Tailscale Mesh Plugin
Mesh network monitoring, route management, and key lifecycle for your Tailscale tailnet.
The Tailscale Mesh plugin connects your Tailscale tailnet to QuoxCORE, giving your AI agents full visibility into your mesh network. Monitor device status, manage routes, handle key lifecycle, and receive real-time alerts -- all from a single dashboard backed by the MESHNET agent.
Agent: MESHNET Price: Free Tier: Free
Overview
Tailscale builds encrypted WireGuard mesh networks across your infrastructure. This plugin pulls device inventory, route tables, ACL policies, DNS configuration, and auth key status into QuoxCORE so you can query and manage your tailnet using natural language or automated workflows.
Key capabilities:
- Mesh overview -- live device list with status, IPs, OS, last seen, and connectivity
- Route management -- view and toggle advertised subnet routes per device
- Key lifecycle -- create, inspect, and revoke pre-authentication keys
- ACL and DNS -- read ACL policies and DNS configuration
- Alerts -- configurable notifications for offline devices, expiring keys, new devices, and route issues
- Cross-reference -- match Tailscale devices against your bastion fleet inventory
- MESHNET agent -- natural language queries like "which devices have expiring keys?" or "show me all subnet routers"
Setup
1. Get your Tailscale API token
- Go to admin.tailscale.com/settings/keys
- Click Generate API access token
- Set expiry (90 days recommended)
- Copy the token (starts with
tskey-api-)
If using OAuth instead of an API key, grant these scopes:
| Scope | Purpose |
|---|---|
devices:core:read / devices:core | Read and write devices |
devices:routes:read / devices:routes | Read and write routes |
auth_keys:read / auth_keys | Read and write auth keys |
policy_file:read | Read ACL policy |
dns:read | Read DNS configuration |
logs:configuration:read | Read audit log |
webhooks | Register webhook for real-time alerts |
2. Add credentials to the QuoxCORE vault
- Navigate to Settings > Integrations Vault
- Find Tailscale under the Zero Trust category
- Enter:
- API Access Token: your
tskey-api-...token - Tailnet: your tailnet name (e.g.
example.com) or-for the default tailnet
- API Access Token: your
- Save
3. Activate the plugin
- Navigate to Settings > Plugins
- Find Tailscale Mesh (Free)
- Click Activate
- Navigate to
/tailscaleto see your mesh
Configuration
Access plugin settings via the gear icon in the MeshPulseBar.
| Setting | Default | Description |
|---|---|---|
| Polling interval | 60s | How often to check device status |
| Offline threshold | 5 min | Device considered offline after this duration |
| Key expiry warning | 7 days | Alert when keys expire within this window |
Alert configuration
Each alert type can be individually enabled or disabled with a severity level:
| Alert | Default | Severity |
|---|---|---|
| Device goes offline | Enabled | High |
| Device comes back online | Enabled | Low |
| Key expiring soon | Enabled | Medium |
| Key expired | Enabled | High |
| New device needs approval | Enabled | Medium |
| Subnet router misconfigured | Enabled | High |
| Policy updated | Disabled | Low |
| New device created | Disabled | Low |
Notification channels
Alerts create HITL inbox items by default. You can also route them to:
- Telegram (high and medium priority)
- Slack
Configure notification preferences in Settings > Notifications.
Tools Reference
Read tools (7)
| Tool | Description |
|---|---|
tailscale_list_devices | List all devices with status, IPs, routes, and summary |
tailscale_device_details | Full device info including connectivity and latency |
tailscale_get_routes | Advertised and enabled routes for a device |
tailscale_get_acl | ACL policy with human-readable summary |
tailscale_get_dns | DNS config: nameservers, MagicDNS, split DNS |
tailscale_list_keys | Auth keys with expiry status and summary |
tailscale_audit_log | Configuration audit log (last 7 days by default) |
Write tools (5)
| Tool | Description | Approval required |
|---|---|---|
tailscale_authorize_device | Authorise or deauthorise a device | Yes (deauthorise) |
tailscale_set_device_tags | Set tags on a device | No |
tailscale_manage_routes | Enable or disable subnet routes | Yes |
tailscale_create_auth_key | Create a pre-auth key | No |
tailscale_revoke_key | Revoke an auth key | Yes |
Cross-reference tool (1)
| Tool | Description | Requires |
|---|---|---|
tailscale_fleet_cross_reference | Match Tailscale devices with bastion fleet hosts | Both Tailscale and Bastion Fleet plugins |
RBAC
| Operation | Minimum role |
|---|---|
| View devices, routes, DNS, ACLs, keys, audit log | viewer |
| Set device tags, rename device, create auth key | builder |
| Authorise/deauthorise device, manage routes, revoke key | admin |
| Delete device | owner |
Multi-organisation support
Each organisation stores its own Tailscale credentials in the vault. The dashboard shows the current organisation's tailnet by default. Users in multiple organisations see org filter pills. Instance admins can view all organisations.
Troubleshooting
"Tailscale credentials invalid or expired"
- Check that the API token has not expired (tokens last 1-90 days)
- Regenerate at admin.tailscale.com/settings/keys
- Update the token in Settings > Integrations Vault
"Tailscale connector not available"
- Confirm the plugin is activated in Settings > Plugins
- Confirm credentials are saved in the vault for the current organisation
- Check the collector container is running:
docker ps | grep collector
Devices showing as offline when they are running
- The offline threshold is 5 minutes by default
- If the device's Tailscale client is not running,
lastSeenwill drift - Run
tailscale statuson the device to verify connectivity
No webhook events
- Webhooks require a public URL that Tailscale can reach
- If you are behind a firewall, the device poller handles status monitoring (polling every 60 seconds)
- Webhook registration can be enabled in plugin settings if a public URL is available