Tailscale Aperture MCP – Secure Tool Proxy
Tailscale Aperture can act as an MCP server proxy for AI agents, aggregating tools and resources from configured remote MCP servers behind a single endpoint. Use it when teams need centralized MCP access, tailnet-aware connectivity, and Tailscale grants for controlling which users can reach specific tools.
Overview
Tailscale Aperture is an AI access gateway from Tailscale. Its MCP server proxying capability lets an Aperture instance present a single MCP endpoint to AI agent clients while connecting onward to one or more remote MCP servers. The documented client endpoint is http://<aperture-hostname>/v1/mcp, where <aperture-hostname> is the MagicDNS name of the Aperture instance.
This provider is useful when the MCP servers themselves should remain private, local, or reachable only from a tailnet, while agents connect through a controlled Tailscale entry point. Aperture acts as an MCP server to the agent and as an MCP client to configured remote MCP servers.
What the MCP server enables
Aperture aggregates tools, resources, and resource templates from configured remote MCP servers. Each configured server receives a server ID, and Aperture prefixes tool names with that ID, such as local_search or remote_get_user, to prevent naming collisions. It can also register the built-in internal_current_time tool when granted.
Key documented capabilities include centralized tool access, dynamic tool discovery, server name prefixing, runtime registration through /v1/mcp/register, and compatibility handling for remote servers that support either Streamable HTTP or legacy SSE.
When to use it
Use Tailscale Aperture MCP server proxying when an organization wants AI agents to access private MCP tools without giving every client a direct connection to every server. Practical workflows include exposing internal database-search tools, code or operational tools hosted on tailnet devices, or locally running MCP servers through one controlled endpoint.
It is especially useful for teams that already use Tailscale identity, MagicDNS, and grants, because MCP access can be managed alongside model access rather than configured separately per agent.
Connection and authentication
Agent clients connect to http://<aperture-hostname>/v1/mcp. Aperture automatically detects whether the client uses current Streamable HTTP or legacy SSE and responds accordingly. Remote MCP servers are configured in the Aperture dashboard under an mcp.servers map, using URLs such as http://localhost:8185/v1/mcp or http://mcp-server.example.ts.net:8080/v1/mcp.
Access is controlled by Tailscale identity and Aperture grants, not by a static API key in the MCP client configuration. MCP grants are deny-by-default and can allow mcp_tools, mcp_resources, and mcp_templates with glob patterns such as local/* or **.
Key considerations
Tailscale documents Aperture MCP server proxying as alpha and Aperture's MCP grant support as experimental, so configuration syntax may change. Users need Aperture enabled on their tailnet, at least one reachable remote MCP server, and appropriate access grants. Without MCP grants, users cannot access any MCP capabilities. When defining grants in a tailnet policy file rather than Aperture configuration, the destination must specify the Aperture device, or the grant has no effect.
Supported Transports
streamable_http
URL: http://<aperture-hostname>/v1/mcp
sse
URL: http://<aperture-hostname>/v1/mcp
Frequently Asked Questions
- When should an AI agent use Tailscale Aperture MCP server proxying?
- Use it when an agent needs a single controlled endpoint for multiple private MCP servers, especially when those servers are local, inside a tailnet, or should be governed by Tailscale identity and Aperture grants.
- What does Tailscale Aperture add to an AI agent's MCP capabilities?
- It gives the agent an aggregated view of tools and resources from configured remote MCP servers through `/v1/mcp`, with server-name prefixes to prevent collisions and optional dynamic registration for servers that come and go.
- What can the AI agent access or manage through this MCP provider?
- The agent can access only the MCP tools, resources, and resource templates that Aperture has aggregated from registered remote servers and that the user's MCP grants allow. Aperture also documents a built-in `internal_current_time` tool when access is granted.
- How is authentication configured for Tailscale Aperture MCP access?
- The client connects to the Aperture host on the tailnet, and access is governed by Tailscale identity, network access to the Aperture device, and Aperture grants such as `mcp_tools`, `mcp_resources`, and `mcp_templates`. The documented MCP client example does not use a bearer API key header.
- Which transport should be used for Tailscale Aperture MCP server proxying?
- Use Streamable HTTP for current MCP clients connecting to `http://<aperture-hostname>/v1/mcp`. Aperture also supports legacy SSE on the same endpoint for backward compatibility and automatically detects the client transport.