AgentIndex icon
AgentIndex
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompareGuides
Submit Tool
ToolsMCP ServersHOTCategoriesTrendingNewBest ListsCompare
Home/
Security & Safety/
tsidp
tsidp logo

tsidp

Active·★ 684·BSD-3-Clause·Updated 2026-10-21
★ Hidden Gem

`tsidp` is an experimental OpenID Connect (OIDC) and OAuth Identity Provider that integrates with your Tailscale network, enabling applications to authenticate users using their Tailscale identities. It supports both OIDC-compatible applications and authenticated MCP client/server connections, offering flexible deployment options via Docker or direct Go execution.

tsidp sits in the Security & Safety category, so it is usually better judged by workflow fit, deployment style, and team needs than by isolated features alone. Based on the available metadata, it leans most clearly toward Functions as an OIDC/OAuth Identity Provider tightly integrated with your Tailscale network.. A representative use case is Centralized authentication for self-hosted applications within a Tailscale network.. The listed license is BSD-3-Clause. GitHub stars are currently 683. Relevant tags include OpenID Connect, OAuth.

© 2026 AgentIndex.app|Built by a 10-year iOS Developer.
Best by use caseAboutContactAdvertisePrivacy PolicyTerms of UseQYSGitHubBuy me a coffee ☕

Browse by Category

MCP ServersCode AssistantWorkflow AutomationRAG / Knowledge BaseMulti-AgentBrowser AutomationLLM InfraDev ToolingObservability

Not affiliated with Anthropic, OpenAI or Microsoft.

Guides

This write-up is based on the project's README and public repository data. We have not hand-tested the tool.

#OpenID Connect#OAuth#Identity Provider#Tailscale#Authentication#Docker#Access Control
$ Install
$ echo 'services: tsidp: container_name: tsidp image: ghcr.io/tailscale/tsidp:latest volumes: - tsidp-data:/data environment: - TAILSCALE_USE_WIP_CODE=1 - TS_STATE_DIR=/data - TS_HOSTNAME=idp - TSIDP_ENABLE_STS=1 # Optional: Tailscale auth key for automatic node registration # - TS_AUTHKEY=tskey-auth-xxxxx # REPLACE WITH YOUR_TAILSCALE_AUTHKEY volumes: tsidp-data:' > compose.yaml && docker compose up -d
↗ Visit site★ GitHub
01

Features

01Functions as an OIDC/OAuth Identity Provider tightly integrated with your Tailscale network.
02Authenticates applications and services using existing Tailscale identities.
03Supports OpenID Connect and OAuth protocols, including Dynamic Client Registration (DCR) and Secure Token Service (STS).
04Offers robust access control through Tailscale Application capability grants for UI and DCR endpoints.
05Deployable with Docker, Docker Compose, or as a Go application, supporting persistent state storage.
02

Why choose it

+Functions as an OIDC/OAuth Identity Provider tightly integrated with your Tailscale network.
+Authenticates applications and services using existing Tailscale identities.
+Centralized authentication for self-hosted applications within a Tailscale network.
+Supports 5 platforms or runtime environments.
03

Trade-offs

!The final decision should still be made through side-by-side comparison with similar tools.
04

Compatibility

Docker
Deployment
Verified via docs
Tailscale
Integration
Verified via docs
OpenID Connect
Protocol
Verified via docs
OAuth
Protocol
Verified via docs
Go
Runtime
Verified via docs
05

Quick start

1
$ echo 'services:
2
$ tsidp:
3
$ container_name: tsidp
4
$ image: ghcr.io/tailscale/tsidp:latest
5
$ volumes:
6
$ - tsidp-data:/data
7
$ environment:
8
- TAILSCALE_USE_WIP_CODE=1
06

Use cases

↳Centralized authentication for self-hosted applications within a Tailscale network.
↳Integrating SaaS products with Tailscale identities by exposing tsidp via Tailscale Funnel.
↳Acting as an Identity Provider for platforms like Proxmox, Grafana, or Jellyfin.
↳Enabling secure client/server authentication based on the Model Context Protocol (MCP).
07

Alternatives

⚡Top VS:
VSsatgate★11→VSshellgate★15→VSHealthClawGuardrails★31→VS

Comments

Log in to leave a comment

No comments yet. Be the first!

On this page
01Features02Why choose it03Trade-offs04Compatibility05Quick start06Use cases
$
9
$ - TS_STATE_DIR=/data
10
$ - TS_HOSTNAME=idp
11
$ - TSIDP_ENABLE_STS=1
12
$ # Optional: Tailscale auth key for automatic node registration
13
$ # - TS_AUTHKEY=tskey-auth-xxxxx # REPLACE WITH YOUR_TAILSCALE_AUTHKEY
14
$ volumes:
15
$ tsidp-data:' > compose.yaml
16
$ docker compose up -d
authmcp-gateway
★12
→
satgate logo
satgate★ 11
The Economic Firewall for AI Agent Requests
VSCompare→
shellgate logo
shellgate★ 15
Self hosted secure gateway for AI agents. One token. Full control. Complete audit trail.
VSCompare→
HealthClawGuardrails logo
HealthClawGuardrails★ 31
Open-source guardrails between AI agents and FHIR clinical data — PHI redaction, immutable audit, step-up auth, tenant isolation. MCP server + OpenAI/Gemini adapters. A healthclaw.io project.
VSCompare→
authmcp-gateway logo
authmcp-gateway★ 12
🔐 Secure authentication proxy for MCP servers with JWT auth, real-time monitoring, and admin dashboard. Production-ready Docker deployment.
VSCompare→
helio logo
helio★ 14
Governance proxy for MCP: block or hold AI agent tool calls on their arguments, route approvals with the arguments shown, enforce rules the model cannot argue with, require prerequisites, cap cumulative spend across tools and servers, and audit every call. No changes to agent code or MCP servers.
VSCompare→
lexware-mcp logo
lexware-mcp★ 42
Open-source, self-hostable MCP server for the Lexware Office (lexoffice) accounting API — comprehensive coverage: contacts, articles, bookkeeping vouchers, the sales-document family (invoices/quotations/credit-notes, draft + finalize), and file/PDF upload & download. OAuth, Cloud Run; connects to Claude & ChatGPT.
VSCompare→
unifi-network-mcp logo
unifi-network-mcp★ 943
MCP server implementation for the UniFi network application
VSCompare→
scopegate logo
scopegate★ 18
AI Access Proxy Layer — granular permission gateway for AI agents. Connect services, define scopes, get an MCP endpoint.
VSCompare→
See all alternatives →
07
Alternatives
tailscale /
tsidp
↗

A simple OIDC / OAuth Identity Provider (IdP) server for your tailnet.

684BSD-3-Clause
Last commit2d ago
StatusActive
CategorySecurity & Safety
Links
Documentation↗Discussion↗Issues↗Releases↗
Cloud Infrastructure
Ad

Deploy on DigitalOcean

Host your MCP servers, Docker containers, and AI agents with $200 free credit over 60 days.

Claim $200 Free Credit