Labsco
MCP SERVER

Terry-Form MCP

by aj-geddes ↗

Run Terraform from an assistant inside a container, with terraform-ls intelligence and destructive operations blocked by design.

Cloud Resources & Infrastructure as Code
Summary
The container is the safety boundary, and the rate limits are per-minute.

Everything runs inside Docker with destructive operations blocked, which is what makes it reasonable to point an assistant at real infrastructure at all. Two knobs are worth setting before you start: MAX_OPERATION_TIMEOUT bounds a Terraform command between 10 and 3600 seconds, and the rate limits — TERRY_RATE_LIMIT_TERRAFORM at 20 per minute, GitHub and Terraform Cloud at 30 — stop a chatty agent from hammering a provider API.

What it is

A containerised Terraform server. Terraform runs inside Docker against a workspace you mount, and the same image carries terraform-ls, so plan output and language-server diagnostics come from one place.

What you get
  • `terry` executes Terraform operations with security validation; `terry_version`, `terry_environment_check` and `terry_workspace_list` report what the container has and which workspaces are initialised
  • `terraform_validate_lsp` and `terraform_format_lsp` run through terraform-ls; `terraform_hover` and `terraform_complete` answer at a cursor position; `terraform_lsp_status` reports the integration
  • `terry_analyze` checks a configuration against best practices; `terry_security_scan` and `terry_recommendations` produce findings and fixes
  • `terry_file_check`, `terry_workspace_info`, `terry_workspace_setup`, `terry_lsp_init` and `terry_lsp_debug` cover diagnostics and scaffolding
  • `github_clone_repo`, `github_prepare_workspace`, `github_list_terraform_files` and `github_get_terraform_config` pull configurations straight out of a repository
  • A dashboard at `/tools` lists the catalogue with search and parameter detail, also served raw at `/api/tools`
Requirements

Docker, with your Terraform directory mounted at /mnt/workspace. MCP_TRANSPORT selects stdio, sse or streamable-http; TERRY_PORT defaults to 8000. Cloud credentials pass straight through to the Terraform subprocess — AWS_ACCESS_KEY_ID, GOOGLE_CREDENTIALS, ARM_CLIENT_ID and their siblings. GitHub features need GITHUB_APP_ID and a private key; Terraform Cloud needs TF_API_TOKEN. Local development wants Python 3.10 or newer.

Setup effort

One command plus a key — docker build -t terry-form-mcp ., then supply credentials