August 2025 Summaries

During Hack Week 2025 at Tailscale, developers set aside their regular tasks to create innovative projects, some of which might be integrated into future products. Notable projects included a Linux system tray client for Tailscale applications, a roommate laundry notification system called Laundromates, and a solar-powered satellite internet setup. Additionally, community engagement was enhanced through a Reddit AMA with developer Simon Law. Other significant contributions involved improvements to Tailscale’s session recorder, the development of a read-only NFS server for faster Go builds, a proof-of-concept video streaming app, a Tailscale app for Garmin watches, a repository of standardized UI components, and exploratory work on PostgreSQL connectivity. These projects not only showcased the team's creativity but also hinted at potential future enhancements to Tailscale's offerings.

Dynamic Client Registration (DCR) is a key recommendation of the Model Context Protocol (MCP) Authorization Spec, designed to simplify client and server deployments by automating the registration process through an API rather than manual operations across various identity provider portals. Despite its potential, DCR has not seen widespread adoption, particularly among major public OAuth servers, due to its relatively rare use cases until the recent rise of MCP servers, especially those used for AI agents. Tailscale, through its tsidp service, aims to simplify this process by enabling secure DCR that leverages existing single sign-on identity providers for authentication while maintaining access control through user identities. For internal MCP servers, Tailscale offers a streamlined security alternative by directly checking Tailscale identities, bypassing the need for an OAuth server. However, as MCP deployments grow more complex, particularly with intermediary agents, there is a need for a more robust solution such as STS Token Exchange, which Tailscale is working to support. Tailscale invites developers working on MCP use cases to join their efforts in enhancing their tsidp authorization server to better cater to the specific needs of secure MCP and AI agent deployments.

Tailscale's recent updates focus on enhancing network reliability, manageability, and security with the introduction of a visual policy editor, data encryption at rest, and integration with Grafana Cloud. The visual policy editor, currently in beta, offers a user-friendly alternative to the HuJSON format, allowing users to manage tailnet access permissions through web-based tools. The encryption of data at rest secures the state file on disk, mitigating risks from attackers with disk access. The partnership with Grafana enables secure connections of data sources within a tailnet to a Grafana Cloud stack, avoiding exposure to the public internet. Additionally, a series of client updates in versions 1.86.0, 1.86.2, and 1.86.4 enhance security and stability across platforms, including fixes for Android, iOS, Windows, and macOS systems. The 1.86.5 release also brings improvements to containers, Kubernetes, and tsrecorder, with updates like enhanced direct connectivity in Kubernetes and the introduction of the Tailscale Kubernetes proxy.

Tailscale has launched a new Community Discord server to facilitate real-time discussions among developers, hobbyists, and enthusiasts who use their services. This new platform is intended to complement existing channels like Reddit and GitHub by providing a space for casual conversation, showcasing projects, and obtaining quick feedback on topics such as access controls, DNS issues, and CI/CD workflows. The Discord server is not a marketing tool or a replacement for official support channels but rather a community-driven space where users can share experiences and help each other. While acknowledging that Discord may not suit everyone's preferences for communication, Tailscale emphasizes that it remains an additional option for engagement, with ongoing plans for further community interaction like AMAs and live demos.

The blog post explores how Tailscale, a VPN service, can be combined with Wake-on-LAN (WoL) technology to remotely wake devices that are asleep or powered off, despite Tailscale's inability to send WoL packets directly. It explains that WoL packets, which function at the data link layer (Layer 2) of the OSI model, require the MAC address of a device to "wake" it, while Tailscale operates at the network layer (Layer 3). To bridge this gap, the post suggests using a Raspberry Pi or a similar device to send WoL packets by installing Tailscale and the etherwake tool. Additionally, the post introduces UpSnap, a self-hosted web application that provides a user-friendly interface for sending WoL packets via a browser, which can be accessed through Tailscale from any location. This method simplifies remote device management and enhances accessibility by offering a more intuitive alternative to command-line tools.

Starting with version 1.86, the Tailscale client introduces the ability to encrypt its state file while stored on disk, enhancing security by making it more challenging for attackers to clone nodes or alter client settings. This encryption focuses on safeguarding private keys necessary for node identification and communication with the coordination server. The feature addresses threats from attackers with root access to the filesystem, but not those capable of reading process memory or executing code as root. Different operating systems implement this encryption through various means: Windows and Linux use TPMs, Apple devices utilize Keychain, and Android employs EncryptedSharedPreferences. While state files on Apple and Android have always been encrypted, the standalone macOS variant and Windows/Linux are seeing these changes as optional "Alpha" features, not enabled by default yet, as Tailscale seeks user feedback before a full rollout. Users can manually activate encryption on these platforms, and Tailscale plans to make it standard in future updates if no major issues arise.

Tailscale is a secure connectivity tool designed to prioritize privacy over anonymity, offering end-to-end encrypted connections between devices while clearly stating that it is not an anonymity service like Tor. The platform focuses on maintaining the privacy of user data by not inspecting or logging browsing activities and ensuring no monetization of personal data, relying instead on a business model supported by paying customers. Tailscale collects minimal telemetry necessary for the operation and improvement of its service, such as IP addresses and connection diagnostics, but openly acknowledges that it knows user identities and connection metadata due to its identity-centric network architecture. While Tailscale provides private, encrypted connections insulated from the broader internet, it advises users seeking complete anonymity to consider other solutions, emphasizing transparency about its capabilities and limitations.

Tailscale has introduced a visual policy editor in beta, enabling users to manage access permissions for their tailnet through a more user-friendly interface compared to the traditional HuJSON policy file. This new tool provides a tabular view that allows users to add, edit, and delete policy entries using visual forms, complementing existing management methods such as direct editing in the admin console, GitOps, Terraform, or the REST API. The visual editor maintains the flexibility of HuJSON, preserving document comments and allowing users to toggle between visual and traditional formats, with features like live previews for complex sections to assist with syntax. For those using GitOps or Terraform, the editor can be locked to prevent conflicts, but emergency changes can be made by unlocking the editor and ensuring updates sync with GitOps or Terraform configurations. The company encourages feedback on this new feature, emphasizing its aim to enhance user experience by simplifying policy management.

Lee Briggs, Director of Solutions Engineering at Tailscale, discusses the evolution and security challenges of the Model Context Protocol (MCP) in the context of integrating local information into Large Language Models (LLMs). Briggs highlights the rapid development of MCP, noting that initial designs focused on secure local connectivity through stdio transport, with later iterations introducing remote access via Server Side Events (SSE) and eventually Streamable HTTP. Despite advancements, Briggs expresses concerns about security vulnerabilities, particularly the lack of robust authentication measures and potential exposure of sensitive data on the internet. Drawing from his experience at Tailscale, he explores using Tailscale's application awareness to enhance MCP's security model, proposing a setup that leverages Tailscale for secure, private connections. Briggs acknowledges the tension between participating in technological advancements and addressing privacy concerns, emphasizing his commitment to building more secure systems while questioning the broader implications of data accessibility to LLMs.