AI agents for Tailscale

List devices

Lists the tailnet's devices, optionally only exact matches on a top-level field (like hostname, os or a tag).

Get a device

Reads one device with all its fields: addresses, OS and client version, owner, tags, authorization, last seen, key expiry, approved and advertised subnet routes.

List users

Lists the tailnet's users, by type (member, shared, all) and role (owner, admin, member, it-admin, network-admin, billing-admin, auditor).

List keys

Lists the tailnet's active keys the OAuth client can see (auth keys and trust credentials), as keys.

Get the access policy

Reads the tailnet policy file as JSON: acls or grants (who may reach what), groups, tagOwners, hosts, ssh rules, autoApprovers and tests.

Authorize a device

Approves a new device so it can join a tailnet that requires device approval, or (with authorized false) removes its approval so it is cut off until approved again.

Set a device's tags

Replaces a device's tags (like ["tag:prod", "tag:db"]); the tags then own the device and the access policy's tag rules apply to it.

Expire a device's keyDeletes data

Expires a device's node key now: the device is disconnected until someone signs it in again.

Remove a deviceDeletes data

Removes a device from the tailnet for good; it must be added again with a new sign-in or auth key to return.

Create an auth key

Creates an auth key that registers new machines into the tailnet without a person signing in (for servers, containers, CI).