Log inSubmit server
MCP Server Terraform logo

MCP Server Terraform

by RajeevSirohi

Runs Terraform through MCP with confirmation gates, risk and cost analysis, drift checks, state management, and provider authentication checks.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install MCP Server Terraform

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "rajeevsirohi-mcp-server-terraform": {
      "command": "npx",
      "args": [
        "-y",
        "@rajsir/mcp-server-terraform"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Automated check passed— started and listed 11 tools correctly (1mo ago).

Overview

RajeevSirohi/mcp-server-terraform MCP server exposes local Terraform operations through MCP-compatible clients such as Claude Desktop. It translates tool calls into Terraform CLI commands for initialization, validation, planning, applying, state and workspace inspection, drift detection, and resource maintenance. Plans include change summaries and warnings for selected always-on resources, while apply and destroy require a separate confirmation step. Reach for it when you want conversational Terraform workflows with configurable safety restrictions and optional audit logging.

Use cases

  • Plan Terraform changes and review resource risk before applying
  • Check provider authentication before running infrastructure operations
  • Detect cloud-console changes with a refresh-only drift check
  • Inspect state, outputs, and workspaces through an MCP client
  • Import or taint resources during infrastructure maintenance

Key features

  • Two-step confirmation for apply and destroy
  • Terraform plan risk and cost summaries
  • Drift detection with changed attributes
  • State and workspace management
  • Provider authentication preflight checks
  • Optional redacted audit logging

Tools11

What MCP Server Terraform lets your agent do. Expand a tool for its parameters.

Verified live~1.9k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked Today

Recent health check succeeded.

21/22 checks healthy over the last 90d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 6d ago via OSV.dev · @rajsir/mcp-server-terraform (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.
npm downloads193Package downloads in the last 30 days.
Last commit4mo agoMost recent push to the default branch.
Availability100%Our rolling endpoint + install checks that succeeded.
Install checkPassedOur sandbox started it and listed its tools.
Tools exposed11Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How MCP Server Terraform works

What RajeevSirohi/mcp-server-terraform MCP server does

RajeevSirohi/mcp-server-terraform MCP server connects an MCP client to the Terraform CLI installed on the host machine. It lets an agent work with Terraform directories and workspaces through structured tools rather than requiring the user to type each CLI command manually.

The server covers the main workflow from initialization and syntax validation through planning and applying. It also exposes state and workspace operations, output inspection, provider authentication checks, drift detection, and resource actions such as import, taint, untaint, and refresh.

Plan results are analyzed through Terraform’s JSON output. The response summarizes creates, updates, destroys, and replacements, and flags selected resources that can create recurring costs when left running. Examples named by the project include NAT gateways, managed Kubernetes control planes, database services, load balancers, and Azure Firewall.

How it works

Tool requests are converted into Terraform CLI execution on the local machine. The working directory and other operation parameters are supplied through the MCP tool call, allowing an agent to target a particular configuration or workspace.

The safety model gives tf_apply and tf_destroy two stages. Without confirmation, the requested operation produces a plan preview and does not change infrastructure. A later call with confirmed: true performs the operation. The confirmation requirement is implemented by the server rather than relying only on instructions given to the model.

tf_drift uses a refresh-only plan to identify changes made outside Terraform. Its report includes changed attribute names and describes remediation choices. The tf_preflight tool checks provider CLI authentication before an operation and can indicate which provider login command is needed.

The project also provides a /tf-diagnose prompt for a structured five-step investigation of plan or apply failures. Audit logging is optional; when enabled, each tool call is written as a JSON line containing the time, tool name, result, and duration. Variable values are redacted, while variable names remain visible.

Setup and configuration

RajeevSirohi/mcp-server-terraform requires Node.js 18 or newer and the Terraform CLI on the system PATH.

Claude Desktop can start the server with npx and the package name in its MCP configuration. A source checkout can instead be started with node and the absolute path to the compiled dist/index.js file. The client must be restarted after changing its configuration.

Several environment variables control exposure and logging. ALLOW_ONLY_READONLY_TOOLS=true limits availability to validation, planning, and output reading. ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS=true blocks apply, destroy, and state move/remove operations. ALLOWED_TOOLS accepts an explicit comma-separated tool allowlist. AUDIT_LOG_PATH enables JSON-lines audit output at the selected path.

Tools and capabilities

The available tools are:

  • tf_init initializes a Terraform working directory.
  • tf_validate checks configuration syntax.
  • tf_plan returns a Terraform diff with risk and cost analysis.
  • tf_apply and tf_destroy execute changes only after confirmation.
  • tf_output reads values from state.
  • tf_state lists, shows, moves, or removes state entries.
  • tf_workspace lists, displays, selects, or creates workspaces.
  • tf_preflight checks provider CLI authentication.
  • tf_drift searches for changes made outside Terraform.
  • tf_resource imports, taints, untaints, or refreshes resources.

The project is suited to plan-review-apply workflows, cautious experiments, state inspection, and diagnosing configuration or authentication problems. It can also be configured for shared or sensitive environments where only read-only or explicitly allowed tools should be exposed.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about MCP Server Terraform

RajeevSirohi/mcp-server-terraform is an MCP server that connects an MCP client to the local Terraform CLI. Its main tools initialize and validate configurations, create plans, apply or destroy changes with confirmation, inspect state and outputs, manage workspaces, check provider authentication, detect drift, and handle resource import or taint operations.

Run it directly with `npx @rajsir/mcp-server-terraform`; Node.js 18 or later and Terraform on `PATH` are required. For development, clone the repository, run `npm install`, and build it with `npm run build`.

It requires a two-step flow for apply and destroy. The first call runs a plan and changes nothing; the operation proceeds only on a later call with `confirmed: true`. Non-destructive and read-only environment modes can also block destructive tools.

Yes. Claude Desktop is documented as a supported client. Configure it to launch the npm package with `npx`, or point the configuration to the compiled `dist/index.js` when running from source.

Set `AUDIT_LOG_PATH` to a file path before starting the server. Each tool call is appended as a JSON line with a timestamp, tool name, outcome, and duration; variable values are redacted while their names are logged.

Related MCP servers

All in Cloud Platforms All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewMCP Server Terraform AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/rajeevsirohi-mcp-server-terraform?style=directory)](https://allmcps.com/mcp/rajeevsirohi-mcp-server-terraform)
HTML Embed
<a href="https://allmcps.com/mcp/rajeevsirohi-mcp-server-terraform"><img src="https://allmcps.com/api/badge/rajeevsirohi-mcp-server-terraform?style=directory" alt="MCP Server Terraform on AllMCPs" /></a>