Cloud, hosting & identity · wired today

What can agents actually do with Tailscale?

Infrastructure state changes under you; agents need to read it live. The Tailscale connector is one of 205 executable connectors and gives agents 13 tools, with the credential held in the vault and every call receipted.

The Tailscale tool list, exactly as agents see it

list_devices — List all devices on the Tailscale mesh with status, IPs, routes, and health summary
device_details — Get full details of a specific Tailscale device including connectivity, latency, and routes
get_routes — Get advertised and enabled subnet routes for a Tailscale device
get_acl — Get the Tailscale ACL policy with groups, rules, tag owners, and a human-readable summary
get_dns — Get Tailscale DNS configuration: nameservers, MagicDNS, search paths, and split DNS rules
list_keys — List all auth keys on the tailnet with expiry status and summary
audit_log — Get recent Tailscale configuration audit log entries
authorize_device — Authorize or deauthorize a Tailscale device. Deauthorizing disconnects it from the tailnet.
set_device_tags — Set tags on a Tailscale device. Replaces all existing tags.
manage_routes — Enable or disable subnet routes on a Tailscale device. Provide the list of routes to enable.
create_auth_key — Create a new Tailscale auth key for device enrollment. The full key is only shown once.
fleet_cross_reference — Cross-reference Tailscale devices with bastion fleet hosts. Shows which hosts are on both, Tailscale-only, or bastion-only. Requires both tailscale and bastion-fleet plugins.
revoke_key — Revoke a Tailscale auth key. Devices already authenticated with this key are NOT affected.

What the Tailscale connector needs

You provide API key, tailnet from your Tailscale account. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.

Where to get it: Tailscale's own API documentation ↗ covers creating and scoping the credential.

How proven is this?

The Tailscale connector is a hand-written module that has been exercised against the live Tailscale API.

Tailscale integration FAQ

What can Quox agents do with Tailscale?

Agents can run 13 tools against Tailscale: list devices, device details, get routes, get acl, get dns and more. Every call is receipted in the evidence trail.

What does the Tailscale integration need?

You provide API key, tailnet from your Tailscale account. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.

Do agents see my Tailscale credentials?

No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.

How proven is the Tailscale connector?