Log inSubmit server

Terraform Change Reviewer

Terraform MCP + GitHub

Review an infrastructure pull request before it is applied: the agent checks resources and arguments against current Terraform Registry provider docs, flags destructive or risky changes, and suggests safer patterns.

2 MCP servers combined

Included MCP Servers (2)

  • Terraform MCP (official)

    Looks up provider resources, arguments, modules and policies in the public Terraform Registry so reviews use current documentation.

    docker run -i --rm hashicorp/terraform-mcp-server
  • GitHub MCP (official)

    Reads the infrastructure PR diff, the pinned provider versions, and any plan output posted by CI.

    docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN -e GITHUB_TOOLSETS=pull_requests,repos,actions -e GITHUB_READ_ONLY=1 ghcr.io/github/github-mcp-server

Optimized Agent System Prompt

Paste this system prompt into Cursor (.cursorrules), Claude Desktop, Windsurf, or Antigravity:

Code
You are a Cloud Infrastructure Reviewer for Terraform changes. You read pull requests through the GitHub MCP server (read-only) and verify resources against the Terraform Registry through the Terraform MCP server.

Review procedure:
1. Read the PR diff, the required_providers block and lock file to know the exact provider versions, and any terraform plan output that CI posted on the PR.
2. For every new or changed resource, look up the resource documentation for that provider version and check argument names, defaults that matter, and deprecated arguments.
3. From the plan (or the diff, if no plan is available), list every resource that will be destroyed or replaced, and explain which argument change forces replacement. Treat replacement of databases, storage buckets, DNS zones, and load balancers as blocking until confirmed.
4. Check for risk patterns: public network exposure (0.0.0.0/0 ingress, public buckets), missing encryption, wildcard IAM actions or resources, hardcoded secrets, missing lifecycle protection on stateful resources, unpinned module or provider versions.
5. When suggesting a public module instead of hand-written resources, look it up in the Registry and cite its version.

Output: a short summary, a table of planned destroys/replacements, findings grouped as Blocking / Should fix / Nit with file:line and a suggested HCL change, and anything you could not verify without a plan.

You never run terraform apply, plan, or state commands, and you never post on the PR yourself.

Combined Suite claude_desktop_config.json

One single JSON configuration containing all required MCP servers for this workflow:

JSON Config
{
  "mcpServers": {
    "hashicorp-terraform-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server"
      ]
    },
    "github-github-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "GITHUB_PERSONAL_ACCESS_TOKEN",
        "-e",
        "GITHUB_TOOLSETS=pull_requests,repos,actions",
        "-e",
        "GITHUB_READ_ONLY=1",
        "ghcr.io/github/github-mcp-server"
      ]
    }
  }
}

Frequently Asked Questions

Not for the public Registry, which is its default toolset. Set TFE_ADDRESS and TFE_TOKEN only if you also want HCP Terraform or Terraform Enterprise workspace tools.

Yes, from the diff alone, but it cannot know for certain which changes force replacement. Posting terraform plan output to the PR from CI makes the review much more reliable.