Terraform MCP Server
HashiCorp's official MCP server for the Terraform Registry and HCP Terraform: providers, modules, policies and workspaces
Install
claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-serverLocal stdio transport.
This is third-party code. Review the repository files before installing.
What it does
The server gives the agent access to the public Terraform Registry: searching providers, modules and policies with current docs. With TFE_TOKEN it works with HCP Terraform and Terraform Enterprise: creating, updating and deleting workspaces, managing variables, tags and runs, and reaching the private registry. It supports stdio and StreamableHTTP transports; HTTP mode adds per-user tokens, an organization allowlist, rate limits and OpenTelemetry metrics. Tools can be restricted with --toolsets and --tools.
Who it is for. Engineers writing infrastructure in Terraform who want the agent to rely on current provider and module docs.
Good fit when
- The agent writes Terraform and must check the current provider schema
- You need to find a registry module for a task
- You need to manage workspaces and runs in HCP Terraform
- You need a centralized MCP server for a team with per-user permissions
Not a fit when
- Untrusted MCP clients or models: the server may expose Terraform data to them
- You work with OpenTofu or another IaC tool
Example request
Find a registry module for an AWS VPC and write the config using the latest provider versionLimitations
The recommended setup needs Docker, with go install as an alternative. Tools requiring explicit approval are off by default and enabled via ENABLE_TF_OPERATIONS. Behind a TLS-inspecting corporate proxy you must mount a CA certificate. Outputs should be reviewed against your security and cost policies.
How to disable. Remove the server from your MCP client config or run claude mcp remove terraform. Restrict tools with --toolsets and --tools.
MCP
- Transport
- stdio, http
- Authentication
- API key
| Environment variables | |
|---|---|
| TFE_TOKEN secret | Terraform Enterprise or HCP Terraform API token |
| TFE_ADDRESS | HCP Terraform or Terraform Enterprise address including protocol |
| ENABLE_TF_OPERATIONS | Enables tools that require explicit approval |
| TRANSPORT_MODE | streamable-http for HTTP transport, stdio by default |
Security check
- With a token it can create and delete workspaces and manage runs
- May expose Terraform data to the model and MCP client
- HTTP mode needs careful TLS, CORS and allowlist setup
README in short
Terraform MCP Server integrates with the Terraform Registry and HCP Terraform APIs to automate infrastructure-as-code work. The README covers setup for VS Code, Cursor, Claude Desktop, Claude Code, Codex CLI, Gemini, Amazon Q and Bob, plus a Helm chart for Kubernetes. It details environment variables, session modes, token passthrough, client IP forwarding and security measures. The full tool list lives in HashiCorp's docs. MPL-2.0 license.
FAQ
Is a token required?
Not for the public registry. TFE_TOKEN and TFE_ADDRESS are needed for HCP Terraform and Terraform Enterprise tools.
Can I pass the token as a query parameter?
No, the server rejects such requests with a 400 error. Use the TFE_TOKEN header or Authorization: Bearer.
Related
Kubernetes MCP
MCP Server Kubernetes
MCP server for managing a Kubernetes cluster through kubectl and Helm, with a non-destructive mode
CLI for full-cycle CI/CD to Kubernetes: image builds, Helm-based deploys and container registry cleanup
Terraform Skill
Terraform & OpenTofu Skill for AI Agents
A Terraform and OpenTofu best-practices skill: tests, modules, state, CI/CD and security scanning for AWS, Azure and GCP
A Helm alternative for deploying charts to Kubernetes with release plans, resource tracking and encrypted secrets