Repository navigation
Tailscale: tagging tag:grokbot drops the session; reconnect mints a new untagged device #1172
Description
Summary
On a personal Tailscale tailnet, applying tag:grokbot to the Grok Bot device immediately drops its session. Reconnecting via Authenticate mints a new device that is again untagged. Least-privilege ACL/grants that target only tag:grokbot therefore never take effect in practice.
Steps to reproduce
- Install/connect the Tailscale plugin so Grok Bot joins the personal tailnet (device appears, typically named like
grokbot-user-…). - In Tailscale admin, set device tags to
tag:grokbot(withtagOwnersallowing that tag). - Observe the Grok Bot Tailscale session disconnects / device goes offline.
- Authenticate / Sign in again from Grok Bot.
- A new Grok Bot device appears on the tailnet — still untagged (owner access).
- Repeat: tagging again → disconnect → reconnect → another new untagged device.
Expected
Either:
- tagging
tag:grokbotkeeps the same device online and tagged, so grants likesrc: ["tag:grokbot"]→ MCP host:port work; or - reconnect after tagging re-joins as the same tagged device (or re-applies the tag automatically).
Actual
Tagging forces a disconnect; each reconnect creates a fresh untagged machine. The documented least-privilege path (tag:grokbot + narrow grants) is effectively unenforceable for personal tailnets. Workaround today is owner-access (untagged) plus host/IP grants, which is broader than intended.
Notes
- MagicDNS names in grants were rejected as invalid in our policy; we used the Tailscale IP (
100.x) instead — separate friction, may be worth documenting. - Plugin docs /
tailscale-setupskill presenttag:grokbotas the least-privilege path; this loop contradicts that. - Related but different: Tailscale plugin: support inbound to the Grok Bot box, or a Tailscale node that survives resets #774 (inbound to the box / node surviving resets).
Environment
- Grok Bot Tailscale plugin (
third_party/tailscale) - Personal tailnet (incremental.coach /
*.ts.net) - Goal: reach a private MCP on the tailnet with grants limited to
tag:grokbot
Activity
deanrie commentedon Nov 5, 2026
@sinanawad for context on the docs side: the
tag:grokbotpath was removed from the plugin shortly before this was filed. Tailscale plugin 1.0.5 (#1167, merged 03.11) says "Personal tailnets connect only through one-click Connect; thetag:grokbotsign-in path is gone", and #1171 took it out of the README the next morning.On current
main,third_party/tailscale/README.mdand the setup skill describe a personal tailnet device as joining untagged with the member's own access. The scoped setup they describe is the company tailnet (Tailscale Premium or Enterprise, enabled at cursor.com Integrations → Tailscale). There, each member's Grok Bot device carries thecustom:grokbotattribute and is limited with aposture:grokbotposture rather than a tag.So the README no longer offers a tag-based least-privilege setup for personal tailnets. What you describe matches that: a re-authenticated device comes back untagged. If narrowing a personal-tailnet device is meant to be supported, that would be a product request rather than a docs fix. Host and port grants on the member's own identity, as you did, are the closest option on a personal tailnet for now.
sinanawad commentedon Nov 5, 2026
Thanks for the quick and detailed response, as you have may understood - the issue was opened by my bot, after it researched ways for the tailscale connection to be safer and it failed. I'll try and see where to report this regression/feature.
Thanks again, keep up the great work!