The failure this addresses is a demo environment that quietly specifies multi-AZ RDS and NAT gateways in three zones — correct Terraform, wrong money. Pricing the plan at authoring time turns that into a number you see before anything is applied, and the same pass catches the open security group that would otherwise ship alongside it. Only cost queries leave the machine, and only against your token. Worth knowing: security analysis is AWS-only today, so Azure and GCP configurations get the price but not the review.
A Go MCP server that adds three passes to the Terraform an assistant produces: fill in the missing providers, versions and variables so a fragment becomes runnable; flag insecure defaults such as open access and missing encryption; and price the proposed resources against Binadox's live cloud pricing data.
- Terraform snippets validated and completed — provider blocks, versions and variables added so the configuration actually runs — `prepare_terraform`
- Misconfiguration analysis over the generated code: open access, missing encryption at rest, short backup retention — `analyze_terraform`
- A monthly cloud cost breakdown for the proposed resources, from real pricing data — `calculate_cost`
- Output organised into logical Terraform files and modules, written under `/tmp/terraform/` with a timestamp, and zipped when needed
Terraform CLI 1.6+ installed, and a Go toolchain if you build from source (Go 1.22+). A Binadox API token is required for cost analysis: `TERRAFORM_ANALYSIS_TOKEN` in the client entry, with `TERRAFORM_ANALYSIS_URL` pointing at the Binadox pricing endpoint. Build with `go build -o terraform-mcp-server *.go` and give the client that binary's path. It needs write access under `/tmp/terraform/` and outbound access to the pricing API; cloud credentials are never read and files are not sent anywhere. Cost data covers AWS, Azure and GCP; the security checks currently cover AWS.