Tailscale Device Management

Workflow skill for managing Tailscale devices including listing, authorization, subnet route configuration, ACL tag assignment, and posture attribute management.

Workflow 1: List Devices

1. Call tailscale_device_list to retrieve all devices.
2. Format as a table:

1. Show total count and online/offline breakdown.
2. Flag devices offline >24h or with imminent key expiry.

Workflow 2: Device Details

1. Call tailscale_device_get with the device ID.
2. Display comprehensive details:

• Addresses, hostname, OS, user
• Tags, routes (advertised + enabled)
• Key expiry, authorization status
• Client connectivity (DERP, endpoints)
• Posture attributes

Workflow 3: Authorize Device

1. Call tailscale_device_list to find pending devices.
2. If multiple pending, ask user to select which one.
3. Show device details and confirm authorization with user.
4. Call tailscale_device_authorize with the device ID.
5. Verify: tailscale_device_get to confirm authorized status.

Workflow 4: Manage Subnet Routes

1. Call tailscale_device_routes_get to see advertised and enabled routes.
2. Display current state:

1. Ask user which routes to enable/disable.
2. Warn about network topology impact — route changes affect traffic flow.
3. Call tailscale_device_routes_set with the updated routes list.
4. Verify: tailscale_device_routes_get.

Workflow 5: Set Tags

1. Show current tags: tailscale_device_get.
2. Gather new tags from user (format: tag:server, tag:prod).
3. Warn about ACL impact — tag changes affect access permissions.
4. Call tailscale_device_tags_set with the new tag list.
5. Verify: tailscale_device_get.

Workflow 6: Manage Posture Attributes

1. View current posture: tailscale_device_posture_get.
2. To set a custom attribute: gather key and value from user.
3. Call tailscale_device_posture_set with key and value.
4. Verify: tailscale_device_posture_get.

Workflow 7: Remove Device

1. Call tailscale_device_get to show device details.
2. Warn if device is online — removing an active device will disconnect it.
3. Require explicit user confirmation — this action is irreversible.
4. Call tailscale_device_delete with confirm=true.
5. Verify: tailscale_device_list to confirm removal.

Rules

• Always show device online status before destructive actions.
• Route changes affect network topology — warn the user before applying.
• Tag changes affect ACL permissions — show the potential impact.
• Destructive actions (delete) require explicit user confirmation.
• Always verify after mutations using a read operation.

Key Tools

• tailscale_device_list — list all devices
• tailscale_device_get — get device details
• tailscale_device_delete — remove device (requires confirm)
• tailscale_device_authorize — authorize pending device
• tailscale_device_routes_get / tailscale_device_routes_set — subnet route management
• tailscale_device_tags_set — set ACL tags
• tailscale_device_posture_get / tailscale_device_posture_set — posture attribute management