init_terraformLABSCO SUMMARY
Destructive operations are off unless you turn them on, and the read-only half is where the value is.
Apply and destroy sit behind explicit environment flags, so the default install is a reader. That default is the interesting one: risk-scored plan review, drift candidates found without a refresh, module health metrics and a PR-ready plan summary all come from state and configuration you already have. HCP Terraform and TFE access is read-only unless you enable the gated write path.
What it is
A Rust CLI that runs as an MCP server over the Terraform CLI, plus registry lookups and read-only access to HCP Terraform and Terraform Enterprise.
What you get
- Core operations — init_terraform, get_terraform_plan, apply_terraform, destroy_terraform, validate_terraform, get_terraform_state and list_terraform_resources
- analyze_plan and review_terraform_plan — plan analysis with risk scoring, blockers and destructive changes called out; summarize_plan_for_pr writes the markdown summary
- analyze_state, inspect_state_safety and detect_drift_candidates — drift detection from readable state, without touching infrastructure
- run_terraform_quality_checks and check_provider_lockfile — CI-friendly validation, module health and lockfile checks
- Workspace and state — terraform_workspace, terraform_import, terraform_taint and terraform_refresh
- Code and output — terraform_fmt, terraform_graph, terraform_output and terraform_providers
- Analysis — inspect_terraform_project, detect_terraform_entrypoints, analyze_module_health, get_resource_dependency_graph, suggest_module_refactoring and get_security_status
- Registry lookups — search_providers, search_modules, get_provider_docs, get_provider_capabilities, get_latest_module_version, search_policies and more
- Read-only HCP Terraform and TFE — list_terraform_orgs, list_workspaces, get_workspace_details, list_runs, get_run_details and get_plan_details
- 82 tools in total, over stdio or Streamable HTTP
Requirements
Rust 1.88.0 or newer and the Terraform CLI on your PATH (the README names 1.15.8), and tfmcp itself from cargo install tfmcp. Anything that changes infrastructure stays behind flags: TFMCP_ALLOW_DANGEROUS_OPS, TFMCP_ALLOW_AUTO_APPROVE and ENABLE_TF_OPERATIONS for gated HCP/TFE writes. TERRAFORM_DIR points at the project; TFE_ADDRESS and TFE_TOKEN reach a Terraform Enterprise install.
Setup effort
One command — cargo install tfmcp
USE CASES
01
Reviewing a plan before anyone approves it
Generate the plan, then get risk, blockers and destructive changes named — and a markdown summary to paste into the PR.
02
Finding drift without touching anything
Read the state and list drift candidates, with no refresh against live infrastructure.
03
Looking up a provider argument you half remember
Search the registry and read the provider's documentation and capabilities in place.
04
Checking a module before you depend on it
Run module health with cohesion and coupling metrics and read the refactoring suggestions.
82 tools
Listed in project docs. Your client may show a different list.
get_terraform_plananalyze_planapply_terraformdestroy_terraformvalidate_terraformvalidate_terraform_detailedget_terraform_stateanalyze_statereview_terraform_plansummarize_plan_for_prrun_terraform_quality_checksinspect_state_safetydetect_drift_candidatesprepare_terraform_changelist_terraform_resourcesset_terraform_directoryterraform_workspaceterraform_importterraform_taintterraform_refreshterraform_fmtterraform_graphterraform_outputterraform_providerscheck_provider_lockfileanalyze_terraforminspect_terraform_projectdetect_terraform_entrypointsanalyze_module_healthget_resource_dependency_graphsuggest_module_refactoringget_security_statussearch_providerssearch_terraform_providersget_provider_detailsget_provider_infoget_provider_docsget_provider_capabilitiessearch_modulessearch_terraform_modulesget_module_detailsget_latest_module_versionget_latest_provider_versionsearch_policiesget_policy_detailsget_token_permissionslist_terraform_orgslist_terraform_projectslist_workspacesget_workspace_detailslist_runsget_run_detailsget_plan_detailsget_plan_logsget_plan_json_outputget_apply_detailsget_apply_logsget_workspace_policy_setslist_workspace_variableslist_variable_setsread_workspace_tagslist_stacksget_stack_detailssearch_private_modulesget_private_module_detailssearch_private_providersget_private_provider_detailscreate_workspaceupdate_workspacedelete_workspace_safelycreate_runaction_runcreate_workspace_variableupdate_workspace_variableattach_policy_set_to_workspacecreate_variable_setcreate_variable_in_variable_setdelete_variable_in_variable_setattach_variable_set_to_workspacesdetach_variable_set_from_workspacescreate_workspace_tagsBEFORE YOU INSTALL
What to know first
Tools you get
82 tools named in the project's documentation. Write tools are hidden by default; use --toolsets operations or --toolsets all. HCP/TFE writes also need ENABLE_TF_OPERATIONS=true, and apply_terraform and destroy_terraform need TFMCP_ALLOW_DANGEROUS_OPS=true.
Requires
- Rust 1.88.0+
- Terraform CLI on PATH (the README names 1.15.8)
Optional
TFE_TOKEN in your environment
INSTALLATION
Connect your client
Server setup
TERMINAL
cargo install tfmcpMCP Clients
Claude Desktop — Cargo
Install tfmcp:
CLAUDE DESKTOP — CARGO · TERMINAL
cargo install tfmcpFind the path to the installed executable: which tfmcp
Add this to ~/Library/Application Support/Claude/claude_desktop_config.json, then restart Claude Desktop and enable the tfmcp tool:
CLAUDE DESKTOP — CARGO · JSON
{
"mcpServers": {
"tfmcp": {
"command": "<YOUR_PATH_TO_TFMCP>",
"args": [
"mcp"
],
"env": {
"HOME": "/Users/<YOUR_USERNAME>",
"PATH": "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
"TERRAFORM_DIR": "<YOUR_TERRAFORM_DIR>"
}
}
}
}<YOUR_PATH_TO_TFMCP> is the path which tfmcp printed, and /Users/<YOUR_USERNAME> is your home directory, and set TERRAFORM_DIR (optional) to your Terraform project.
The configuration on this page does not set TFE_TOKEN, which only the HCP Terraform and Terraform Enterprise tools need. The README treats it as a server environment variable: set it in the environment where tfmcp starts. tfmcp does not accept it per request.
