Best for
- Developers who need AI-assisted Terraform project and plan inspection.
- Users managing local Terraform directories through Claude Desktop.
- Teams needing plan-risk, state-drift, module-health, or security checks.
T
64FMRS · C
An unofficial MIT-licensed Terraform MCP server with broad capabilities and default-off dangerous operations, audit logging, directory protections, and remote-access security controls. It is suitable for inspection and assisted operations, but infrastructure writes require human plan review.
tfmcp is an experimental command-line MCP server that lets AI assistants read and analyze Terraform configurations and plans, perform configuration and state workflows, and query public or private Terraform registries. It supports stdio and Streamable HTTP, plus read-only HCP Terraform/Terraform Enterprise tools and safety-gated write tools. The project remains under active development.
Tools
init_terraform
Initialize the Terraform working directory.
get_terraform_plan
Generate and show an execution plan.
analyze_plan
Analyze a plan with risk scoring and recommendations.
apply_terraform
Apply a Terraform configuration.
destroy_terraform
Destroy Terraform-managed infrastructure.
validate_terraform
Validate configuration syntax.
validate_terraform_detailed
Run detailed validation with guidelines.
get_terraform_state
Show the current state.
analyze_state
Analyze state and detect drift.
review_terraform_plan
Review plan risks, blockers, and destructive changes.
summarize_plan_for_pr
Generate a plan summary for PR comments.
run_terraform_quality_checks
Run validation, module health, guideline, and lockfile checks.
inspect_state_safety
Inspect state readability, drift risk, and blockers.
detect_drift_candidates
Detect drift candidates without modifying infrastructure.
prepare_terraform_change
Generate blockers, warnings, and a recommended change sequence.
list_terraform_resources
List managed resources.
set_terraform_directory
Change the active project directory.
terraform_workspace
Manage Terraform workspaces.
terraform_import
Import existing resources.
terraform_taint
Taint or untaint resources.
terraform_refresh
Refresh state.
terraform_fmt
Format Terraform code.
terraform_graph
Generate a dependency graph.
terraform_output
Get output values.
terraform_providers
Get provider and lockfile information.
check_provider_lockfile
Check reproducible provider selections in the lockfile.
analyze_terraform
Analyze Terraform configuration.
inspect_terraform_project
Inspect local Terraform directories, modules, and entrypoints.
detect_terraform_entrypoints
Detect likely root module entrypoints.
analyze_module_health
Analyze module health, cohesion, and coupling.
get_resource_dependency_graph
Get the resource dependency graph.
suggest_module_refactoring
Suggest module refactoring.
get_security_status
Run security scanning and secret detection.
search_providers
Search providers.
search_terraform_providers
Search Terraform providers.
get_provider_details
Get provider details.
get_provider_info
Get provider information.
get_provider_docs
Get provider documentation.
get_provider_capabilities
Get provider resources, data sources, functions, and guides.
search_modules
Search modules.
search_terraform_modules
Search Terraform modules.
get_module_details
Get module details.
get_latest_module_version
Get the latest module version.
get_latest_provider_version
Get the latest provider version.
search_policies
Search Sentinel/OPA policy libraries.
get_policy_details
Get policy library details.
get_token_permissions
Inspect token account details without exposing the token.
list_terraform_orgs
List visible organizations.
list_terraform_projects
List projects in an organization.
list_workspaces
List workspaces in an organization.
get_workspace_details
Get workspace details by ID or organization/name.
list_runs
List workspace runs.
get_run_details
Get run details.
get_plan_details
Get plan details.
get_plan_logs
Get plan logs.
get_plan_json_output
Get Terraform JSON plan output.
get_apply_details
Get apply details.
get_apply_logs
Get apply logs.
get_workspace_policy_sets
Get policy sets attached to a workspace.
list_workspace_variables
List workspace variables.
list_variable_sets
List organization variable sets.
read_workspace_tags
Read workspace tags.
list_stacks
List Terraform stacks.
get_stack_details
Get stack details.
search_private_modules
Search private registry modules.
get_private_module_details
Get private module details.
search_private_providers
Search private registry providers.
get_private_provider_details
Get private provider details.
create_workspace
Create a workspace when gated operations are enabled.
update_workspace
Update workspace settings when gated operations are enabled.
delete_workspace_safely
Safely delete a workspace when gated operations are enabled.
create_run
Queue a run when gated operations are enabled.
action_run
Apply, discard, cancel, or execute a run when gated operations are enabled.
create_workspace_variable
Create a workspace variable when gated operations are enabled.
update_workspace_variable
Update a workspace variable when gated operations are enabled.
attach_policy_set_to_workspace
Attach a policy set to a workspace when gated operations are enabled.
create_variable_set
Create a variable set when gated operations are enabled.
create_variable_in_variable_set
Create a variable in a variable set when gated operations are enabled.
delete_variable_in_variable_set
Delete a variable from a variable set when gated operations are enabled.
attach_variable_set_to_workspaces
Attach a variable set to workspaces when gated operations are enabled.
detach_variable_set_from_workspaces
Detach a variable set from workspaces when gated operations are enabled.
create_workspace_tags
Create or attach workspace tags when gated operations are enabled.
Setup
Install Rust 1.88.0 or newer and Terraform CLI 1.15.8, then install tfmcp with Cargo or build it from source. Replace the executable path and optional TERRAFORM_DIR in the configuration with actual values, save it in the Claude Desktop configuration file, and restart Claude Desktop. Docker is also supported.
claude_desktop_config.json
{"mcpServers":{"tfmcp":{"command":"/path/to/your/tfmcp","args":["mcp"],"env":{"HOME":"/Users/yourusername","PATH":"/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin","TERRAFORM_DIR":"/path/to/your/terraform/project"}}}}
Fit and risk
Not for
- Situations requiring infrastructure changes without human review.
- Users without Terraform CLI or a usable Terraform project directory.
- Production environments that cannot tolerate active-development software.
Required permissions
- Read and operate on the Terraform project directory specified by TERRAFORM_DIR.
- Access the Terraform CLI available in PATH.
- Use configured TFE_ADDRESS and TFE_TOKEN for HCP Terraform/Terraform Enterprise queries.
- Use appropriate Terraform or HCP/TFE permissions when write operations are enabled.
Risks and side effects
- Apply and destroy are disabled by default but can change or destroy infrastructure when enabled.
- Auto-approve is disabled by default; enabling it reduces manual confirmation.
- Incorrect directories, credentials, permissions, or AI-generated plans can cause unintended changes.
- Misconfigured Streamable HTTP can broaden network exposure; TFE_TOKEN and TLS private keys are sensitive.
- The project is under active development, so review all operations before production use.
Troubleshooting
- Verify the executable path and confirm Terraform CLI is installed and available in PATH.
- Check that TERRAFORM_DIR points to the intended project.
- If Claude Desktop cannot connect, inspect its MCP server log.
- When using Docker, verify volume mounts, paths, and permissions.
- For method-not-found errors, confirm the client is using MCP methods implemented by the server.
Use cases
Read, validate, format, and analyze Terraform configurations.
Generate, review, and summarize Terraform plans.
Perform safety-gated local Terraform apply, destroy, and state operations.
Query Terraform Registry, HCP Terraform, and Terraform Enterprise.
Supported clients
Claude DesktopFull support