Terraform MCP Server
HashiCorp's official MCP server for the Terraform Registry and HCP Terraform: providers, modules, policies and workspaces
- 1,554 ★ on the repository
- Last commit
- MPL-2.0
Broad access
Why this level
- With a token it can create and delete workspaces and manage runs
- May expose Terraform data to the model and MCP client
- HTTP mode needs careful TLS, CORS and allowlist setup
Install
- Works in
Manual install
claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-serverLocal stdio transport.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- With a token it can create and delete workspaces and manage runs
- May expose Terraform data to the model and MCP client
- HTTP mode needs careful TLS, CORS and allowlist setup
This is third-party code. Review the repository files before installing.
What it does
The server gives the agent access to the public Terraform Registry: searching providers, modules and policies with current docs. With TFE_TOKEN it works with HCP Terraform and Terraform Enterprise: creating, updating and deleting workspaces, managing variables, tags and runs, and reaching the private registry. It supports stdio and StreamableHTTP transports; HTTP mode adds per-user tokens, an organization allowlist, rate limits and OpenTelemetry metrics. Tools can be restricted with --toolsets and --tools.
Who it is for. Engineers writing infrastructure in Terraform who want the agent to rely on current provider and module docs.
Good fit when
- The agent writes Terraform and must check the current provider schema
- You need to find a registry module for a task
- You need to manage workspaces and runs in HCP Terraform
- You need a centralized MCP server for a team with per-user permissions
Not a fit when
- Untrusted MCP clients or models: the server may expose Terraform data to them
- You work with OpenTofu or another IaC tool
Example request
Find a registry module for an AWS VPC and write the config using the latest provider versionMCP
- Transport
- stdio, http
- Authentication
- key is optional
Environment variables
TFE_TOKENsecret- Terraform Enterprise or HCP Terraform API token
TFE_ADDRESS- HCP Terraform or Terraform Enterprise address including protocol
ENABLE_TF_OPERATIONS- Enables tools that require explicit approval
TRANSPORT_MODE- streamable-http for HTTP transport, stdio by default
Limitations
The recommended setup needs Docker, with go install as an alternative. Tools requiring explicit approval are off by default and enabled via ENABLE_TF_OPERATIONS. Behind a TLS-inspecting corporate proxy you must mount a CA certificate. Outputs should be reviewed against your security and cost policies.
How to disable. Remove the server from your MCP client config or run claude mcp remove terraform. Restrict tools with --toolsets and --tools.
FAQ
Is a token required?
Not for the public registry. TFE_TOKEN and TFE_ADDRESS are needed for HCP Terraform and Terraform Enterprise tools.
Can I pass the token as a query parameter?
No, the server rejects such requests with a 400 error. Use the TFE_TOKEN header or Authorization: Bearer.
How is Terraform MCP different from Terraform skills?
It is the official HashiCorp MCP server. It gives the agent access to the public Terraform Registry: search for providers, modules and policies with current documentation. With a TFE_TOKEN it works with HCP Terraform and Terraform Enterprise.
Does Terraform MCP need a token and how do I connect it?
Reading the public registry needs no token. HCP Terraform needs TFE_TOKEN. In Claude Code: claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server. Pass the token in an environment variable, not in the address.
Discussion
No questions or reviews yet.
Related
MCP serversAn MCP server and CLI from AWS that builds baseline IAM policies from application code or a Terraform plan and resolves AccessDenied errors
Official HashiCorp skills for Terraform and Packer: HCL style, modules, tests, imports, Stacks, provider development and image builds
A self-hosted gateway that merges several MCP servers into one endpoint with auth and tool selection
Self-hosted MCP server for running commands on remote servers over SSH, with tokens and roles
MCP Gateway Registry
mcp-gateway-registry
One registry and gateway for MCP servers, agents and skills: shared login, OAuth, audit, OpenTelemetry. Community project for Docker and cloud
A Node.js manager for MCP servers: it starts local servers, connects remote ones and gives a client one address, with a REST API for control
README in short
Terraform MCP Server integrates with the Terraform Registry and HCP Terraform APIs to automate infrastructure-as-code work. The README covers setup for VS Code, Cursor, Claude Desktop, Claude Code, Codex CLI, Gemini, Amazon Q and Bob, plus a Helm chart for Kubernetes. It details environment variables, session modes, token passthrough, client IP forwarding and security measures. The full tool list lives in HashiCorp's docs. MPL-2.0 license.