YawLabs/tailscale-mcp v0.23.2 on GitHub

The oam floor moves from 0.19.1 to 0.19.5, so the tailscale-mcp launcher no longer runs the server on oam 0.19.1-0.19.4. 0.19.5 is verified on the installed binary (oam 0.19.5) through the launcher with OAM_BIN pointing at it and TAILSCALE_MCP_RUNTIME=oam: a full MCP handshake listing all 98 tools and all 4 resources, tailscale_tool_groups answering, a call with invalid arguments returning the same error, and the whole session byte-identical to the same session on Node, with no non-JSON line on stdout. The same session answers from oam run bin/tailscale-mcp.mjs (in-process), from oam run src/index.ts (no build step), and with TAILSCALE_MCP_SANDBOX=1. An oam below 0.19.5 is handled as any below-floor oam: Node under auto, an error under TAILSCALE_MCP_RUNTIME=oam. Run oam self-update.

Dependency patches clearing every open Dependabot alert and npm audit finding: @hono/node-server 2.1.7 (was 1.19.17; serveStatic double-decode middleware bypass -- the MCP SDK accepts ^1.19.9 || ^2.0.5), fast-uri 3.1.9 (four URI-normalization advisories), zod 4.6.7 (memory exhaustion on oversized constrained collections), qs 6.17.1, ip-address 10.7.6 and body-parser 2.4.0 (DoS advisories). npm audit reports 0 vulnerabilities.