The tailnet is the device list

Connector does not run mDNS discovery, does not maintain a server registry, and does not ask you to type IP addresses. It runs one subprocess — tailscale status --json — and treats the resulting Self and Peer objects as the complete population of machines it is allowed to think about.

If the Tailscale CLI cannot be found at all, refreshDevices() short-circuits: it clears local tailnet state, empties the device model, and sets the activity line to "Tailscale CLI not found. Device discovery is unavailable." There is no fallback discovery path. That is a design choice, not an omission — the tailnet is also the security boundary.

4124void ConnectorBackend::refreshDevices() {
4125  ++m_deviceRefreshGeneration;
4126  m_deviceConnectivityRetryCounts.clear();
4127  if (m_tailscalePath.isEmpty()) {
4128    resetLocalTailscaleState();
4129    m_deviceModel.setDevices({});
4130    refreshThisDevice();
4131    setActivityMessage("Tailscale CLI not found. Device discovery is unavailable.");
4132    emit commandPathsChanged();
4133    return;
4134  }
       /* ... kill any in-flight refresh ... */
4142  m_refreshProcess->setProgram(m_tailscalePath);
4143  m_refreshProcess->setArguments({"status", "--json"});
4144  m_refreshProcess->start();
4145  setActivityMessage("Refreshing devices...");
4146}

Every node in the tailnet becomes a DeviceRecord, but they are not equal. The Self node is marked isSelf and is deliberately excluded from streaming and pairing — "Connector does not prepare remote trusted access or stream into the current machine in the locked v1 scope." Peers get a route of "Tailscale"; manually added endpoints carry manual = true and render as MANUAL in the rail.

"Do not treat Tailscale reachability as proof that remote desktop streaming is ready. SSH readiness and Connector streaming readiness are separate."

The pipeline below is the whole of device state. Twenty-seven roles come out of DeviceModel::roleNames(); the QML rail reads about a dozen of them, and the RPC surface serialises all of them verbatim through QJsonObject::fromVariantMap.

The device model is not a private structure. Every field is serialised straight onto the control socket, so the CLI view and the QML view are literally the same data.

$ build/connector-app/connectorctl devices get nZ55Q5PqHN11CNTRL
{
    "advancedReady": true,
    "apps": [
        {
            "hdr": false,
            "id": 1,
            "name": "Desktop"
        }
    ],
    "clientTrusted": true,
    "defaultApp": "Desktop",
    "deviceId": "nZ55Q5PqHN11CNTRL",
    "dnsName": "linux-host",
    "favorite": false,
    "hostCheckPending": false,
    "hostReachable": true,
    "ip": "100.64.0.11",
    "isSelf": false,
    "manual": false,
    "name": "linux-host",
    "online": true,
    "os": "linux",
    "route": "Tailscale",
    "sshAvailable": true,
    "sshMode": "tailscale",
    "sshModeDefault": "tailscale",
    "sshModeExplicit": true,
    "sshReady": true,
    "sshTarget": "100.64.0.11",
    "sshUser": "ian",
    "state": "Online",
    "statusText": "Ready to connect"
}

Field names above are exactly the twenty-seven role names declared in DeviceModel::roleNames(); the id role is exposed as deviceId, which is why RPC parameters use device_id while the record itself carries deviceId.

Node ids like nZ55Q5PqHN11CNTRL are correct and unusable. The MCP layer therefore ships a scoring resolver that accepts an id, a hostname, an IP, a DNS name, an SSH target, an SSH user, the leading label of a DNS name, or a parenthesised alias inside a device name — and then breaks ties using live readiness.

Anything within twenty points of the winner counts as a close match. If more than one candidate lands in that band and the caller did not pass allow_ambiguous, the resolver raises rather than guessing — and the exception text lists up to five colliding devices by name and id. An agent that guesses which machine to reboot is worse than an agent that asks.