Agent Plugins Marketplace
← All plugins

tailscale-wif

v1.0.0

Set up and troubleshoot secretless GitHub Actions -> Tailscale auth via Workload Identity Federation (WIF): GitHub OIDC exchanged for short-lived Tailscale tokens, with no stored API keys or OAuth secrets.

Claude Code1 Skill

By Jordan RichlenLicense: MIT1 GitHub starsUpdated 1 hour ago

Directory evidence

Runtimes
Claude Code
Parsed components
1 skill or MCP entry
Source updated
Sep 24, 2026
Manifest status
Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install tailscale-wif for Claude Code

Installs for the current user
claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install tailscale-wif@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually
git clone https://github.com/JRichlen/agent-plugins

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/tailscale-wif/.

Plugin files

plugins/tailscale-wif/
├── .claude-plugin/plugin.json
└── skills/tailscale-wif/SKILL.md

Included Skills1

tailscale-wifskills/tailscale-wif/SKILL.md

Set up and troubleshoot SECRETLESS GitHub Actions -> Tailscale authentication using Workload Identity Federation (WIF): each run mints a GitHub OIDC token that a Tailscale "Trust Credential" exchanges for a short-lived API token or ephemeral auth key, so no Tailscale API key or OAuth client secret is ever stored. Use this WHENEVER a GitHub Actions workflow needs to talk to Tailscale — pushing an ACL/policy file with tailscale/gitops-acl-action, or joining a CI runner to the tailnet with tailscale/github-action — and you want to drop the stored credential, OR when such a workflow is failing with "token exchange failed with status 403: Unauthorized", "requested tags are invalid or not permitted", or "only one of API Key, OAuth secret, or OAuth client ID and audience". Reach for it on phrases like "Tailscale OIDC", "Tailscale WIF", "federated identity Tailscale", "secretless Tailscale in CI", "remove the Tailscale API key / OAuth secret from Actions", or "Tailscale Trust Credential".

Plugin manifests1

plugins/tailscale-wif/.claude-plugin/plugin.json
{
  "name": "tailscale-wif",
  "version": "1.0.0",
  "description": "Set up and troubleshoot secretless GitHub Actions -> Tailscale auth via Workload Identity Federation (WIF): GitHub OIDC exchanged for short-lived Tailscale tokens, with no stored API keys or OAuth secrets.",
  "author": {
    "name": "Jordan Richlen"
  },
  "repository": "https://github.com/JRichlen/agent-plugins",
  "homepage": "https://github.com/JRichlen/agent-plugins/tree/main/plugins/tailscale-wif",
  "license": "MIT",
  "keywords": [
    "tailscale",
    "github-actions",
    "oidc",
    "workload-identity-federation",
    "secretless",
    "ci-cd"
  ],
  "skills": "./skills/",
  "commands": "./commands/",
  "agents": [
    "./agents/tailscale-wif-setup.md"
  ]
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[tailscale-wif on Agent Plugins Marketplace](https://pluginsmp.com/plugins/tailscale-wif)