Tailscale

Tailscale (tailscale.com). Use this skill for ANY Tailscale request — reading, creating, updating, and deleting data. Whenever a task involves Tailscale, use this skill instead of calling the API directly.

Operate Tailscale through your OOMOL-connected account. This skill calls the tailscale connector with the oo CLI; OOMOL injects credentials server-side, so you never handle raw tokens.

Running an action

Assume the user has already installed the oo CLI, signed in, and connected Tailscale. Do not run oo auth login or open the connection URL proactively — just run the action. Fall back to First-time setup only when a command actually fails with an auth or connection error.

1. Inspect the contract to get the authoritative input/output schema before building a payload:

bash

oo connector schema "tailscale" --action "<action_name>"

2. Run the action with a JSON payload that matches the input schema:

bash

oo connector run "tailscale" --action "<action_name>" --data '<json>' --json

• --data takes a JSON object string or @path/to/file.json; omit it to send {}.
• The response is { "data": ..., "meta": { "executionId": "..." } }; the execution id lives under meta.executionId.

Each action is listed below with a one-line description; actions that change state carry a [write] or [destructive] tag. Before constructing --data, fetch the action's live schema with oo connector schema to get its authoritative input fields.

Available actions

• approve_user — Approve a pending Tailscale user for the tailnet. [write]
• batch_update_device_posture_attributes — Set or remove custom posture attributes across multiple Tailscale devices. [write]
• create_key — Create an auth key, OAuth client credential, or federated trust credential and return its secret. [write]
• create_oauth_app — Create a Tailscale OAuth application and return its client secret. [write]
• create_posture_integration — Create a device posture integration using its external provider credentials. [write]
• create_webhook — Create a webhook endpoint and return its signing secret. [write]
• delete_device — Permanently delete a device from its Tailscale tailnet. [destructive]
• delete_device_invite — Delete a Tailscale device share invite. [destructive]
• delete_device_posture_attribute — Permanently remove one custom posture attribute from a Tailscale device. [destructive]
• delete_key — Permanently revoke and delete a Tailscale trust credential or key. [destructive]
• delete_oauth_app — Permanently delete a Tailscale OAuth application and revoke its access. [destructive]
• delete_posture_integration — Delete a device posture integration. [destructive]
• delete_service — Permanently delete a named Tailscale Service. [destructive]
• delete_user — Permanently delete a Tailscale user from the tailnet. [destructive]
• delete_webhook — Permanently delete a Tailscale webhook endpoint. [destructive]
• disable_log_streaming — Disable and remove the destination configuration for a Tailscale log stream. [write]
• expire_device_key — Immediately expire a device key and require the device to authenticate again. [destructive]
• get_aws_external_id — Create or retrieve the AWS external ID used by Tailscale log streaming.
• get_contacts — Get the account, support, and security contacts for the tailnet.
• get_device — Get one Tailscale device by its preferred node ID or legacy device ID.
• get_device_invite — Get one Tailscale device share invite. [write]
• get_device_posture_attributes — Get the posture attributes currently reported for a Tailscale device.
• get_dns_configuration — Get the complete DNS configuration for the tailnet.
• get_dns_preferences — Get the tailnet DNS preferences, including MagicDNS state.
• get_key — Get metadata for a Tailscale trust credential or key.
• get_log_streaming_configuration — Get the potentially sensitive destination configuration for a Tailscale log stream.
• get_log_streaming_status — Get the current publishing status for configuration or network log streaming.
• get_oauth_app — Get a Tailscale OAuth application by app ID.
• get_policy_file — Get the current Tailscale policy file as JSON, optionally with validation details.
• get_posture_integration — Get one device posture integration by ID.
• get_service — Get a Tailscale Service by name.
• get_service_device_approval — Get whether a Service is approved on a specific device.
• get_split_dns — Get the split DNS nameserver mapping for the tailnet.
• get_tailnet_settings — Get the tailnet feature, logging, networking, and policy settings visible to the OAuth client.
• get_user — Get a Tailscale user by user ID.
• get_webhook — Get a Tailscale webhook endpoint by ID.
• list_configuration_audit_logs — List configuration audit logs for an RFC 3339 time window, with optional filters.
• list_device_invites — List all share invites for a Tailscale device.
• list_device_routes — List the subnet routes advertised and enabled for a Tailscale device.
• list_devices — List all devices in the configured Tailscale tailnet.
• list_dns_nameservers — List the global DNS nameservers configured for the tailnet.
• list_dns_search_paths — List the DNS search paths configured for the tailnet.
• list_keys — List trust credentials and keys visible to the OAuth client.
• list_network_flow_logs — List network flow logs for an RFC 3339 time window.
• list_oauth_apps — List OAuth applications configured for the tailnet.
• list_posture_integrations — List the device posture integrations configured for the tailnet.
• list_service_hosts — List devices currently hosting a named Tailscale Service.
• list_services — List the Services configured in the tailnet.
• list_users — List tailnet users with optional user-type and role filters.
• list_webhooks — List webhook endpoints configured for the tailnet.
• preview_policy_rule_matches — Preview which rules in a proposed policy match a user or IP address and port without saving it.
• resend_contact_verification_email — Resend the verification email for a tailnet contact.
• restore_user — Restore a suspended Tailscale user.
• rotate_webhook_secret — Rotate a webhook signing secret and return the new secret once.
• set_device_authorized — Authorize or deauthorize a Tailscale device. [write]
• set_device_ip — Set the Tailscale IPv4 address for a device. [write]
• set_device_key_expiry — Enable or disable key expiry for a Tailscale device. [write]
• set_device_name — Set a Tailscale device name, or reset it from the OS hostname with an empty name. [write]
• set_device_posture_attribute — Set one custom posture attribute on a Tailscale device. [write]
• set_device_routes — Replace the enabled subnet routes for a Tailscale device. [write]
• set_device_tags — Replace all ACL tags assigned to a Tailscale device. [write]
• set_dns_configuration — Replace the entire tailnet DNS configuration, including nameservers, split DNS, search paths, and preferences. [write]
• set_dns_nameservers — Replace the global DNS nameservers configured for the tailnet. [write]
• set_dns_preferences — Enable or disable MagicDNS for the tailnet. [write]
• set_dns_search_paths — Replace the DNS search paths configured for the tailnet. [write]
• set_log_streaming_configuration — Create or replace a Tailscale log streaming destination configuration. [write]
• set_policy_file — Replace the Tailscale policy file after its embedded tests pass. [write]
• set_split_dns — Replace the entire tailnet split DNS configuration. [write]
• suspend_user — Suspend a Tailscale user and their access to the tailnet.
• test_webhook — Send a test event to a Tailscale webhook endpoint.
• update_contact — Change the account, support, or security contact email for the tailnet. [write]
• update_key — Replace the mutable configuration of an OAuth or federated Tailscale trust credential. [write]
• update_oauth_app — Replace the configuration of a Tailscale OAuth application. [write]
• update_posture_integration — Update a device posture integration and optionally replace its client secret. [write]
• update_service — Create or replace a named Tailscale Service definition. [write]
• update_service_device_approval — Approve or revoke approval for a Service on a device. [write]
• update_split_dns — Merge domain-to-resolver entries into the tailnet split DNS configuration. [write]
• update_tailnet_settings — Update reversible feature, logging, networking, or policy-link settings for the tailnet. [write]
• update_user_role — Change a Tailscale user's administrative role. [write]
• update_webhook — Replace the subscribed events for a Tailscale webhook endpoint. [write]
• validate_aws_external_id — Validate an AWS IAM role trust policy against a Tailscale external ID.
• validate_policy_file — Validate a proposed policy file or run ACL tests without changing the tailnet policy.

Safety

• Untagged actions are reads (get / list / search) — safe to run directly.
• Actions tagged [write] change Tailscale state — confirm the exact payload and effect with the user before running.
• Actions tagged [destructive] remove or overwrite data — always confirm the target and get explicit approval first.

First-time setup

These are one-time steps — do not repeat them on every call. Run a step only when a command fails for the matching reason.

• oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):

  bash

  curl -fsSL https://cli.oomol.com/install.sh | bash    # macOS / Linux
  

  powershell

  irm https://cli.oomol.com/install.ps1 | iex           # Windows PowerShell
  

• Not signed in / authentication error — sign in to your OOMOL account once:

  bash

  oo auth login
  

• scope_missing / credential_expired / app_not_ready / app_not_found — Tailscale is not connected, or the connection expired or lacks a scope. Connect once (auth type: custom credential) at:

  text

  https://console.oomol.com/app-connections?provider=tailscale
  

• HTTP 402 / OOMOL_INSUFFICIENT_CREDIT — billing stop. Recharge at https://console.oomol.com/billing/token-recharge before retrying.

Resources

• Tailscale homepage: https://tailscale.com