Tailscale MCP Server vs Vnsh
A side-by-side look at the Tailscale MCP Server and Vnsh MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Tailscale MCP Server for developer tools work as a local process; choose Vnsh for developer tools as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Tailscale MCP Server when
- You need dedicated capabilities in the Developer Tools domain.
- You prefer a local stdio subprocess transport.
- You have the keys it needs:
TAILSCALE_API_KEY. - You want tools like
tailscale_tool_groups, tailscale_status, tailscale_list_devices.
Choose Vnsh when
- You need dedicated capabilities in the Developer Tools domain.
- You prefer a local stdio subprocess transport.
- You want tools like
vnsh_read, vnsh_share, vnsh_share_file.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Developer Tools | Developer Tools |
| Quality signal | 64/100 · Good | 64/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | Not declared | Not declared |
| Pricing | Not declared | Not declared |
| Required env vars | TAILSCALE_API_KEY | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 34 | 158 |
| Directory activity | 0 views 0 installs 0 upvotes | 1 views 0 installs 0 upvotes |
| Tools | 98 | 14 |
| Full listing | View Tailscale MCP Server | View Vnsh |
Tools & capabilities
Tailscale MCP Server tools 98
tailscale_tool_groupsExplain which of this server's tools are available and why. Call this FIRST when a Tailscale tool you expected is missing, instead of assuming the capability does not exist -- tools can be withheld by configuration, and the fix is usually one environment variable. Pass `toolName` to ask about one specific tool (e.g. 'tailscale_delete_device'): the answer distinguishes 'no such tool exists' -- where you should find another approach -- from 'it exists but its group is not loaded' and 'it exists and loaded but writes are withheld there', both of which the operator can enable and neither of which you should work around. With no arguments it lists every group with its availability and, where something is withheld, the exact environment change that would restore it. Always available regardless of filters.tailscale_statusCheck that the Tailscale API connection is working. Returns your tailnet name, device count, and confirms authentication is valid. Use this to verify setup.tailscale_list_devicesList all devices in your tailnet with their status, IP addresses, OS, and last seen time. 'lastSeen' is omitted while a device is connected (connectedToControl: true) and for devices that have never been online -- on a connected device a missing lastSeen means online now, not never seen.tailscale_get_deviceGet detailed information about a specific device by its ID. Returns the default field subset unless fields: 'all'. 'lastSeen' is omitted while a device is connected (connectedToControl: true) and for devices that have never been online -- on a connected device a missing lastSeen means online now, not never seen.tailscale_authorize_deviceAuthorize a device that is pending authorization.tailscale_deauthorize_deviceDeauthorize a device, immediately removing its access to the tailnet. The device will need to be re-authorized to reconnect.tailscale_delete_devicePermanently remove a device from the tailnet. This is irreversible -- the device must re-authenticate to rejoin.tailscale_rename_deviceSet the name of a device in the tailnet, or reset it to its OS hostname.tailscale_expire_deviceExpire a device's key, forcing it to re-authenticate.tailscale_get_device_routesGet the subnet routes a device advertises and which are enabled.tailscale_set_device_routesSet the enabled subnet routes for a device. Replaces all currently enabled routes -- pass the full list of routes you want enabled.tailscale_get_device_posture_attributesGet all posture attributes for a device, including custom and system-managed attributes.- +86 more on the listing page
Vnsh tools 14
vnsh_readReads any vnsh URL: decrypts legacy vnsh.dev/v links locally, or directly fetches a public vnshcontent.dev/p link. Public content is intentionally unencrypted.vnsh_shareEncrypts text content locally and uploads it to vnsh, returning a shareable URL. Use this when output exceeds ~50 lines or ~2000 characters, when generating complete code files, or when the user wants portable/shareable output. ALWAYS prefer vnsh_share over dumping large content into chat. The content is encrypted before upload - the server only sees encrypted bytes.vnsh_share_fileEncrypts a local file and uploads it to vnsh, returning a shareable URL. Use this for images, screenshots, PDFs, binaries, or any file that should not be loaded into context. More efficient than vnsh_share for large or binary files.vnsh_artifact_createCreates a permanent, service-readable Account Artifact in the signed-in user’s Library. Use this for durable knowledge that the user wants their other Agents to discover and update. Requires VNSH_TOKEN. This is different from an encrypted Incognito workspace: vnsh can read Account Artifact content so authorized Agents can collaborate on it.vnsh_artifact_listLists permanent Account Artifacts available to the connected user. Use this instead of asking the human to paste a link when continuing earlier account knowledge. Requires VNSH_TOKEN.vnsh_artifact_readReads the current content and version of one permanent Account Artifact. Pass the returned version to vnsh_artifact_update so another Agent cannot be overwritten.vnsh_artifact_updateCreates a new immutable version of an Account Artifact. Requires the base_version returned by vnsh_artifact_read. On conflict, re-read, merge, and retry; never silently overwrite.vnsh_workspace_createCreates a shared workspace and returns one link that any agent can read AND write. Use this when work will continue somewhere else: handing a plan, status doc, design, or investigation to another agent or another session, or when the user says they will pick this up in a different tool. Unlike vnsh_share (a one-shot snapshot), a workspace keeps the same URL as its content evolves. Content is encrypted locally; the server never sees the key. Anonymous workspaces expire 24h after the last write (ttl can extend this to a week). With VNSH_TOKEN, new workspaces and artifacts are kept until the account owner deletes them.vnsh_workspace_renewExtends the expiry of a vnsh workspace without changing its content. Use this when the user says a link is about to expire, or asks to keep something alive longer. Needs the edit link (a #w= fragment); a view-only #r= link cannot renew. The version is not bumped, so any pending edit still applies.vnsh_workspace_readReads the current content of a workspace: encrypted /w/ links with #w= or #r=, and public /p/ links with no fragment. Use this whenever the user provides such a link — it is how you pick up work another agent left for you. Returns the content and its version number; pass that version to vnsh_workspace_update to write safely.vnsh_workspace_updateReplaces the content of a vnsh workspace, keeping the same URL. Use this to record progress so far, revise a shared plan, or leave the next agent an updated document. Writes are version-checked: if someone else wrote first, this returns their current content so you can merge it with yours and call this again.vnsh_workspace_openDecrypts a vnsh workspace to a local temp file and opens it in the browser. Use this when the user wants to LOOK at a workspace rather than have its content read into context — HTML reports, dashboards, and diagrams render properly this way. Rendering happens locally from file://, so nothing is exposed to any server.- +2 more on the listing page
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Tailscale MCP Server
{
"mcpServers": {
"tailscale-mcp-server-2": {
"command": "npx",
"args": [
"-y",
"@yawlabs/tailscale-mcp@latest"
],
"env": {
"TAILSCALE_API_KEY": "YOUR_TAILSCALE_API_KEY_HERE"
}
}
}
}
Vnsh
{
"mcpServers": {
"vnsh": {
"command": "npx",
"args": [
"-y",
"vnsh-mcp@1.9.0"
]
}
}
}
Frequently asked questions
Tailscale MCP Server is categorized under Developer Tools and uses a local stdio subprocess. Vnsh belongs to Developer Tools and uses a local stdio subprocess. Pick Tailscale MCP Server for developer tools work and Vnsh for developer tools.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Tailscale MCP Server has no declared pricing — check the project's own site. Vnsh has no declared pricing — check the project's own site. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add tailscale-mcp-server-2 and vnsh as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Tailscale MCP Server has a quality signal of 64/100 (Good) with 0 views, 0 installs and 34 GitHub stars. Vnsh has 64/100 (Good) with 1 views, 0 installs and 158 GitHub stars.