---
title: "Tailscale integration for LuumenAI"
url: "https://www.luumen.ai/integrations/tailscale/"
entity: SoftwareIntegration
category: "Identity & security"
audience: "SRE, DevOps, platform engineering, IT operations"
---

# Tailscale integration for LuumenAI

Read your tailnet in full, then change device approval, routes, and tags with review.

## What LuumenAI can do with Tailscale

LuumenAI connects to Tailscale with an API token and exposes 10 tools (7 read-only · 3 write). Reads answer immediately; writes are shown as a plan and require approval by default, configurable per tool by an administrator.

## Key facts

- Authentication: API token
- Tools available: 10 tools (7 read-only · 3 write)
- Plan: available on all plans
- Category: Identity & security

## About Tailscale with LuumenAI

Connect Tailscale and your agent can see the whole tailnet: every device with its addresses, tags, and authorization state, the subnet routes each node advertises, DNS and tailnet-wide settings, users, and configuration audit events for a given window. Changes to device approval, enabled routes, and ACL tags are previewed and go through approval first.

## Example tools

Read-only (7 in total):

- `TAILSCALE_GET_DEVICE` — Get the full current record for one manageable Tailscale device by ID.
- `TAILSCALE_GET_DNS_CONFIGURATION` — Return the selected tailnet's combined MagicDNS, nameserver, search-path, and split-DNS configuration.
- `TAILSCALE_GET_TAILNET_SETTINGS` — Return current tailnet-wide approval, update, key-duration, HTTPS, routing, logging, and posture settings.
- `TAILSCALE_LIST_CONFIGURATION_AUDIT_LOGS` — Return configuration audit events for an explicit RFC3339 time window in the selected tailnet, optionally filtered by actor, target, or event name.
- `TAILSCALE_LIST_DEVICE_ROUTES` — Return the subnet routes advertised and currently enabled for a Tailscale device.
- `TAILSCALE_LIST_TAILNET_DEVICES` — Return all devices in the selected tailnet, including identifiers, names, addresses, tags, authorization state, and connectivity metadata.
- `TAILSCALE_LIST_USERS` — Return users in the selected tailnet, optionally filtered by membership type or role.

Write and destructive (3 in total, approval required by default):

- `TAILSCALE_SET_DEVICE_AUTHORIZATION` — Approve or revoke approval for one device when device approval is enabled on the tailnet.
- `TAILSCALE_SET_DEVICE_ROUTES` — Replace the enabled subnet routes for one device with an explicit list of routes.
- `TAILSCALE_SET_DEVICE_TAGS` — Replace all ACL tags assigned to one Tailscale device.

## Frequently asked questions

### How does LuumenAI connect to Tailscale?

Authorize once with API token. Luumen lists the scopes each action needs before you approve the connection, and credentials never appear in the chat.

### Can LuumenAI change things in Tailscale on its own?

Read actions answer immediately. Anything that writes is shown as a plan and requires approval by default. Administrators configure that per tool.

### Is there an audit trail?

Every call to Tailscale — read or write, approved or declined — is recorded with the actor, the input, and the result.

Full page: https://www.luumen.ai/integrations/tailscale/