Ask which machines on your tailnet are offline, and whose device keys expire soon.
Connect Tailscale with an API access token and Memtro reads the devices on your tailnet with owner, addresses, tags, online state and key expiry, people and settings. Tokens and auth keys are listed as metadata only, never their secret values. It reads on demand and there is no hourly sync. When asked, and once an administrator has granted the action by name, it can authorise or de-authorise a device, rename it, replace its tags, set its subnet routes, turn key expiry off or on, and remove a device from the tailnet. Each takes effect at once.
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Tailscale tool, reads what it needs, and answers with the source cited.
These tools change something in Tailscale. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Tailscale, choosing the same kinds; the tab shows Tailscale's own steps. Each event can start a job, with the event as its input. Tailscale signs every delivery, and one whose signature does not check out is refused before it is read.
Events and webhooksOnce Tailscale is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
Which machines on the tailnet are offline right now?
Whose device keys expire this month?
What is the Tailscale address of the build server?
Which auth keys exist, and which of them are reusable?
Remove the contractor's laptop from the tailnet
On Monday the platform lead asks which device keys expire before the end of the month. Memtro lists six devices with their owners and expiry dates, including Dan Fletcher's laptop on Thursday and two build runners tagged ci that are already offline.
After a contractor leaves Acme, Priya Sharma asks Memtro to take his two devices off the tailnet. Memtro names both back to her, then removes them, so they lose access at once and would have to log in and be approved again to return.
The teams that lean on Tailscale most, a question each of them asks, and what they connect beside it.
A record in Tailscale is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
UptimeRobot
Honeycomb
Cronitor
FireHydrant
StatusCake
GlitchTip
GLPI
Langfuse
LibreNMS
NetBox
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert
JumpCloud
ConfigCat
Split
Aikido Security
Astronomer
Comet Opik
CrowdStrike Falcon
Detectify
Domotz
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary
NinjaOne
Northflank
Portkey
PromptLayer
PRTG Network Monitor
Raygun
Retell AI
Runpod
Shodan
Spike.sh
Squadcast
Tenable
UpGuard
Uptime.com
Vanta
Zenduty
Cortex
WorkOS
Kandji
Automox
Huntress
SimpleMDM
Healthchecks.io
Rapid7 InsightVM
ZenhubIn login.tailscale.com open Settings → Keys and, under API access tokens, choose Generate access token. Only an Owner, Admin, IT admin or Network admin can make one, and the token reads and changes devices as its owner can
Give it a description and an expiry of 1 to 90 days, then copy it: it is shown once, cannot be renewed and must be replaced with a new token when it expires
Paste the API access token into Connections → Tailscale in Memtro. Leave Tailnet name blank to use the token's own tailnet, or type the name shown top left of the admin console, such as tail1234.ts.net
Ask which devices have keys expiring this month
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Tailscale tools are the same everywhere.
Only when you ask, and only what it has been granted: authorise or de-authorise a device on the tailnet; rename a device; replace a device's ACL tags; set a device's enabled subnet routes; turn a device's key expiry off or back on; remove a device from the tailnet. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
API access token. In login.tailscale.com open Settings → Keys and, under API access tokens, choose Generate access token. Only an Owner, Admin, IT admin or Network admin can make one, and the token reads and changes devices as its owner can.
Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Tailscale, choosing the same kinds; the tab shows Tailscale's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.
Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.
7-day free trial · card on file, nothing charged until it ends · cancel any time
