Deletes require ENABLE_DELETE_TOOLS before they exist at all, and READ_ONLY_TOOLS strips every write in one setting — so a production connection and a sandbox one can be genuinely different rather than differing by discipline. safe_delete_workspace deserves the name: it refuses when the workspace still manages resources. The response filtering is described as conservative, trimming 5-15% of tokens while keeping the accountability and change-tracking fields an audit would need.
A Terraform Cloud server built on Pydantic models and organised by domain. It covers the API surface an operator actually uses day to day, and separates the destructive parts behind an explicit environment flag.
- Workspaces: list_workspaces, get_workspace_details, create_workspace, update_workspace, plus lock_workspace, unlock_workspace and force_unlock_workspace
- Runs: create_run, list_runs_in_workspace, list_runs_in_organization, get_run_details, apply_run, discard_run, cancel_run, force_cancel_run and force_execute_run
- Plans and applies: get_plan_details, get_plan_json_output, get_run_plan_json_output, get_plan_logs, get_apply_details, get_apply_logs, and get_errored_state for recovering from a failed state upload
- Projects and organizations, including tag bindings, moving workspaces between projects, and organization entitlements
- State: list_state_versions, get_current_state_version, get_state_version, create_state_version, download_state_file, and the state version outputs tools
- Variables: workspace variables, variable sets, the variables inside them, and assignment to workspaces and projects — sensitive values stay hidden
- get_cost_estimate_details returns matched and unmatched resource counts, prior monthly cost, proposed monthly cost and the delta
- Assessment results: details, JSON plan output, JSON schema and logs from a health assessment
- READ_ONLY_TOOLS=true removes every create, update, delete, apply and state-modifying tool; ENABLE_DELETE_TOOLS must be true before any delete works
- safe_delete_workspace deletes only when the workspace manages no resources
Python 3.12 or newer with uv, or the repository's Docker image. TFC_TOKEN is required — a user API token created from User Settings then Tokens in HCP Terraform. TFC_ADDRESS points at a self-hosted Terraform Enterprise instance and defaults to https://app.terraform.io. ENABLE_DELETE_TOOLS and READ_ONLY_TOOLS default to false. Version 0.8.20.
One command plus a key — uv pip install ., then supply credentials