- Idempotent
Inputs
split_dnsobjectrequired- Object mapping each domain to the list of nameserver IP addresses that should resolve it, for example {"internal.example.com": ["10.0.0.2"], "corp.example.net": ["10.0.0.3", "10.0.0.4"]}. This replaces all existing split DNS settings; an empty object removes them.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_update_contactChange the email address for one of a tailnet's contacts.WriteUpdate Contact
Change the email address for one of a tailnet's contacts. A changed address is emailed a verification link. Returns an empty JSON object on success. Use update_contact to set the account, support or security contact. Use get_contacts to read current values.
- Idempotent
Inputs
contact_typestringrequired- Which contact to change: 'account' for billing and account notices, 'support' for support updates, or 'security' for security notices.one of
accountsupportsecurity emailstringrequired- New email address for the contact, for example 'security@example.com'.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_update_policy_fileReplace the tailnet's entire access control policy file.WriteUpdate Policy File
Replace the tailnet's entire access control policy file. Sections you leave out are removed. Returns the saved policy as JSON; the call fails if the policy is malformed or its tests fail. Use update_policy_file to change access rules. Call get_policy_file first and send back the full edited policy. Use validate_policy_file to check a policy without saving it.
- Idempotent
Inputs
policyobjectrequired- The complete tailnet policy file as a JSON object, using the same sections as the admin console policy editor such as acls, grants, groups, hosts, tagOwners, autoApprovers, ssh, nodeAttrs and tests. Example: {"acls": [{"action": "accept", "src": ["*"], "dst": ["*:*"]}]}. This object fully replaces the existing policy file.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_update_split_dnsChange split DNS for only the domains you name, leaving other domains untouched.WriteUpdate Split DNS
Change split DNS for only the domains you name, leaving other domains untouched. A null value for a domain clears its nameservers. Returns the full split DNS map after the update. Use update_split_dns for partial changes. Use set_split_dns to replace the whole map.
- Idempotent
Inputs
split_dnsobjectrequired- Object mapping each domain to the list of nameserver IP addresses that should resolve it, for example {"internal.example.com": ["10.0.0.2"], "corp.example.net": ["10.0.0.3", "10.0.0.4"]}. Set a domain to null to clear its nameservers.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_update_tailnet_settingsChange one or more tailnet settings.WriteUpdate Tailnet Settings
Change one or more tailnet settings. Settings you leave blank stay as they are. Returns an empty JSON object on success. Use update_tailnet_settings to turn device approval, auto updates, flow logging or HTTPS on or off, or to change the key expiry duration. Call get_tailnet_settings first to see current values.
- Idempotent
Inputs
devices_approval_onboolean- Set to true to require an admin to approve new devices, or false to let them join freely.
devices_auto_updates_onboolean- Set to true to turn on automatic Tailscale client updates for devices, or false to turn them off.
devices_key_duration_daysinteger- Number of days before a device's node key expires, for example 90.
https_enabledboolean- Set to true to enable HTTPS certificates for the tailnet, or false to disable them.
network_flow_logging_onboolean- Set to true to turn on network flow logging for the tailnet, or false to turn it off.
posture_identity_collection_onboolean- Set to true to let devices report posture identity such as serial numbers, or false to stop collection.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
- users_approval_onboolean- Set to true to require an admin to approve new users, or false to let them join freely.
tailscale_delete_deviceRemove a device from its tailnet.DestructiveDelete Device
Remove a device from its tailnet. The device must re-authenticate to rejoin. Returns an empty JSON object on success. Use delete_device to permanently remove a device. Use expire_device_key to force re-authentication while keeping the device entry.
- Idempotent
Inputs
device_idstringrequired- ID of the device. The preferred form is the node ID returned as nodeId by the list devices tool (for example 'nABC123CNTRL'); the legacy numeric id (for example '12345') also works.
tailscale_delete_keyRevoke and delete an auth key, API access token or OAuth client.DestructiveDelete Key
Revoke and delete an auth key, API access token or OAuth client. Returns an empty JSON object on success. Use delete_key to revoke a key permanently. Devices already registered with the key are not removed.
- Idempotent
Inputs
key_idstringrequired- ID of the key to delete, as returned by list_keys, for example 'kABC123CNTRL'.
tailnetstring- Tailnet to operate on. Use '-' (a dash) for the default tailnet of the connected API token, or pass the organization name shown on the Tailscale admin console General settings page, for example 'example.com' or 'alice@gmail.com'.default
-
tailscale_delete_user_inviteWithdraw a pending user invitation so it can no longer be accepted.DestructiveDelete User Invite
Withdraw a pending user invitation so it can no longer be accepted. Returns an empty JSON object on success. Use delete_user_invite to cancel an invite. Use list_user_invites to find the ID.
- Idempotent
Inputs
user_invite_idstringrequired- ID of the user invite to delete, as returned by list_user_invites, for example '29214'.
No tools match.
