The registry half fixes the everyday problem — an assistant writing provider blocks out of whatever it memorised during training — by fetching today's documentation instead. The HCP Terraform half goes further and manages workspaces, variables and runs, with the part that can destroy infrastructure deliberately gated behind its own flag.
HashiCorp's server for Terraform work, split into three toolsets: the public registry, private registries, and HCP Terraform or Terraform Enterprise operations. It also serves the Terraform style guide and module-development guide as resources the client can read directly.
- Provider documentation searched with search_providers and returned in full markdown by get_provider_details, plus get_latest_provider_version
- Modules found with search_modules, read with get_module_details for inputs, outputs, examples and submodules, and pinned with get_latest_module_version
- Sentinel policies through search_policies and get_policy_details, for governance and compliance questions
- Organizations, projects and workspaces through list_terraform_orgs, list_terraform_projects, list_workspaces and get_workspace_details
- Runs through list_runs, get_run_details and create_run, which takes plan_and_apply, refresh_state, plan_only or allow_empty_apply
- Plans and applies read as metadata, execution logs, or machine-readable JSON — get_plan_details, get_plan_logs, get_plan_json_output, get_apply_details, get_apply_logs
- Variables and variable sets managed with list_variable_sets, create_variable_set, create_variable_in_variable_set, attach_variable_set_to_workspaces, list_workspace_variables, create_workspace_variable and update_workspace_variable
- Workspace tags through create_workspace_tags and read_workspace_tags, policy sets through get_workspace_policy_sets and attach_policy_set_to_workspace
- Private registry contents — search_private_modules, get_private_module_details, search_private_providers, get_private_provider_details
- Stacks listed with list_stacks and read with get_stack_details, and get_token_permissions to see what your token is allowed to do
- The tools that can change infrastructure — create_workspace, update_workspace, delete_workspace_safely and action_run — held behind ENABLE_TF_OPERATIONS
Docker Engine v20.10.21 or later, or Docker Desktop v4.14.0 or later, to run the published image; pre-compiled binaries cover the other operating systems. Registry tools need nothing more. For HCP Terraform or Terraform Enterprise, set TFE_TOKEN to an API token, and TFE_ADDRESS to your own address if you are not on https://app.terraform.io. Creating, updating and deleting workspaces, and applying or destroying through a run, stay off until ENABLE_TF_OPERATIONS is true. TRANSPORT_MODE=streamable-http turns the stdio server into an HTTP one.
One command plus a key — docker run -i --rm hashicorp/terraform-mcp-server, then supply credentials