tfmcp
A Rust MCP server for Terraform: the agent inspects a project, builds a saved plan, reviews its risks and applies that same plan
- 371 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- With the variables enabled it runs terraform apply and destroy and can change and delete production infrastructure
- Works with state, variables and an HCP Terraform token, which may hold secrets and cloud account data
- The audit log is kept in ~/.tfmcp/audit.log, and logging sensitive data is a separate switch
Install
- Works in
Manual install
cargo install tfmcpNeeds Rust 1.88 or newer and the Terraform CLI on PATH. Then find the path with which tfmcp.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- With the variables enabled it runs terraform apply and destroy and can change and delete production infrastructure
- Works with state, variables and an HCP Terraform token, which may hold secrets and cloud account data
- The audit log is kept in ~/.tfmcp/audit.log, and logging sensitive data is a separate switch
This is third-party code. Review the repository files before installing.
What it does
tfmcp runs local Terraform processes through MCP and walks the agent through a safe order of steps. prepare_terraform_change inspects the chosen folder: the Terraform version, workspace, backend, configuration validity and state readability. get_terraform_plan builds a plan and stores it under a plan_id, with sensitive values redacted. With that ID, analyze_plan, review_terraform_plan and summarize_plan_for_pr give a risk assessment and text for a pull request comment. A plan can be applied only by plan_id through apply_terraform, and infrastructure is destroyed only from a saved destroy plan through destroy_terraform. Terraform applies the saved plan even if configuration files were edited afterwards. Writes require the TFMCP_ALLOW_DANGEROUS_OPS and TFMCP_ALLOW_AUTO_APPROVE variables on the server, and deletion also needs TFMCP_DELETE_ENABLED. The apply result carries an exit code, diagnostics and recovery steps, and after a failure or timeout the same plan cannot be applied again. Beyond local Terraform the server searches providers, modules and policies in public and private registries and reads HCP Terraform and Terraform Enterprise data: organizations, projects, workspaces, runs and plans. Analysis covers configuration, state with drift detection, module health, secrets and the dependency graph. The server runs over stdio and Streamable HTTP, keeps an audit log and can cap the number of resources.
Who it is for. For DevOps engineers and infrastructure developers who work in Claude Desktop or Codex and want an agent to read Terraform projects and prepare changes with a mandatory plan review.
Good fit when
- You need to understand an unfamiliar Terraform project: find the root module and assess code quality and module health
- Before applying changes you want a plan risk review and ready text for a pull request comment
- You want the agent to apply only a reviewed saved plan, with file edits after review not reaching apply
- You need to find drift between state and real infrastructure without changing it
- You look up providers, modules and Sentinel or OPA policies in a registry and read HCP Terraform run data
Not a fit when
- You work with Pulumi, Ansible or CloudFormation: the server works with the Terraform CLI only
- You need a server with no Terraform installed: it calls the CLI and requires version 1.15.8 on PATH
- You want unattended changes to production: apply and destroy are off by default and a human must decide in the client
- You need recovery from a failed apply: no rollback or automatic retry is done, and live progress and restart recovery are not supported
Example request
Inspect my Terraform project in this folder, build a saved plan, assess the risks and show a pull request summary, but apply nothingMCP
- Transport
- stdio, http
- Authentication
- not required
Environment variables
TERRAFORM_DIR- Terraform project folder; if missing, a sample project is created in ~/terraform
TFMCP_ALLOW_DANGEROUS_OPS- Setting it to true allows apply and destroy; off by default
TFMCP_ALLOW_AUTO_APPROVE- Setting it to true allows auto-approve for dangerous operations; off by default
TFMCP_DELETE_ENABLED- Setting it to true allows applying saved destroy plans
Limitations
- Rust 1.88 or newer is needed to build, with Terraform CLI 1.15.8 on PATH and an MCP client such as Claude Desktop or Codex.
- The author warns that the project is under active development and advises reviewing every operation in production.
- Plan IDs live only within the server process, and at most 64 plans are retained. A saved plan is bound to the project, workspace, Terraform version and provider lockfile.
- Post-apply state verification checks resource addresses and does not check attribute or output values.
- For HCP Terraform and Terraform Enterprise the description speaks of read-only tools and operations behind permission gates.
- Upgrading from 0.2.2: `apply_terraform` now requires `plan_id`, and calls with only `auto_approve` return an explanation instead of running.
How to disable. Remove the tfmcp block from claude_desktop_config.json and restart the client. cargo uninstall tfmcp removes the installed program, and the audit log sits in ~/.tfmcp/audit.log, which you can delete by hand.
FAQ
How do I connect tfmcp to Claude Desktop?
Run cargo install tfmcp, find the path with which tfmcp and add a server with that command and the argument mcp to claude_desktop_config.json. In env set HOME, PATH and optionally TERRAFORM_DIR with the project folder. For Docker use the docker command and the tfmcp image instead.
Can tfmcp apply infrastructure changes on its own?
Only if you allowed it with the TFMCP_ALLOW_DANGEROUS_OPS and TFMCP_ALLOW_AUTO_APPROVE variables. They are off by default. Strictly the saved plan is applied by plan_id, and the decision to apply is made in the client before the call because Terraform receives no interactive input.
How do I destroy infrastructure through tfmcp?
Build a plan with get_terraform_plan and the destroy parameter, review it and call destroy_terraform with its plan_id and auto_approve. Besides the two apply permissions the server needs TFMCP_DELETE_ENABLED=true. Destroying without a saved plan is no longer possible.
What if apply failed or timed out?
The failed status means Terraform returned a nonzero exit code, and some changes may have been applied. The outcome_unknown status means no result was obtained, for example after a timeout. The same plan cannot be applied again: inspect state and actual resources, find the cause and build a new plan. The server does not roll back or retry.
Does tfmcp hide secrets in output?
Yes, sensitive values are redacted in the plan and in output values, including named queries. An audit log is kept in ~/.tfmcp/audit.log by default, and the TFMCP_AUDIT_LOG_SENSITIVE=true variable, which would put sensitive data into the log, is off by default.
Discussion
No questions or reviews yet.
Related
MCP serversHashiCorp's official MCP server for the Terraform Registry and HCP Terraform: providers, modules, policies and workspaces
An MCP server and CLI from AWS that builds baseline IAM policies from application code or a Terraform plan and resolves AccessDenied errors
An agent runs servers through a catalog of declared actions: policy decides what runs and what waits for a person
Terraform Skill
Terraform & OpenTofu Skill for AI Agents
A Terraform and OpenTofu best-practices skill: tests, modules, state, CI/CD and security scanning for AWS, Azure and GCP
The cronstable job scheduler exposes its jobs, run history and schedule debugging to an agent through MCP.
Terragrunt organizes OpenTofu and Terraform configurations into units with shared inputs, dependencies and ordered execution.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| tfmcp (this card) | no | not required | 371 | |
| HashiCorp Agent Skills | no | 913 | official HashiCorp skills for HCL style and tests, no Terraform runs through MCP | |
| Terraform Skill | no | 2,443 | a best-practices skill for Terraform and OpenTofu: tests, modules, state, CI | |
| TerraShark | no | 710 | a skill that cuts agent hallucinations in Terraform and runs no MCP server |
README in short
The README describes the latest release and a capability table, then installation from source, crates.io and Docker, requirements and the Claude Desktop setup. The main part covers the plan workflow from preparation to result checks, tables of all tools, environment variables and security guidance.