LabscoMCP early access ↗
aj-geddesMCP SERVER

Terry-Form MCP

Run Terraform from an assistant inside a container, with terraform-ls intelligence and destructive operations blocked by design.

by aj-geddes ↗Cloud Resources & Infrastructure as CodeCommunity

LABSCO SUMMARY

The container is the safety boundary, and the rate limits are per-minute.

Everything runs inside Docker with destructive operations blocked, which is what makes it reasonable to point an assistant at real infrastructure at all. Two knobs are worth setting before you start: MAX_OPERATION_TIMEOUT bounds a Terraform command between 10 and 3600 seconds, and the rate limits — TERRY_RATE_LIMIT_TERRAFORM at 20 per minute, GitHub and Terraform Cloud at 30 — stop a chatty agent from hammering a provider API.

What it is

A containerised Terraform server. Terraform runs inside Docker against a workspace you mount, and the same image carries terraform-ls, so plan output and language-server diagnostics come from one place.

What you get

  • terry executes Terraform operations with security validation; terry_version, terry_environment_check and terry_workspace_list report what the container has and which workspaces are initialised
  • terraform_validate_lsp and terraform_format_lsp run through terraform-ls; terraform_hover and terraform_complete answer at a cursor position; terraform_lsp_status reports the integration
  • terry_analyze checks a configuration against best practices; terry_security_scan and terry_recommendations produce findings and fixes
  • terry_file_check, terry_workspace_info, terry_workspace_setup, terry_lsp_init and terry_lsp_debug cover diagnostics and scaffolding
  • github_clone_repo, github_prepare_workspace, github_list_terraform_files and github_get_terraform_config pull configurations straight out of a repository
  • A dashboard at /tools lists the catalogue with search and parameter detail, also served raw at /api/tools

Requirements

Docker, with your Terraform directory mounted at /mnt/workspace. MCP_TRANSPORT selects stdio, sse or streamable-http; TERRY_PORT defaults to 8000. Cloud credentials pass straight through to the Terraform subprocess — AWS_ACCESS_KEY_ID, GOOGLE_CREDENTIALS, ARM_CLIENT_ID and their siblings. GitHub features need GITHUB_APP_ID and a private key; Terraform Cloud needs TF_API_TOKEN. Local development wants Python 3.10 or newer.

Setup effort

Run a container — build the image from the repository, then point your client at it

See installation options