What is tailscale-mcp?

Instructions for using Tailscale, a private network that connects devices, with self-hosted Hermes agents through an MCP server. MCP is a way for an agent to use external tools.

Use them to configure or troubleshoot Tailscale, expose local services, check connections, join machines to the network, and plan a homelab agent setup.

They help with remote access, device connectivity, and setup for agents running on your own machines.

tailscale-mcp — Skill for Claude Code and Codex by GumbyEnder

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add GumbyEnder/mcp-tailscale --skill mcp-tailscale

Clone the repo

git clone --depth 1 https://github.com/GumbyEnder/mcp-tailscale

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/gumbyender/mcp-tailscale/mcp-tailscale/github.svg)](https://agentmods.dev/skills/gumbyender/mcp-tailscale/mcp-tailscale)

Your own site

<a href="https://agentmods.dev/skills/gumbyender/mcp-tailscale/mcp-tailscale"><img src="https://agentmods.dev/badge/skills/gumbyender/mcp-tailscale/mcp-tailscale/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/gumbyender/mcp-tailscale/mcp-tailscale"><img src="https://agentmods.dev/badge/skills/gumbyender/mcp-tailscale/mcp-tailscale.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 29 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,043 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe. ✓ AI security review Sonnet 5 · 7 Sept 2026 📄 Read the review

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00029	$0.02043
Opus 5	$0.00015	$0.01022
Sonnet 5	$0.00006	$0.00409
Haiku 4.5	$0.00003	$0.00204

Measured 9d ago against content hash 6dc4b2748be3, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade B, and why

tailscale-mcp scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

sudo tailscale up --accept-routes=false \

SKILL.md · 234 lines

How it starts

The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Secure Homelab Networking with Tailscale + Self-Hosted Agents

When to Use This Skill

Use this skill whenever you are:

Setting up or troubleshooting Tailscale for remote access to self-hosted agents
Exposing a local Hermes gateway / dashboard / service over Tailscale
Diagnosing peer connectivity (direct vs relay, NAT traversal)
Adding or removing tailscale serve configurations for self-hosted tools
Auditing which devices are on your tailnet and their connection health
Configuring a new machine (Linux, Windows) to join a tailnet for agent hosting
Planning a multi-machine homelab architecture with Tailscale as the backbone

Prerequisites

Tailscale installed and logged in on all machines
Python 3.11+ with the mcp package (pip install mcp)
The mcp-tailscale MCP server installed (see README.md)

Architecture Pattern: Tailscale as Homelab Backbone

Internet ──┬── Starlink / ISP
           │
     ┌─────┴──────────────────┐
     │  Tailscale Tailnet      │
     │  (WireGuard mesh VPN)   │
     └─────┬──────────────────┘
           │
     ┌─────┼─────┬─────┬──────┐
     │     │     │     │      │
  Linux   Linux Linux Win  iPhone
  (Mint)  (Dell) (RPi) (Surface)
  Agent   Agent  Agent  Client

Key Properties

No open ports — Tailscale uses outbound-only connections + DERP relays
Direct peer-to-peer when NAT permits; automatic fallback to relay
Fixed Tailscale IPs (100.x.y.z) — stable addressing regardless of upstream ISP
MagicDNS — human-readable hostnames (machine.tailXXXXX.ts.net)
ACL-based security — fine-grained access policies between nodes

Common Workflows

1. Check Tailnet Health

# Quick overview
tailscale status

# Rich JSON
tailscale status --json

# NAT / DERP diagnostics
tailscale netcheck

# See which ports are served
tailscale serve status --json

Via the MCP server tools: call list_devices, netcheck, serve_list.

2. Expose a Service Over Tailscale

Read the full file on GitHub · 234 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 234 lines · 29 tokens per session scan F 6dc4b2748be3

Subscribe to this mod's changes

tailscale-mcp is a skill published in the GitHub repository GumbyEnder/mcp-tailscale (3 stars, last pushed 2mo ago), licensed MIT. It adds 29 tokens to every session and 2,043 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Cloud DevOps and cloud Security homelab mcp networking remote-access tailscale vpn

vpn

A guide to setting up and managing VPNs, private network connections that protect or route traffic between devices and servers. It covers WireGuard, OpenVPN, and IPsec, with emphasis on WireGuard commands and configuration.

chaterm/terminal-skills · 7 tokens

aws-network-ops

AWS cloud networking — VPC, Transit Gateway, Cloud WAN, VPN, Network Firewall, ENI, flow logs. Use when auditing AWS VPCs, troubleshooting connectivity between EC2 instances, checking Transit Gateway routes, or investigating VPN tunnel status.

automateyournetwork/netclaw · 55 tokens

azure-network-ops

Azure cloud networking -- VNets, NSGs, ExpressRoute, VPN Gateways, Azure Firewalls, Load Balancers, Application Gateways, Route Tables, Network Watcher, Private Endpoints, DNS zones. Use when auditing Azure VNets, troubleshooting hybrid connectivity (ExpressRoute/VPN), checking NSG rules, inspecting firewall policies…

automateyournetwork/netclaw · 80 tokens

olares-chart

Olares app packaging and chart authoring via olares-cli chart — port a repo, docker-compose, or generic Helm chart; build/push the image; author, lint, package, and deploy an OlaresManifest; wire storage, middleware, entrances, env, and GPU; edit the chart after diagnosis. Runtime failure diagnosis is olares-doctor…

beclab/Olares · 85 tokens

cis-aws-foundations-5.13

Ensure route table changes are monitored.

CyberStrikeus/CyberStrike · 16 tokens

cis-aws-foundations-6.5

Ensure the default security group of every VPC restricts all traffic.

CyberStrikeus/CyberStrike · 23 tokens

tailscale-mcp