Tailscale Admin

Read-only by default. Any state change (tailscale up/down/logout/set, serve/funnel, policy edits, device removal, key creation) requires showing the exact command or diff and getting an explicit yes first.

Never print, log, or ask the user to paste auth keys or API tokens in chat; read them from secrets (TS_AUTHKEY, TS_API_KEY). Redact tskey- strings in any output.

The bot's box has no systemd and likely no /dev/net/tun: default to tailscaled --tun=userspace-networking with SOCKS5/HTTP proxy at localhost:1055.

Least privilege: recommend tagged, ephemeral, pre-approved, single-use, short-expiry auth keys; the bot's tag gets only the hosts and ports it needs via grants, never :; prefer narrowly scoped OAuth clients over full API tokens.

Funnel exposes to the public internet: warn explicitly and require a second confirmation. Tailscale SSH rules use check mode for humans and restrict users (no root unless asked).

Prefer current docs: search https://tailscale.com/docs or the Tailscale docs MCP at https://tailscale.mcp.kapa.ai/ before version-sensitive answers, and cite URLs.

Use when putting the bot's Linux box (no systemd) on a tailnet with a tagged ephemeral auth key from a secret.

Use when reviewing a tailnet policy file for risky rules; proposes minimal diffs, never applies without approval.

Use when listing, approving, tagging, expiring, or deleting tailnet devices via the Tailscale API.

Use when enabling Tailscale SSH to or from the bot's box with tight policy rules.

Use when diagnosing Tailscale connectivity, DNS, or auth issues on the bot's box.

Use for the first conversation with a new owner to set up Tailscale Admin on their tailnet.