cvs rtag
("rtag" = "remote-tag")
cvs tag :pserver:user@cvs.repository.com:/usr/local/cvsroot/
I have not used it for ages, but IIRC,
cvs -d :pserver:user@cvs.repository.com:/usr/local/cvsroot/
rtag should do exactly what you want. (Check the documentation and test it before performing it on a production server!)