tailscale-muse-connector

A Tailscale API connector for Muse. Lets the assistant manage your tailnet from chat — list devices, generate auth keys, read tailnet settings — without pasting API tokens into code.

How it works

• Drop SKILL.md and bin/ into your Muse workspace skills as ~/workspace/skills/tailscale/.
• bin/ts_api.py is a thin CLI over https://api.tailscale.com/api/v2.
• Authentication uses a vault-stored Tailscale API access token, attached at request time as an Authorization: Bearer header through a runtime surrogate. The raw token never appears in this repo, in logs, or in the code.

Usage

bin/ts_api.py tailnet/-/devices
bin/ts_api.py tailnet/-/devices --param fields=default
bin/ts_api.py tailnet/-/keys --method POST --data '{"capabilities": {"devices": {"create": {"reusable": false, "ephemeral": true, "preauthorized": true, "tags": ["tag:server"]}}}, "expirySeconds": 3600}'

Run bin/ts_api.py --help for full usage.

Setup

1. In the Tailscale admin console, go to Settings → Keys and generate an API access token (tskey-api-...).
2. Store it in your Muse vault as the custom.tailscale credential. Authenticated requests are restricted to api.tailscale.com.

Note: personal API access tokens expire 1–90 days after creation (your choice at creation time). When the token expires, generate a fresh one and replace the stored credential.

Files

• SKILL.md — the skill definition Muse reads.
• bin/ts_api.py — the API client CLI.
• bin/dynamic_credentials.py — the surrogate credential helper (shared with the github-muse-connector).

Safety

• Destructive actions (deleting devices, changing ACL/policy, rotating keys, expiring sessions) require explicit user approval — the skill says so in its operating rules.
• No secrets are committed here. The .gitignore excludes anything that could hold one.