LabscoMCP early access ↗
severity1MCP SERVER

Terraform Cloud

Manage HCP Terraform through conversation — workspaces, runs, plans, applies, state versions and variables — with deletes disabled until you turn them on.

by severity1 ↗Cloud Resources & Infrastructure as CodeCommunity

LABSCO SUMMARY

Two independent safety switches, both off in the direction you want.

Deletes require ENABLE_DELETE_TOOLS before they exist at all, and READ_ONLY_TOOLS strips every write in one setting — so a production connection and a sandbox one can be genuinely different rather than differing by discipline. safe_delete_workspace deserves the name: it refuses when the workspace still manages resources. The response filtering is described as conservative, trimming 5-15% of tokens while keeping the accountability and change-tracking fields an audit would need.

What it is

A Terraform Cloud server built on Pydantic models and organised by domain. It covers the API surface an operator actually uses day to day, and separates the destructive parts behind an explicit environment flag.

What you get

  • Workspaces: list_workspaces, get_workspace_details, create_workspace, update_workspace, plus lock_workspace, unlock_workspace and force_unlock_workspace
  • Runs: create_run, list_runs_in_workspace, list_runs_in_organization, get_run_details, apply_run, discard_run, cancel_run, force_cancel_run and force_execute_run
  • Plans and applies: get_plan_details, get_plan_json_output, get_run_plan_json_output, get_plan_logs, get_apply_details, get_apply_logs, and get_errored_state for recovering from a failed state upload
  • Projects and organizations, including tag bindings, moving workspaces between projects, and organization entitlements
  • State: list_state_versions, get_current_state_version, get_state_version, create_state_version, download_state_file, and the state version outputs tools
  • Variables: workspace variables, variable sets, the variables inside them, and assignment to workspaces and projects — sensitive values stay hidden
  • get_cost_estimate_details returns matched and unmatched resource counts, prior monthly cost, proposed monthly cost and the delta
  • Assessment results: details, JSON plan output, JSON schema and logs from a health assessment
  • READ_ONLY_TOOLS=true removes every create, update, delete, apply and state-modifying tool; ENABLE_DELETE_TOOLS must be true before any delete works
  • safe_delete_workspace deletes only when the workspace manages no resources

Requirements

Python 3.12 or newer with uv, or the repository's Docker image. TFC_TOKEN is required — a user API token created from User Settings then Tokens in HCP Terraform. TFC_ADDRESS points at a self-hosted Terraform Enterprise instance and defaults to https://app.terraform.io. ENABLE_DELETE_TOOLS and READ_ONLY_TOOLS default to false. Version 0.8.20.

Setup effort

Build from source — git clone https://github.com/severity1/terraform-cloud-mcp.git

See installation options