Back to Plugins

Terraform

Manage Terraform infrastructure as code with plan previews, state inspection, module documentation, and drift detection directly from Claude Code

infrastructureiacterraformdevopsexternal
By HashiCorp
1.5k188Updated 4 days agoGoMPL-2.0

Installation

/plugin install terraform@claude-plugins-official

Commands

tf:planPreview infrastructure changes
tf:stateInspect current Terraform state
tf:docsGenerate module documentation

How to install

  1. Open Claude Code in your terminal
  2. Run the installation command above
  3. The plugin will be enabled automatically
  4. Use the plugin's features in your Claude Code sessions

<img src="public/images/Terraform-LogoMark_onDark.svg" width="30" align="left" style="margin-right: 12px;"/> Terraform MCP Server

The Terraform MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with Terraform Registry APIs, enabling advanced automation and interaction capabilities for Infrastructure as Code (IaC) development.

Features

  • Dual Transport Support: Both Stdio and StreamableHTTP transports with configurable endpoints
  • Terraform Registry Integration: Direct integration with public Terraform Registry APIs for providers, modules, and policies
  • HCP Terraform & Terraform Enterprise Support: Full workspace management, organization/project listing, and private registry access
  • Workspace Operations: Create, update, delete workspaces with support for variables, tags, and run management
  • OTel metrics for monitoring tool usage: Integration with open telemetry meters to track tool-call volume, latency and failures in Streamable HTTP mode. Also exposes default http server metrics when this feature is enabled

Security Note: Depending on the query, the MCP server may expose certain Terraform data to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.

Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.

Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.

Prerequisites

  1. Ensure Docker is installed and running to use the server in a containerized environment.
  2. Install an AI assistant that supports the Model Context Protocol (MCP).

Command Line Options

Environment Variables:

VariableDescriptionDefault
TFE_ADDRESSSets the Terraform Enterprise/HCP Terraform address for API calls. Must include the protocol (e.g., https://app.terraform.io). In streamable-http mode this is the only way to set the address; it cannot be supplied by clients via header or query parameter.Optional
TFE_TOKENTerraform Enterprise API token"" (empty)
TF_MCP_SHARED_SECRETShared secret sent as the X-Tf-Mcp-Secret header on requests to HCP Terraform / TFE, used to identify requests originating from a hosted MCP deployment. Should only be used over TLS."" (empty)
TFE_SKIP_TLS_VERIFYSkip HCP Terraform or Terraform Enterprise TLS verificationfalse
LOG_LEVELLogging level: trace, debug, info, warn, error, fatal, panic (overrides --log-level flag)info
LOG_FORMATLogging format: text or json (overrides --log-format flag)text
TRANSPORT_MODESet to streamable-http to enable HTTP transport (legacy http value still supported)stdio
TRANSPORT_HOSTHost to bind the HTTP server127.0.0.1
TRANSPORT_PORTHTTP server port8080
MCP_ENDPOINTHTTP server endpoint path/mcp
MCP_REDIRECT_ROOT_URLURL to redirect requests to / to""
MCP_KEEP_ALIVEKeep-alive interval for SSE connections (e.g., 30s, 1m). 0 to disable0
MCP_SESSION_MODESession mode: stateful or statelessstateful
MCP_ALLOWED_ORIGINSComma-separated list of allowed origins for CORS"" (empty)
MCP_CORS_MODECORS mode: strict, development, or disabledstrict
MCP_TLS_CERT_FILEPath to TLS cert file, required for non-localhost deployment (e.g. /path/to/cert.pem)"" (empty)
MCP_TLS_KEY_FILEPath to TLS key file, required for non-localhost deployment (e.g. /path/to/key.pem)"" (empty)
MCP_RATE_LIMIT_GLOBALGlobal rate limit (format: rps:burst)10:20
MCP_RATE_LIMIT_SESSIONPer-session rate limit (format: rps:burst)5:10
MCP_ORGANIZATION_ALLOWLISTCSV list of HCP Terraform organization names allowed to access the HTTP server"" (empty)
MCP_FORWARD_CLIENT_IPForward the client IP to HCP Terraform / TFE via X-Forwarded-For. Set to true to enablefalse
MCP_REMOTE_IP_METHODHow the client IP is sourced when forwarding is enabled: RemoteAddr (direct connection only), X-Real-IP, or X-Forwarded-ForRemoteAddr
MCP_XFF_TRUSTED_HOPSNumber of trusted proxy hops counted from the right of the X-Forwarded-For chain. Only used when MCP_REMOTE_IP_METHOD=X-Forwarded-For0
ENABLE_TF_OPERATIONSEnable tools that require explicit approvalfalse
OTEL_METRICS_ENABLEDEnable tools and server metrics using otelfalse
OTEL_METRICS_SERVICE_VERSIONVersion of the terraform-mcp-server sending metrics, which is used to set metric attributes. It also helps track metrics across different deploymentslatest
OTEL_METRICS_SERVICE_NAMEIdentifies the source of the metrics (e.g., "terraform-mcp-server")terraform-mcp-server
OTEL_METRICS_EXPORT_INTERVALControls the frequency of metric flushes2
OTEL_METRICS_ENDPOINTURL of your OTel Collector or backendlocalhost:4318
INSTANA_ENABLEDEnable Instana instrumentation (metrics and HTTP request tracing) for the streamable-http server. Requires an Instana agent that is reachable by the server.false
# Stdio mode
terraform-mcp-server stdio [--log-file /path/to/log] [--log-level info] [--log-format text] [--toolsets <toolsets>] [--tools <tools>]

# StreamableHTTP mode
terraform-mcp-server streamable-http [--transport-port 8080] [--transport-host 127.0.0.1] [--mcp-endpoint /mcp] [--organization-allowlist <orgs-csv>] [--log-file /path/to/log] [--log-level info] [--log-format text] [--toolsets <toolsets>] [--tools <tools>]

Instructions

Default instructions for the MCP server is located in cmd/terraform-mcp-server/instructions.md, if those do not seem appropriate for your organization's Terraform practices or if the MCP server is producing inaccurate responses, please replace them with your own instructions and rebuild the container or binary. An example of such instruction is located in instructions/example-mcp-instructions.md

AGENTS.md essentially behaves as READMEs for coding agents: a dedicated, predictable place to provide the context and instructions to help AI coding agents work on your project. One AGENTS.md file works with different coding agents. An example of such instruction is located in instructions/example-AGENTS.md, in order to use it commit a file name AGENTS.md to the directory where your Terraform configurations reside.

Installation

Usage with Visual Studio Code

Add the following JSON block to your User Settings (JSON) file in VS Code. You can do this by pressing Ctrl + Shift + P and typing Preferences: Open User Settings (JSON).

More about using MCP server tools in VS Code's agent mode documentation.

<table> <tr><th>Version 0.3.0+ or greater</th><th>Version 0.2.3 or lower</th></tr> <tr valign=top> <td>
{
  "mcp": {
    "servers": {
      "terraform": {
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "-e", "TFE_TOKEN=${input:tfe_token}",
          "-e", "TFE_ADDRESS=${input:tfe_address}",
          "hashicorp/terraform-mcp-server:1.1.0"
        ]
      }
    },
    "inputs": [
      {
        "type": "promptString",
        "id": "tfe_token",
        "description": "Terraform API Token",
        "password": true
      },
      {
        "type": "promptString",
        "id": "tfe_address",
        "description": "Terraform Address",
        "password": false
      }
    ]
  }
}
</td> <td>
{
  "mcp": {
    "servers": {
      "terraform": {
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "hashicorp/terraform-mcp-server:0.2.3"
        ]
      }
    }
  }
}
</td> </tr> </table>

Optionally, you can add a similar example (i.e. without the mcp key) to a file called .vscode/mcp.json in your workspace. This will allow you to share the configuration with others.

<table> <tr><th>Version 0.3.0+ or greater</th><th>Version 0.2.3 or lower</th></tr> <tr valign=top> <td>
{
  "servers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e", "TFE_TOKEN=${input:tfe_token}",
        "-e", "TFE_ADDRESS=${input:tfe_address}",
        "hashicorp/terraform-mcp-server:1.1.0"
      ]
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "tfe_token",
      "description": "Terraform API Token",
      "password": true
    },
    {
      "type": "promptString",
      "id": "tfe_address",
      "description": "Terraform Address",
      "password": false
    }
  ]
}
</td> <td>
{
  "servers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server:0.2.3"
      ]
    }
  }
}
</td> </tr> </table>

<img alt="Install in VS Code (docker)" src="https://img.shields.io/badge/VS_Code-VS_Code?style=flat-square&label=Install%20Terraform%20MCP&color=0098FF"> <img alt="Install in VS Code Insiders (docker)" src="https://img.shields.io/badge/VS_Code_Insiders-VS_Code_Insiders?style=flat-square&label=Install%20Terraform%20MCP&color=24bfa5">

Usage with Cursor

Add this to your Cursor config (~/.cursor/mcp.json) or via Settings → Cursor Settings → MCP:

<table> <tr><th>Version 0.3.0+ or greater</th><th>Version 0.2.3 or lower</th></tr> <tr valign=top> <td>
{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e", "TFE_ADDRESS=<<PASTE_TFE_ADDRESS_HERE>>",
        "-e", "TFE_TOKEN=<<PASTE_TFE_TOKEN_HERE>>",
        "hashicorp/terraform-mcp-server:1.1.0"
      ]
    }
  }
}
</td> <td>
{
  "servers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server:0.2.3"
      ]
    }
  }
}
</td> </tr> </table> <a href="cursor://anysphere.cursor-deeplink/mcp/install?name=terraform&config=eyJjb21tYW5kIjoiZG9ja2VyIiwiYXJncyI6WyJydW4iLCItaSIsIi0tcm0iLCJoYXNoaWNvcnAvdGVycmFmb3JtLW1jcC1zZXJ2ZXIiXX0%3D"> <img alt="Add terraform MCP server to Cursor" src="https://cursor.com/deeplink/mcp-install-dark.png" height="32" /> </a>

Usage with Claude Desktop / Amazon Q Developer / Kiro CLI

More about using MCP server tools in Claude Desktop user documentation. Read more about using MCP server in Amazon Q Developer and Kiro CLI.

<table> <tr><

View source on GitHub