M
MCP Directory CURATED DIRECTORY
911 MCP servers indexed
中文
← Back to directory
T

Terraform MCP Server

Official
Generate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise.
How to install ↓ Compare GitHub source repository ↗
Category
Dev Tools #50 of 438
Stars
★ 1.5k Very popular
Transport
stdio (local process) · Streamable HTTP
Runtime
Docker · Go
Credentials
Optional API key
License
MPL-2.0
Last commit
65FMRS · C

An official Terraform MCP server with comprehensive features, dual transport support, and broad client compatibility. Requires HCP Terraform or Terraform Enterprise credentials. Security considerations are important; use trusted MCP clients.

Strongest · Documentation 16/20 Weakest · Reliability 8/20

Reliability
8/20
Security and permissions
14/20
Maintenance
14/20
Documentation
16/20
Setup experience
13/20
Why each score
Reliability 8/20
The manifest is well-formed and internally consistent (version 1.2.0, OCI package, stdio transport), so a happy path is plausible. However, the static calibration treats the README and manifest as untrusted for execution claims, and no source files, CI workflows, or committed tests were provided for review, so the init handshake and declared-vs-actual tool behavior cannot be verified. Deductions: missing verifiable execution evidence; the manifest declares only stdio while the README advertises streamable-http (a fidelity gap); 58 open issues cannot be assessed for impact on key paths.
Security and permissions 14/20
Positive signals: TFE_TOKEN is marked isSecret in the manifest; ENABLE_TF_OPERATIONS defaults to false, gating sensitive delete/execute operations behind explicit opt-in; the README documents anti-redirection (clients cannot set TFE_ADDRESS), rejection of tokens in query parameters, mandatory TLS for central deployment, allowed-origins/CORS and organization allowlists, and an explicit warning against use with untrusted clients. No red lines: install examples contain only placeholders, no real tokens; no malware/theft/exfiltration patterns; maintainer identity is genuine. Deductions: static review cannot confirm the controls are enforced in source; long-lived user API tokens and the static shared secret (TF_MCP_SHARED_SECRET) remain residual risks; least-privilege relies on documented behavior rather than audited code.
Maintenance 14/20
HashiCorp is a real, well-known maintainer; MPL-2.0 license with a dedicated security contact and vulnerability-management policy; repository not archived; version progression is visible (0.2.3 → 0.3.0+ → 1.2.0) with matching Docker tags; the feature surface is actively expanding (dual transport, OTel metrics, Instana, session modes, IP forwarding). Deductions: no commit history, issue-response timeliness, or dependency-update evidence in the provided material; 58 open issues lack resolution context; stars are discovery signals only and add no points.
Documentation 16/20
Documentation is layered and unusually thorough: an environment-variable table, CLI flags, install/config examples for six mainstream clients, transport and session-mode guides, token passthrough, a client-IP forwarding trust model with explicit limitations, supported headers, curl examples, security considerations, a centralized-deployment example, corporate-proxy/TLS troubleshooting, and development make targets; limits and risks (rate limits, allowlist) are disclosed. Deductions: tool parameters and the full tool list are only linked externally to HashiCorp developer docs, not included in the reviewed material; a leftover IBM legal notice suggests template reuse; operational claims (rate limiting, allowlist enforcement) lack in-repo verification material.
Setup experience 13/20
The setup path is clear and short: a single docker run command for stdio mode, one-line launch examples for streamable-http, copy-paste JSON snippets for VS Code, Cursor, Claude Desktop, Claude Code, Gemini and Bob IDE, plus go install and make docker-build fallbacks. Deductions: the static calibration caps setup at 15 without CI/test execution evidence, and none was provided; Docker is a hard prerequisite; some clients require extra steps (e.g., installing a Gemini extension from GitHub); token/address are optional, so full functionality without them cannot be verified.

Static review · not runListed 2026-08-07

Read the FMRS scoring method →

Fit and risk

What it can accessRuns commands or codeUses the network

Best for

  • Teams using HCP Terraform or Terraform Enterprise
  • Developers integrating Terraform into IDEs like VS Code and Cursor
  • DevOps engineers automating IaC workflows

Not for

  • Not suitable for local-only Terraform use without HCP Terraform/Terraform Enterprise
  • Not for environments requiring complex custom instructions or high security without careful review

Required permissions

  • Requires Terraform API token (TFE_TOKEN) to access HCP Terraform or Terraform Enterprise
  • Runs in a Docker container, requiring network access
  • If ENABLE_TF_OPERATIONS is enabled, can execute Terraform operations, requiring explicit approval

Risks and side effects

  • Server may expose Terraform data to MCP client and LLM; avoid untrusted clients
  • Outputs are generated dynamically; review to align with security and cost policies
  • In streamable-http mode, TFE_ADDRESS cannot be set by clients to prevent redirect attacks
  • Shared secret (TF_MCP_SHARED_SECRET) should only be used over TLS

Setup

Before you start

Runtime：Docker · Go

TFE_TOKEN optionalsecret HCP Terraform / Terraform Enterprise API token for authenticating requests; generate it in your TFE user settings.
TF_MCP_SHARED_SECRET optionalsecret Shared secret sent as the X-Tf-Mcp-Secret header to identify hosted deployments; set by the deployment operator, TLS only.
Other optional settings (30)
TFE_ADDRESS optional Base URL of HCP Terraform or Terraform Enterprise, default https://app.terraform.io; see your TFE admin console.
TFE_SKIP_TLS_VERIFY optional Set to true to skip TLS verification against HCP Terraform / TFE; testing only.
LOG_LEVEL optional Logging level (trace/debug/info/warn/error/fatal/panic), default info.
LOG_FORMAT optional Log format, text or , default text.
TRANSPORT_MODE optional Set to streamable-http to enable HTTP transport; default stdio.
TRANSPORT_HOST optional Host the HTTP server binds to, default 127.0.0.1; set 0.0.0.0 in containers.
TRANSPORT_PORT optional HTTP server port, default 8080.
MCP_ENDPOINT optional HTTP endpoint path, default /mcp.
MCP_REDIRECT_ROOT_URL optional URL to redirect requests to / to.
MCP_KEEP_ALIVE optional Keep-alive interval for SSE connections, e.g. 30s or 1m; 0 disables.
MCP_SESSION_MODE optional Session mode, stateful or stateless; default stateful.
MCP_ALLOWED_ORIGINS optional Comma-separated CORS allowed origins.
MCP_CORS_MODE optional CORS mode: strict, development, or disabled; default strict.
MCP_TLS_CERT_FILE optional Path to TLS cert file, required for non-localhost deployments.
MCP_TLS_KEY_FILE optional Path to TLS key file, required for non-localhost deployments.
MCP_RATE_LIMIT_GLOBAL optional Global rate limit, format rps:burst, default 10:20.
MCP_RATE_LIMIT_SESSION optional Per-session rate limit, format rps:burst, default 5:10.
MCP_ORGANIZATION_ALLOWLIST optional CSV list of HCP Terraform organization names allowed to access the HTTP server.
MCP_FORWARD_CLIENT_IP optional Set to true to forward the client IP to TFE via X-Forwarded-For.
MCP_REMOTE_IP_METHOD optional Client IP sourcing method: RemoteAddr, X-Real-IP, or X-Forwarded-For.
MCP_XFF_TRUSTED_HOPS optional Number of trusted proxy hops counted from the right of the X-Forwarded-For chain.
ENABLE_TF_OPERATIONS optional Set to true to enable Terraform execution tools requiring explicit approval.
OTEL_METRICS_ENABLED optional Set to true to enable OTel tools and server metrics.
OTEL_METRICS_SERVICE_VERSION optional Version identifier for metrics, default latest.
OTEL_METRICS_SERVICE_NAME optional Metrics source identifier, default terraform-mcp-server.
OTEL_METRICS_EXPORT_INTERVAL optional Metric flush frequency, default 2.
OTEL_METRICS_ENDPOINT optional OTel Collector or backend URL, default localhost:4318.
INSTANA_ENABLED optional Enable Instana instrumentation (metrics and HTTP tracing); requires a reachable Instana agent.
INSTANA_SERVICE_NAME optional Service name in Instana, default terraform-mcp-server.
SSL_CERT_FILE optional Path to a corporate CA certificate, used to fix certificate errors from TLS inspection proxies like Zscaler.

Run via Docker: docker run -i --rm hashicorp/terraform-mcp-server:1.2.0. Configure with TFE_ADDRESS and TFE_TOKEN environment variables. Alternatively, install from source: go install github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@latest.

Check that it works

Run docker run -i --rm hashicorp/terraform-mcp-server:1.2.0 and confirm the server's Terraform tools (e.g., provider search tools) appear in your client's tool list; in streamable-http mode, curl http://localhost:8080/health to confirm the server is healthy.

Troubleshooting

  1. If encountering certificate errors (e.g., corporate proxy), mount corporate CA certificate and set SSL_CERT_FILE
  2. Ensure TFE_ADDRESS and TFE_TOKEN environment variables are set correctly
  3. When running in Docker, set TRANSPORT_HOST=0.0.0.0 to allow external connections
  4. Check log level (LOG_LEVEL) for more diagnostics

Things to try

Once connected, you can ask your AI assistant things like:

  • Search the Terraform Registry for AWS providers and show their documentation
  • Find official VPC modules available on the Terraform Registry
  • List my workspaces in HCP Terraform
  • Show the latest version and usage details for this Terraform provider

Use cases

Generate more accurate Terraform configurations
Manage workspaces, variables, tags, and runs on HCP Terraform or Terraform Enterprise
Query providers, modules, and policies from the Terraform Registry
Centralized deployment with per-user token passthrough via StreamableHTTP

Overview

The Terraform MCP Server is an official MCP integration that seamlessly connects with Terraform Registry APIs, enabling advanced automation and interaction for Infrastructure as Code (IaC) development. It supports dual transports (Stdio and StreamableHTTP), full workspace management, organization/project listing, private registry access, and optional Terraform execution tools.

Similar servers

Context7 80 · B

Upstash's official server providing up-to-date third-party library docs for AI coding assistants

★ 62.9k · Tools 2 Compare with this →
Compare with other MCP servers

Source revision 66e223d8ba74 Data synced 2026-10-12 Read the FMRS scoring method