Sanaf AI
Start free
IT Operations

Tailscale, worked by an AI employee

Not another app for your team to learn, and not a set of rules for you to build. You hire an AI employee, you give it access to your Tailscale account, and you ask it for things in Slack or Teams the way you would ask anyone else on the team. There is nothing to map and nothing to maintain.

  • IT Operations
  • Connects with a key
  • 10 ready-made tools
  • Asked in Slack or Teams
At work

An illustration of how the conversation reads, not a transcript from a client account.

What Tailscale is

Tailscale is a secure networking platform for managing tailnets, devices, users, DNS, access policies, services, and other network administration resources.

You paste in a key from your own Tailscale account. It is kept encrypted, and you can withdraw it from inside Tailscale whenever you like.

How a run works

One message in, the work done in Tailscale.

  1. 01

    You ask

    You message your AI employee in the chat your team already has open, in one sentence, in your own words.

  2. 02

    It works out the step

    It decides what the job needs in Tailscale. You do not pick anything from a menu or wire anything together.

  3. 03

    It does the work

    Signed in to your own Tailscale account, inside the access you granted it, doing the thing you asked for.

  4. 04

    It reports back

    It tells you what it did, in the same thread. If it could not do something, it says so rather than guessing.

10 tools it already has

What it can do in Tailscale

These are the ready-made tools your AI employee already has in Tailscale. It is not limited to them, but it never has to be taught these.

  • Get DeviceGet the full current record for one manageable Tailscale device by ID.
  • Get DNS ConfigurationReturn the selected tailnet's combined MagicDNS, nameserver, search-path, and split-DNS configuration.
  • Get Tailnet SettingsReturn current tailnet-wide approval, update, key-duration, HTTPS, routing, logging, and posture settings.
  • List Configuration Audit LogsReturn configuration audit events for an explicit RFC3339 time window in the selected tailnet, optionally filtered by actor, target, or event name.
  • List Device RoutesReturn the subnet routes advertised and currently enabled for a Tailscale device.
  • List Tailnet DevicesReturn all devices in the selected tailnet, including identifiers, names, addresses, tags, authorization state, and connectivity metadata. Supports exact server-side filtering by h
  • List UsersReturn users in the selected tailnet, optionally filtered by membership type or role.
  • Set Device AuthorizationApprove or revoke approval for one device when device approval is enabled on the tailnet.
  • Set Device RoutesReplace the enabled subnet routes for one device with an explicit list of routes. Routes may be enabled before the device advertises them.
  • Set Device TagsReplace all ACL tags assigned to one Tailscale device.
Access, and who is in charge of it

You stay the boss of your Tailscale account.

Nothing connects until you approve it. You grant access one app at a time, you can take it back the same way, and everything your AI employee does in there is written down where you can see it.

How we handle your data
  • It signs in to your own Tailscale account. You are not moving anything into ours.
  • You grant access one app at a time, and you can take it back the same way.
  • Everything it does in Tailscale is written down, with what it did and when.
  • Anything you tell it to check with you first, it checks with you first.
Other apps in the same corner of the business

It works in Tailscale and the rest of your software in the same job

A real job rarely stays in one place. Reading a message in one app, checking a record in another and writing the result in a third is one request to your AI employee, not three.

See every app

Questions people ask about Tailscale

Can an AI employee really work inside Tailscale?
Yes. It signs in to your own Tailscale account and works in it the way a new hire would, from the chat your team already has open. Nobody installs anything, and nobody learns a new screen.
Do I have to move anything out of Tailscale?
No. Nothing moves and nothing is replaced. Your records stay in Tailscale, your team carries on in the same screens they used yesterday, and your AI employee works alongside them in there.
How does it get into my Tailscale account?
You paste in a key from your own Tailscale account. It is kept encrypted, and you can withdraw it from inside Tailscale whenever you like. You approve it before anything connects, and you can take the access back the same way you gave it.
What can it actually do in Tailscale?
It has 10 ready-made tools in Tailscale today, among them Get Device, Get DNS Configuration and Get Tailnet Settings. The full list is on this page. It is not limited to those, but it never has to be taught them.
Can it use Tailscale and the rest of my software in the same job?
Yes, and that is usually the point. Reading a message in one app, checking a record in Tailscale and writing the result somewhere else is one request to your AI employee, not three separate ones you stitch together.
Who decides what it is allowed to do in Tailscale?
You do. You grant access one app at a time and can withdraw it at any time, anything you ask it to check with you first it checks with you first, and everything it does in Tailscale is written down with what it did and when.