Terraform MCP Server

The Terraform MCP Server is a Model Context Protocol (MCP) server that integrates with Terraform Registry APIs. It enables advanced automation and interaction for Infrastructure as Code (IaC) development by providing tools for:

• Terraform Registry Integration: Accessing public providers, modules, and policies.
• HCP Terraform & Terraform Enterprise Support: Managing workspaces, listing organizations/projects, and accessing private registries.
• Workspace Operations: Creating, updating, and deleting workspaces, including managing variables, tags, and runs.
• Dual Transport Support: Operating in either stdio or streamable-http modes.
• Observability: Providing OpenTelemetry (OTel) metrics for tool-call volume, latency, and failures in streamable-http mode.

Security Warning: The MCP server may expose Terraform data to the MCP client and LLM. Do not use it with untrusted clients or LLMs.

The Terraform MCP (Model Context Protocol) server is a specialized tool that enables LLMs to generate high-quality Terraform code and manage Terraform workflows through API integrations with HCP Terraform and Terraform Enterprise.

Core Capabilities

Code Generation Enhancement

• Registry Integration: Connects to both public and private Terraform registries for module and provider information.
• Style Guide Compliance: Provides access to Terraform styling guide resources for consistent HCL/TF file generation.
• Module Development: Supports creation of reusable Terraform modules following best practices.

Workflow Automation

• API Operations: Executes HCP Terraform and Terraform Enterprise commands via API calls.
• Iterative Development: Enables automated testing, refinement, and enhancement of Terraform configurations.
• State Management: Facilitates proper state handling and workspace management.

To ensure high-quality, compatible, and valid Terraform code, follow these guidelines when using the MCP server tools:

1. Registry-First Approach: Before generating code, always query registries for the latest provider/module versions and styling guidelines. If an enterprise token is provided, search private registries before falling back to public ones.
2. Provider Consistency: Ensure all modules in a project use compatible provider versions. Use get_provider_details to verify compatibility before generation.
3. Validation Workflow: Follow this sequence after generating code:
   • Run terraform validate immediately after generation.
   • Run terraform plan only if validation passes.
   • Use terraform fmt to ensure correct formatting.
4. Safety First: Always obtain explicit user confirmation (yes/no) before executing destructive or state-changing operations such as create_run, apply_run, discard_run, or cancel_run.

To use the Terraform MCP server in VS Code (agent mode), add the configuration to your User Settings (JSON).

For Version 0.3.0+, use the mcp key and define inputs to securely prompt for credentials. For Version 0.2.3 or lower, use the legacy format.

You can also create a .vscode/mcp.json file in your workspace to share the configuration with your team (omit the mcp key for workspace-level files).

// VS Code User Settings (JSON) - Version 0.3.0+
{
  "mcp": {
    "servers": {
      "terraform": {
        "command": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "-e", "TFE_TOKEN=${input:tfe_token}",
          "-e", "TFE_ADDRESS=${input:tfe_address}",
          "hashicorp/terraform-mcp-server:1.1.0"
        ]
      }
    },
    "inputs": [
      {
        "type": "promptString",
        "id": "tfe_token",
        "description": "Terraform API Token",
        "password": true
      },
      {
        "type": "promptString",
        "id": "tfe_address",
        "description": "Terraform Address",
        "password": false
      }
    ]
  }
}

Follow these specific workflows for validating code and performing destructive operations:

Validation Workflow

Execute validation in this specific order:

1. terraform validate: Run immediately after code generation to verify syntax correctness, resource attribute validity, and provider configuration completeness.
2. terraform plan: Only execute after successful validation to review resource changes and identify potential issues before apply.

User Confirmation Requirements

MANDATORY: Request explicit user confirmation before executing any of these destructive operations:

• create_run: Initiates a new Terraform run
• apply_run: Applies changes to infrastructure
• discard_run: Discards a planned run
• cancel_run: Cancels an in-progress run

The confirmation prompt must include:

• A clear description of the operation.
• A list of resources to be affected.
• Potential risks or impacts.
• A request for explicit "yes/no" confirmation.