Terraform MCP Server

What hashicorp/terraform-mcp-server does

hashicorp/terraform-mcp-server gives MCP clients access to Terraform ecosystem APIs. It can query public Registry data for providers, modules, and policies, and it supports HCP Terraform and Terraform Enterprise features such as organization and project listing, private registry access, and workspace operations.

Workspace-oriented operations include creating, updating, and deleting workspaces, working with workspace variables and tags, and managing runs. Operations that require explicit approval can be enabled separately through configuration.

How it works

The server communicates with MCP clients over stdio or Streamable HTTP. Stdio is the default transport. HTTP deployments can bind to a configured host and port, expose a configurable MCP endpoint, use stateful or stateless sessions, and apply CORS and rate-limit settings.

Terraform Enterprise or HCP Terraform requests use the configured service address and API token. HTTP deployments can also pass a shared secret, forward client IP information, restrict access by organization, and terminate TLS using certificate and key files. OpenTelemetry metrics can record tool-call volume, latency, failures, and server HTTP metrics when enabled; Instana instrumentation is also available for Streamable HTTP deployments.

Setup and configuration

Docker is required for the containerized setup, and the client must support MCP. Configuration is available through environment variables. TFE_ADDRESS selects the HCP Terraform or Terraform Enterprise endpoint, while TFE_TOKEN supplies its API token. TRANSPORT_MODE=streamable-http switches from stdio to HTTP; TRANSPORT_HOST, TRANSPORT_PORT, and MCP_ENDPOINT control the HTTP listener.

HTTP deployments can configure MCP_SESSION_MODE, MCP_ALLOWED_ORIGINS, MCP_CORS_MODE, MCP_TLS_CERT_FILE, MCP_TLS_KEY_FILE, and rate limits. Logging uses LOG_LEVEL and LOG_FORMAT. Set ENABLE_TF_OPERATIONS=true to enable approval-requiring tools. Metrics use the OTEL_* settings, and INSTANA_ENABLED=true enables Instana instrumentation when an accessible Instana agent is available.

The project documents configuration examples for Visual Studio Code, Cursor, Claude Desktop, Claude Code, Codex CLI, and Gemini extensions. It also supports building and running the server from source or as a locally built Docker image.

Tools and capabilities

• Search Terraform Registry providers, modules, and policies.
• List HCP Terraform or Terraform Enterprise organizations and projects.
• Access private registry content.
• Create, update, and delete workspaces.
• Manage workspace variables, tags, and runs.
• Expose optional tool-usage and HTTP metrics through OpenTelemetry.

Limitations and notes

Queries can expose Terraform data to the MCP client and its connected language model, so the server should not be used with untrusted clients or models. Generated outputs and recommendations vary with the query, model, and client; review them against security, cost, and compliance requirements before applying them.

For centralized HTTP deployments, TLS, origin controls, rate limits, trusted proxy settings, and organization allowlists should be configured according to the deployment topology. Skipping TLS verification is available as an option, but it changes certificate validation behavior.