Labsco
MCP SERVER

Terraform MCP

by nwiizo ↗

Let an assistant read a Terraform plan, judge the risk, and tell you what would break before you apply.

Cloud Resources & Infrastructure as Code
Summary
Destructive operations are off unless you turn them on, and the read-only half is where the value is.

Apply and destroy sit behind explicit environment flags, so the default install is a reader. That default is the interesting one: risk-scored plan review, drift candidates found without a refresh, module health metrics and a PR-ready plan summary all come from state and configuration you already have. HCP Terraform and TFE access is read-only unless you enable the gated write path.

What it is

A Rust CLI that runs as an MCP server over the Terraform CLI, plus registry lookups and read-only access to HCP Terraform and Terraform Enterprise.

What you get
  • Core operations — init_terraform, get_terraform_plan, apply_terraform, destroy_terraform, validate_terraform, get_terraform_state and list_terraform_resources
  • analyze_plan and review_terraform_plan — plan analysis with risk scoring, blockers and destructive changes called out; summarize_plan_for_pr writes the markdown summary
  • analyze_state, inspect_state_safety and detect_drift_candidates — drift detection from readable state, without touching infrastructure
  • run_terraform_quality_checks and check_provider_lockfile — CI-friendly validation, module health and lockfile checks
  • Workspace and state — terraform_workspace, terraform_import, terraform_taint and terraform_refresh
  • Code and output — terraform_fmt, terraform_graph, terraform_output and terraform_providers
  • Analysis — inspect_terraform_project, detect_terraform_entrypoints, analyze_module_health, get_resource_dependency_graph, suggest_module_refactoring and get_security_status
  • Registry lookups — search_providers, search_modules, get_provider_docs, get_provider_capabilities, get_latest_module_version, search_policies and more
  • Read-only HCP Terraform and TFE — list_terraform_orgs, list_workspaces, get_workspace_details, list_runs, get_run_details and get_plan_details
  • 82 tools in total, over stdio or Streamable HTTP
Requirements

Rust 1.88.0 or newer and the Terraform CLI 1.15.8 on your PATH; cargo install tfmcp, or use the published container image. Anything that changes infrastructure stays behind flags: TFMCP_ALLOW_DANGEROUS_OPS, TFMCP_ALLOW_AUTO_APPROVE and ENABLE_TF_OPERATIONS for gated HCP/TFE writes. TERRAFORM_DIR points at the project; TFE_ADDRESS and TFE_TOKEN reach a Terraform Enterprise install.

Setup effort

One command plus a key — cargo install tfmcp, then supply credentials