tailscale-setup

Imported from cursor/plugins (third_party/tailscale/skills/tailscale-setup/SKILL.md). Install upstream with npx skills add cursor/plugins --skill tailscale-setup. Copyright stays with the author.

Tailscale setup for Grok Bot

Grok Bot joins the user's tailnet as one device tagged tag:grokbot. It can reach only the hosts and ports the tailnet policy file grants to that tag, so set up the policy before signing in.

On a team's company tailnet, which a Grok Bot team admin turns on in the Tailscale plugin, each member connects their own Grok Bot device from the team row instead, and no tag:grokbot policy is needed. If signing in on the personal row fails with a tag:grokbot error on a company tailnet, use the company tailnet.

1. Define the tag and grant access

In the Tailscale admin console, open Access controls and edit the policy file:

• Add tag:grokbot to tagOwners, listing the user who will sign in (or autogroup:admin).
• Add a grant from tag:grokbot to only the MCP hosts and ports Grok Bot should reach. Nothing else.

{
  "tagOwners": {
    "tag:grokbot": ["autogroup:admin"],
  },
  "grants": [
    {
      "src": ["tag:grokbot"],
      "dst": ["mcp-server.tail1234.ts.net"],
      "ip":  ["tcp:443"],
    },
  ],
}

Merge these keys into the existing policy instead of replacing it. Use the user's real host names, 100.x addresses, or tags in dst, and the ports their MCP servers listen on in ip. If the policy still has the default allow-all rule, tag:grokbot can reach every device; point that out and suggest narrowing it.

2. Connect Grok Bot

1. Open the Tailscale plugin in Grok Bot and click Authenticate.
2. Sign in to Tailscale and approve the new device.
3. If device approval is on for the tailnet, approve the device on the Machines page of the admin console.
4. If the tailnet uses Tailnet Lock, sign the device from a signing node (tailscale lock sign <node-key>). It cannot reach anything until it is signed.

3. Add MCP servers

Add each MCP server as usual, using its *.ts.net name or 100.x address as the URL host. Requests to that host go over the tailnet.

Who can use the tailnet

Only messages from the bot owner and linked teammates, and routines the owner schedules, can use the tailnet. Other people messaging the bot cannot.

Disconnect

Click Remove on the Tailscale plugin page in Grok Bot.

Troubleshooting

• Checking whether a host is reachable: use the Tailscale plugin's Check host tool, not curl from the bot computer, which only uses the personal connection. To use a server, add it as an MCP server.
• Cannot reach a host: check that a grant from tag:grokbot covers that host and port, and that the device is approved (and signed, with Tailnet Lock).
• Sign-in cannot apply the tag: the signing-in user is not an owner of tag:grokbot in tagOwners.