Finopsmcp vs MCP Server Terraform
A side-by-side look at the Finopsmcp and MCP Server Terraform MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Finopsmcp for cloud platforms work as a local process; choose MCP Server Terraform for cloud platforms as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Finopsmcp when
- You need dedicated capabilities in the Cloud Platforms domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
connect_aws, connect_azure, get_cost_summary.
Choose MCP Server Terraform when
- You need dedicated capabilities in the Cloud Platforms domain.
- You prefer a local stdio subprocess transport.
- You want tools like
tf_validate, tf_plan, tf_output.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Cloud Platforms | Cloud Platforms |
| Quality signal | 60/100 · Good | 59/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | No auth required | Not declared |
| Pricing | Free | Not declared |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 18 | 1 |
| Directory activity | 2 views 0 installs 0 upvotes | 2 views 0 installs 0 upvotes |
| Tools | 10 | 11 |
| Full listing | View Finopsmcp | View MCP Server Terraform |
Tools & capabilities
Finopsmcp tools 10
connect_awsConnect an AWS account from inside your MCP client, no terminal needed. Propose-then-confirm and local-only. It reads AWS credentials that already exist on this machine (named profiles, environment, the default chain), verifies each against STS, and connects the one you choose. It never creates, modifies, or deletes anything in your AWS account, and credentials stay on this machine. Call it with no arguments first to see which accounts are available (nothing is stored). Then call it again with account_id set to the one to connect. Examples: - "Connect my AWS account" - "Use the credentials on this machine to connect AWS"connect_azureGuide connecting Azure while keeping the service-principal secret off the model. Azure has no local credentials nable can safely auto-detect, so connecting needs a client secret. Unlike connect_aws and connect_gcp (which read credentials already on the machine, so nothing sensitive passes through this conversation), an Azure secret would have to be pasted into the chat to reach a tool argument, which routes it through the model provider. nable does not do that. This tool returns the Cloud Shell script and has you finish the connect in your OWN terminal with `finops setup azure`, which encrypts the secret into your local vault. The model never sees the secret. Examples: - "Connect Azure" - "How do I connect my Azure subscription?"get_cost_summaryGet total spend summarized by service, account, and region. Examples: - "How much did we spend last month?" - "Give me an AWS cost summary for January"estimate_change_costCost preflight for a proposed change: what it costs and whether it fits budget. Agent-native. Call this BEFORE applying an infrastructure change to get a machine verdict (ok / warn / over_budget / no_budget) plus the monthly and annual cost delta and the budget headroom. Read-only: it estimates and checks, it never applies anything. Describe the change one of these ways: - terraform_plan_json / terraform_plan_file / tf_dir : a Terraform plan - helm_diff : output of `helm diff upgrade` or a values.yaml diff - monthly_delta_usd : a known monthly cost delta (escape hatch for any change the estimators don't parse, e.g. "launch a db.r6g.4xlarge") budget_name selects which budget to check against; default is the first active budget. With no budget configured the verdict is "no_budget" and the cost delta is still returned. Good triggers: "will this fit my budget", "what will this terraform/helm change cost before I apply it", "cost preflight", "can the agent afford this change". Examples: - "What would this change cost per month?" - "Preflight the cost of this terraform plan"connect_gcpConnect a Google Cloud billing account from inside your MCP client, no terminal. Propose-then-confirm and local-only. It reads Google Cloud credentials that already exist on this machine (GOOGLE_APPLICATION_CREDENTIALS or gcloud Application Default Credentials), lists the open billing accounts they can see, and connects the one you choose. It never changes anything in GCP, and credentials stay on this machine. Call it with no arguments to see the billing accounts available (nothing is stored). Then call it again with billing_account_id set to connect one. Examples: - "Connect my Google Cloud billing" - "Use my gcloud login to connect GCP"list_connected_providersList every cloud, SaaS, and LLM provider nable knows, each marked connected or not-configured, plus the active plan. The starting point for "what am I connected to" and for spotting which connector still needs credentials (each not-configured entry names the setup command to run). Examples: - "Which providers are connected?" - "Is GCP set up yet?"check_ai_budgetAdvisory gate: before a big task, is the agent about to blow its AI budget? Call this before an expensive run. Returns a verdict (ok / warn / over), the reason, and a recommendation. Advice only, it never blocks; relay the verdict and let the human decide. Pass estimated_next_tokens to test whether the next task would tip a token budget over.check_action_policyAdvisory policy gate: should a proposed remediation action proceed? The request-path guardrail, advisory. Describe a remediation action you are considering (action_type), optionally with the change to cost (a Terraform plan, a helm diff, or a known monthly delta), and nable returns a machine verdict against your human-authored policy: - allow: reversible, allowlisted, and within budget. A human can apply it. - escalate: a one-way door (delete, terminate, buy a commitment) or an over-budget / large-cost change. A human must review it first. - block: the action type is not in your allowlist. ADVICE ONLY. nable never applies the action, a human does. This is the propose-only guardrail; nable does not auto-execute anything. action_type examples: rightsizing, tag_fix, stop_idle, spot_migration, ticket (reversible); idle_cleanup, purchase_commitment, terminate_instance, delete_resource (one-way). Policy knobs via env: FINOPS_POLICY_MAX_AUTO_USD, FINOPS_POLICY_ALLOWED_ACTIONS (comma-separated). Read-only. Good triggers: "can the agent do X", "is this action within policy", "should I apply this fix", "is it safe to auto-apply this". Examples: - "Is this apply within policy?" - "Check this change against our cost guardrails"what_can_nable_doShow everything nable can do, tailored to what you've connected. Call this when the user asks "what can you do?", "what features do you have?", "what should I try first?", "show me what's available", or "help". Always call it right after a user connects their first account, so they see what just became possible. Pass detailed=True to also list the underlying tool names. Examples: - "What can nable do?" - "List your capabilities"nable_setup_statusAgent-driven onboarding: what is connected, what credentials are already on this machine, and the exact command to connect each remaining provider. Call this when the user asks to connect a provider, says setup is incomplete, or asks what they are missing. Detected ambient credentials (gcloud login, env keys, ~/.modal.toml) mean the connect is ONE terminal command with no secrets involved; run it for the user or hand them the command. Rules for the agent, and they are hard rules: - NEVER ask the user to paste an API key or secret into the chat. For paste-a-key providers, have them run the setup command in their own terminal; it deep-links the key page and stores the key locally. - Prefer the zero-secret paths: `finops connect` (batch-connects everything detected) and `finops setup gcp` / ambient AWS, where no secret ever passes through the conversation. Examples: - "Connect my GCP costs" - "What providers am I missing?"
MCP Server Terraform tools 11
tf_validateValidate Terraform configuration files for syntax and internal consistency. Does not access remote state or APIs.tf_planRun terraform plan and return a human-readable diff of what will change. Safe — makes no changes to infrastructure.tf_outputRead Terraform output values from the current state. Returns all outputs as JSON, or a specific output by name.tf_preflightCheck which cloud providers are used in a Terraform workspace and verify authentication status for each. Call this before plan or apply to catch credential issues early.tf_driftDetect infrastructure drift — resources that were changed outside of Terraform (e.g. manually in the cloud console). Runs a refresh-only plan and reports differences between state and reality. Read-only, makes no changes.tf_applyApply Terraform changes to real infrastructure. TWO-STEP SAFETY FLOW: 1. Call without confirmed=true → runs terraform plan, shows the diff, returns without applying. 2. Call with confirmed=true after reviewing the diff → actually applies the changes. Never pass confirmed=true without first showing the plan output to the user.tf_destroyDestroy all Terraform-managed infrastructure in the workspace. TWO-STEP SAFETY FLOW: 1. Call without confirmed=true → shows the destroy plan (what will be deleted). 2. Call with confirmed=true after the user explicitly approves → destroys everything. This is irreversible. Always show the plan and get explicit user approval first.tf_stateManage Terraform state. Supports the following operations: - list: List all resources in state - show: Show attributes of a specific resource - mv: Move/rename a resource in state (use with care) - rm: Remove a resource from state without destroying it (destructive)tf_resourceResource-level state operations: - import: Bring an existing cloud resource under Terraform management (requires address + id) - taint: Mark a resource for recreation on next apply (requires address) - untaint: Remove the taint mark (requires address) - refresh: Sync state with real infrastructure (accepts drift into state)tf_initInitialize a Terraform working directory. Downloads providers and modules. Run this before plan or apply on a fresh workspace.tf_workspaceManage Terraform workspaces. Supports: - list: List all workspaces and show which is active - show: Show the current workspace name - select: Switch to a workspace - new: Create a new workspace
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Finopsmcp
{
"mcpServers": {
"chaandannn-finopsmcp": {
"command": "uvx",
"args": [
"nable"
]
}
}
}
MCP Server Terraform
{
"mcpServers": {
"rajeevsirohi-mcp-server-terraform": {
"command": "npx",
"args": [
"-y",
"@rajsir/mcp-server-terraform"
]
}
}
}
Frequently asked questions
Finopsmcp is categorized under Cloud Platforms and uses a local stdio subprocess. MCP Server Terraform belongs to Cloud Platforms and uses a local stdio subprocess. Pick Finopsmcp for cloud platforms work and MCP Server Terraform for cloud platforms.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Finopsmcp is listed as free. Auth: no auth required. MCP Server Terraform has no declared pricing — check the project's own site. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add chaandannn-finopsmcp and rajeevsirohi-mcp-server-terraform as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Finopsmcp has a quality signal of 60/100 (Good) with 2 views, 0 installs and 18 GitHub stars. MCP Server Terraform has 59/100 (Good) with 2 views, 0 installs and 1 GitHub stars.