Best for
- Teams using HCP Terraform or Terraform Enterprise
- Developers integrating Terraform into IDEs like VS Code and Cursor
- DevOps engineers automating IaC workflows
T
Terraform MCP Server
Official
Generate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise.
GitHub source repository ↗
65FMRS · C
An official Terraform MCP server with comprehensive features, dual transport support, and broad client compatibility. Requires HCP Terraform or Terraform Enterprise credentials. Security considerations are important; use trusted MCP clients.
The Terraform MCP Server is an official MCP integration that seamlessly connects with Terraform Registry APIs, enabling advanced automation and interaction for Infrastructure as Code (IaC) development. It supports dual transports (Stdio and StreamableHTTP), full workspace management, organization/project listing, private registry access, and optional Terraform execution tools.
Tools
The tool list has not been reviewed yet.
Setup
Run via Docker: docker run -i --rm hashicorp/terraform-mcp-server:1.2.0. Configure with TFE_ADDRESS and TFE_TOKEN environment variables. Alternatively, install from source: go install github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@latest.
Fit and risk
Not for
- Not suitable for local-only Terraform use without HCP Terraform/Terraform Enterprise
- Not for environments requiring complex custom instructions or high security without careful review
Required permissions
- Requires Terraform API token (TFE_TOKEN) to access HCP Terraform or Terraform Enterprise
- Runs in a Docker container, requiring network access
- If ENABLE_TF_OPERATIONS is enabled, can execute Terraform operations, requiring explicit approval
Risks and side effects
- Server may expose Terraform data to MCP client and LLM; avoid untrusted clients
- Outputs are generated dynamically; review to align with security and cost policies
- In streamable-http mode, TFE_ADDRESS cannot be set by clients to prevent redirect attacks
- Shared secret (TF_MCP_SHARED_SECRET) should only be used over TLS
Troubleshooting
- If encountering certificate errors (e.g., corporate proxy), mount corporate CA certificate and set SSL_CERT_FILE
- Ensure TFE_ADDRESS and TFE_TOKEN environment variables are set correctly
- When running in Docker, set TRANSPORT_HOST=0.0.0.0 to allow external connections
- Check log level (LOG_LEVEL) for more diagnostics
Use cases
Generate more accurate Terraform configurations
Manage workspaces, variables, tags, and runs on HCP Terraform or Terraform Enterprise
Query providers, modules, and policies from the Terraform Registry
Centralized deployment with per-user token passthrough via StreamableHTTP
Supported clients
Supported clients have not been confirmed yet.