Read devices, users, keys, ACLs and DNS for a tailnet; manage devices, routes and auth keys. Hosted by usefulapi: connect it to Claude, ChatGPT, Cursor or any MCP client.
Turn on the Tailscale connector, then ask in plain words. The AI picks the tools.
For IT admins and DevOps teams who run their network with Tailscale.
The AI lists the devices in the tailnet with OS, addresses, tags and last seen time. It picks out stale ones and groups them by OS or tag.
The AI lists the users and their roles, and the auth keys and API tokens with expiry. You see which keys end soon.
The AI reads the policy file, DNS nameservers, split DNS and tailnet settings, and explains them.
The AI renames a device, replaces its ACL tags, authorizes or de-authorizes it, or changes the enabled subnet routes of a device.
Changes dataThe AI expires a device's node key to force sign-in again, deletes a device, or revokes an auth key. It can also create a new auth key.
Changes dataThe login page asks for your Tailscale API access token.
Optional: Tailnet (optional — defaults to the key's own tailnet).
Generate one in the Tailscale admin console → Settings → Keys → API access tokens. Your credentials are used only to call the API on your behalf and to derive a private account id; they are never shown to anyone.
Team and Enterprise: an Owner adds the connector for the organization first.
No Add custom MCP server option? It depends on your account or workspace settings: see OpenAI's guide.
Run this command, then run /mcp in Claude Code to log in:
Add to Cursor or add this to ~/.cursor/mcp.json:
{
"mcpServers": {
"tailscale": {
"url": "https://tailscale.usefulapi.io/mcp"
}
}
} Add to VS Code or add this to .vscode/mcp.json:
{
"servers": {
"tailscale": {
"type": "http",
"url": "https://tailscale.usefulapi.io/mcp"
}
}
} Run these commands. The second one opens the login page:
Windsurf, Cline, Zed and other MCP clients: add this URL as a remote MCP server (Streamable HTTP). The client then opens the login page in your browser.
Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Tailscale API access token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
| Plan | Price | Limit |
|---|---|---|
| Free | $0 | 50 tool calls / month |
| Pro | $9/mo · $90/yr | 10,000 tool calls / month |
| Pro+ | $39/mo · $390/yr | 100,000 tool calls / month |
Each paid plan covers this Tailscale server only. Ask your AI to run tailscale_upgrade and choose Pro or Pro+, billed monthly or yearly (it returns a Stripe Checkout link). If you already have Pro, ask to change it to Pro+. The change requires your confirmation, keeps your billing interval and charges the price difference for the rest of the period immediately. Cancel any time with tailscale_cancel_subscription: your paid plan continues to the end of the paid period, with no refund for the current period, and asking to resume the same plan with tailscale_upgrade before then undoes the cancel. Or write to [email protected].
tailscale_list_devicestailscale_get_devicetailscale_list_device_routestailscale_list_keystailscale_get_keytailscale_get_policy_filetailscale_list_dns_nameserverstailscale_get_dns_preferencestailscale_list_dns_searchpathstailscale_get_split_dnstailscale_list_userstailscale_get_usertailscale_list_webhookstailscale_get_tailnet_settingstailscale_authorize_devicetailscale_set_device_nametailscale_set_device_tagstailscale_expire_device_keytailscale_set_device_routestailscale_create_auth_keytailscale_delete_keytailscale_delete_devicetailscale_usage_statustailscale_request_featuretailscale_upgradetailscale_cancel_subscriptionFind devices that have not been seen lately. Check users, keys and their expiry. Review ACLs, DNS and tailnet settings. Rename or tag devices, change approval or subnet routes. Respond to a lost device or leaked key. See what you can do for the details.
No. usefulapi is an independent service. It is not affiliated with or endorsed by Tailscale. The server calls the Tailscale API with your own Tailscale access, so it sees only the data that your account can see.
Yes. In Claude, add this server's URL as a custom connector. In ChatGPT, add it as a custom MCP server in Plugins. Then log in once. Cursor, VS Code, Claude Code and Codex work too. See the setup steps.
The login page asks for your Tailscale API access token. See Before you connect for where to find it.
No. Add only the URL. Do not add an Authorization header or an API key to the client config. The server signs you in with OAuth: the login page asks for your Tailscale API access token. If the config has such a header, remove it: some clients then send that header instead of the login token, and every call fails with 401.
The login stores them encrypted in the authorization grant of your connection. The server uses them to call the Tailscale API for you and to derive a private account id for usage metering. usefulapi does not show them on any page or in any reply. To stop all access, remove the connector and change or delete these credentials in Tailscale.
Yes, if you approve it. 8 of the 22 Tailscale tools can create or change data. The other 14 are marked read-only. Most MCP clients ask you to approve a tool call before it runs.
The Free plan gives 50 tool calls / month. Pro costs $9/mo or $90/yr, with 10,000 tool calls / month. Pro+ costs $39/mo or $390/yr, with 100,000 tool calls / month. Each subscription covers this Tailscale server only. Cancel any time: your paid plan then runs to the end of the paid period. Run tailscale_usage_status to see how many calls you used.
Ask the AI to run tailscale_upgrade and choose Pro or Pro+, billed monthly or yearly: it returns a Stripe Checkout link. If you already have Pro, ask to change it to Pro+. After you confirm, your existing subscription changes in place, keeps its billing interval and charges the price difference for the rest of the period immediately. To cancel, run tailscale_cancel_subscription. Your paid plan continues to the end of the paid period.
Tell the AI what you wanted to do. It can send the request with tailscale_request_feature. We store the text with the server name, the type of AI client and the tool you tried, not with your account, and read every request when we plan new tools. You can send up to 5 requests per day.
Any client that supports remote MCP servers (Streamable HTTP) with OAuth login: Claude (web and desktop), Claude Code, ChatGPT, Codex, Cursor, VS Code, Windsurf and others.
This is a Model Context Protocol endpoint — meant to be connected from an AI client, not opened in a browser. An invalid_token response at the URL is the auth gate working as designed; clients authenticate automatically.
Need a tool this server does not have, or a connection to another system? We build custom integrations and MCP servers.