Yes, Tailnetport is free to use.

How do I install Tailnetport?

Tailnetport is a local plugin. Install it using npm package: @reneturcios/tailnetport and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Is Tailnetport safe to use?

Tailnetport scored 6.1/10 (moderate risk) in MCP Marketplace's automated security scan. It has 2 high or critical findings to review. It's listed, but review the security report on this page before installing.

What AI apps work with Tailnetport?

Tailnetport uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Tailnetport MCP Server

by CloudCorpRecords

Developer ToolsModerate6.1MCP RegistryLocal

Free

Server data from the Official MCP Registry

Tailscale tailnet admin via one router tool: devices, keys, ACL, DNS, and users.

About

Tailscale tailnet admin via one router tool: devices, keys, ACL, DNS, and users.

Security Report

6.1

Moderate6.1Moderate Risk

tailnetport is a Tailscale administration server that requires TAILSCALE_API_KEY before any request, sends it only as a Bearer header to api.tailscale.com, and gates the destructive delete_device action behind both confirm=true and TAILSCALE_ALLOW_DESTRUCTIVE=true. Its permissions (network_http, env_vars) match its purpose; the main caveats are that it can read sensitive tailnet data such as ACL policy and API key listings and can authorize or delete devices, so the API key should be scoped minimally. No malicious patterns, hardcoded secrets, or shell execution were found. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 2 high severity). Package verification found 1 issue.

8 files analyzed · 7 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-cloudcorprecords-tailnetport": {
      "args": [
        "-y",
        "@reneturcios/tailnetport"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

tailnetport

tailnetport administers a Tailscale tailnet through a single action-router tool. One call names an action — list devices, inspect one device or its routes, read keys, the ACL policy, DNS settings or users, authorize a device, or delete one — and the router maps it to the Tailscale API v2. One binary serves a command-line interface and a stdio MCP server.

An API key is required. Set TAILSCALE_API_KEY in the environment; without it, every network action fails before a request is made. TAILSCALE_TAILNET selects the tailnet and defaults to - (the tailnet the key belongs to).

Deletion is double-gated: the delete_device action only runs when the call carries confirm: true and the environment sets TAILSCALE_ALLOW_DESTRUCTIVE=true. Either gate missing refuses the delete before any request.

Install

npx @reneturcios/tailnetport devices

Or run the container image:

docker run -i -e TAILSCALE_API_KEY=... ghcr.io/cloudcorprecords/tailnetport

The container defaults to the MCP server (see below). Pass CLI arguments to use it as a CLI instead.

CLI

tailnetport devices
tailnetport device 12345
tailnetport device-routes 12345
tailnetport keys
tailnetport acl
tailnetport dns
tailnetport users
tailnetport help
tailnetport authorize-device 12345
tailnetport delete-device 12345 --confirm   # also needs TAILSCALE_ALLOW_DESTRUCTIVE=true

tailnetport --version

Commands print the upstream JSON payload; help prints the local action list and makes no request. Exit codes: 0 on success, 1 when a call fails (including an upstream API error or a refused gate), 2 for usage errors.

MCP server

One bin serves both faces. The mcp subcommand starts a stdio MCP server:

npx -y @reneturcios/tailnetport mcp

MCP client configuration:

{
  "mcpServers": {
    "tailnetport": {
      "command": "npx",
      "args": ["-y", "@reneturcios/tailnetport", "mcp"],
      "env": {
        "TAILSCALE_API_KEY": "tskey-...",
        "TAILSCALE_TAILNET": "-"
      }
    }
  }
}

Add TAILSCALE_ALLOW_DESTRUCTIVE: "true" to that env only if you want the server to be able to delete devices (each delete still needs confirm: true in the call).

Tool

One tool, tailscale, routes on its action argument:

Action	Extra input	What it does
`devices`	—	List devices in the tailnet.
`device`	`id` (required)	Get one device.
`device_routes`	`id` (required)	Get the routes advertised by one device.
`keys`	—	List API keys for the tailnet.
`acl`	—	Get the tailnet ACL policy.
`dns`	—	Get DNS nameservers and preferences for the tailnet.
`users`	—	List users in the tailnet.
`help`	—	Return the local action documentation; no API request.
`authorize_device`	`id` (required)	Authorize one device.
`delete_device`	`id` and `confirm: true` (both required)	Delete one device. Also requires `TAILSCALE_ALLOW_DESTRUCTIVE=true`.

Development

npm install
npm run build   # tsc -> dist/
npm test        # node test runner over test/*.test.ts, no network (fake fetch fixtures)
npm run dev     # run the CLI from source via tsx

License

MIT — see LICENSE.

Reviews

No reviews yet

Be the first to review this server!

4.8

Local

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.