Tailscale
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/tailscale-connector
Tailscale
Give every Cinatra dev instance a deterministic public URL through your tailnet. Once set up, each clone automatically gets a Tailscale Funnel URL (e.g. https://my-clone.acme.ts.net) so webhooks, OAuth callbacks, and MCP clients reach your instance without configuring a tunnel each session.
Setup (recommended — OAuth client): In the connector settings, choose OAuth client. In Tailscale, open Trust credentials (login.tailscale.com/admin/settings/trust-credentials), add a Credential → OAuth with Keys (auth_keys) = Write, attach your clone tag (for example, tag:cinatra-clone), and Generate credential. Back in Cinatra, click Connect OAuth client and enter the client ID + secret in the connection service dialog. An OAuth client has no 90-day expiry.
Setup (API access token): Alternatively, paste a Tailscale API access token (tskey-api-…) and choose the same clone tag. API tokens expire after up to 90 days; the connector reminds you as expiry approaches.
Security model: Both modes require a tagOwners entry for your clone tag in the tailnet policy (e.g. owner autogroup:admin). Credentials live in the connection service (Nango); the OAuth secret stays there and is never read by Cinatra or its clones. Each clone mints its own short-lived, tag-scoped, per-node auth-key at start through that service.
Troubleshooting: If connection fails, regenerate the credential and confirm its auth_keys Write scope (OAuth) or Tags scope (API token) matches the tag. If Tailscale rejects the tag (tailscale.tag_denied), confirm it appears under tagOwners in your ACL policy. Detailed error codes go to the server logs.
Works with
- Tailscale (tailnet — any paid or personal plan with API access enabled)
- Cinatra connection service (stores the API token and OAuth credentials)
Capabilities
- Provision a deterministic Funnel URL per dev instance so webhooks, OAuth callbacks, and MCP clients reach it without manual tunnel setup
- Mint per-clone, tag-scoped ephemeral auth-keys automatically on clone start
- Connect via a no-expiry OAuth client (secret stays in the connection service) or a Tailscale API access token
- Display the predicted Funnel URL in the dev tab before the sidecar is provisioned
- Show the tailnet name, clone tag, auth mode, and token expiry reminder in the status view
- Disconnect and remove credential storage from the connection service in one action
- fix: declared cinatra.vendor identity ahead of a marketplace re-submit (#38)
- chore: stripped private tracker references from public source (#35)
- feat: OAuth-client auth mode via the Nango Connect UI ("Design C", shipped flag-off) (#26, #32)
- docs: updated OAuth setup copy for the Trust-credentials flow; expanded README to the org standard (#34, #28)
- ci: ramped the raw-JSX lint block to error and re-vendored the UI-gate preset with the dynamic-import ban; adopted source-leak-gate (#29, #33, #30, #31)
- feat: inline reminder before the 90-day API token expires (#25)
- ci: added the truthful-attribution gate (advisory/WARN mode); adopted the reusable extension→host IoC conformance gate, the tag-driven GitHub release workflow, and secret-scan-gate (#18, #19, #20, #21)
- feat: self-registration at serverEntry activation via capability services; friendlier operation-specific error copy instead of raw action errors; dev-tunnel-status capability registration; dev CLI modules declared in the extension manifest (#6, #7, #10, #14)
- chore: adopted source-leak-gate, SHA-pinned org gate callers, npm packaging hygiene, Renovate config, reusable release-workflow pinning (#1–#5, #8, #9, #11–#13, #15, #16)
- Initial release.
- Unreleased
- chore: stripped private tracker references from workflow comments; pinned the reusable extension-release workflow to the gated version (release-approval wall); declared cinatra.consumes for closure-gate enrollment (#39, #40, #41)
More from Cinatra
Connect Twenty CRM to Cinatra so your agents can look up companies and contacts and keep your CRM records up to date.
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/twenty-connector
Generate ready-to-use image prompts for a finished blog draft — one for the cover, several inline, and a social share. The agent reads the…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/blog-image-prompt-agent
Connect a GitHub repository to Cinatra and let your agents work with it. Once you sign in and pick a repository, Cinatra keeps a…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/github-connector
Bring agents from external Agent-to-Agent (A2A) servers into your Cinatra workspace and run them alongside your own. Point Cinatra at any A2A-compatible peer and…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/a2a-server-connector
A security-review helper that sits beside the agent-authoring chat experience. It reads a draft agent definition and flags the fuzzy risks a deterministic linter…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/security-reviewer-agent
The final send step of an outreach campaign. Once recipients have been confirmed and drafts approved upstream, this agent hands the campaign to the…
Enter a valid instance URL (https:// is required unless it is localhost).
cinatra install cinatra-ai/email-delivery-agent
Reviews
There are no reviews yet.