Tailscale ships Aperture, letting AI agents add nodes and SSH in

Aperture started out as a way to avoid scattering AI API keys across a network. By holding the keys at the gateway, Tailscale let any node inside a Tailnet reach an AI service through Aperture, effectively wiring AI into the VPN. Since then Tailscale has layered more onto it: cost management for AI services, guardrails, audit logging, an MCP (Model Context Protocol) proxy, and an API proxy. Tokens for AI models can now also be bought inside Aperture, so token management sits in the same place.

The new additions push in the opposite direction — from AI as a service on the network to AI as an operator of it. Tailscale MCP and Tailscale SSH MCP give an agent the ability to modify the network itself, adding nodes and connecting into them over SSH to run services or deploy software. Because connected AI services like Claude, Gemini, or local models know nothing about the user's Tailscale network, Tailscale supplies its own chat UI so the underlying agent can pick up the right MCP tools automatically.

The guardrails are the part worth watching. Tailscale says existing access-control settings hold, new machine additions need human approval, and everything is logged — so the practical question is whether agent-driven deployments stay inside those limits as the agent gets more to do. For teams already running a Tailnet, the appeal is handing repetitive server work to an agent without handing over unrestricted access.