MCP.Market

Terraform MCP server

by RajeevSirohi·io.github.RajeevSirohi/mcp-server-terraform·v0.2.1·1 stars
No reviews yet

Safety-first Terraform: confirmation-gated apply/destroy, risk & cost analysis, drift detection

A88/100grade A
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
A88/100

full report

Adoption
New

1 stars34 downloads/wk

Reviews

Write one

Nobody has reviewed Terraform yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Terraform tools (11, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • tf_apply

    Apply Terraform changes to real infrastructure. TWO-STEP SAFETY FLOW: 1. Call without confirmed=true → runs terraform plan, shows the diff, returns without applying. 2. Call with confirmed=true after reviewing the diff → actually applies the changes. Never pass confirmed=true without first showing the plan output to the user.

  • tf_destroywrite action

    Destroy all Terraform-managed infrastructure in the workspace. TWO-STEP SAFETY FLOW: 1. Call without confirmed=true → shows the destroy plan (what will be deleted). 2. Call with confirmed=true after the user explicitly approves → destroys everything. This is irreversible. Always show the plan and get explicit user approval first.

  • tf_drift

    Detect infrastructure drift — resources that were changed outside of Terraform (e.g. manually in the cloud console). Runs a refresh-only plan and reports differences between state and reality. Read-only, makes no changes.

  • tf_init

    Initialize a Terraform working directory. Downloads providers and modules. Run this before plan or apply on a fresh workspace.

  • tf_output

    Read Terraform output values from the current state. Returns all outputs as JSON, or a specific output by name.

  • tf_planwrite action

    Run terraform plan and return a human-readable diff of what will change. Safe — makes no changes to infrastructure.

  • tf_preflight

    Check which cloud providers are used in a Terraform workspace and verify authentication status for each. Call this before plan or apply to catch credential issues early.

  • tf_resource

    Resource-level state operations: - import: Bring an existing cloud resource under Terraform management (requires address + id) - taint: Mark a resource for recreation on next apply (requires address) - untaint: Remove the taint mark (requires address) - refresh: Sync state with real infrastructure (accepts drift into state)

  • tf_state

    Manage Terraform state. Supports the following operations: - list: List all resources in state - show: Show attributes of a specific resource - mv: Move/rename a resource in state (use with care) - rm: Remove a resource from state without destroying it (destructive)

  • tf_validate

    Validate Terraform configuration files for syntax and internal consistency. Does not access remote state or APIs.

  • tf_workspace

    Manage Terraform workspaces. Supports: - list: List all workspaces and show which is active - show: Show the current workspace name - select: Switch to a workspace - new: Create a new workspace

Public scan report

scanner v0.1.9 · 2026-09-26 · same rubric, same numbers if you re-run it

no findings
  • Code scan39 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 81 days ago12/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 88/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Terraform compares

Against every graded Developer tools MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
88/100
higher than 75% of 1,119 Developer tools servers
Tools
11
the typical Developer tools server has 7
Tools that change things
18%
typical: 5%. Fewer write tools means less an agent can break
GitHub stars
1
more than 50% of 854 Developer tools servers
Downloads a week
34
more than 20% of 430 Developer tools servers with a package

What its tools let an agent do: 9 read · 2 change

Install Terraform in Claude Code, Cursor or VS Code

Runs npx -y @rajsir/mcp-server-terraform on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add mcp-server-terraform -- npx -y @rajsir/mcp-server-terraform
Add to Cursor

What the publisher says

From the Terraform repository's README, as published. We do not edit it. Read it on GitHub

mcp-server-terraform

A Model Context Protocol (MCP) server that lets Claude manage Terraform infrastructure through natural language.

Run plans, apply changes, inspect state, and diagnose failures — all from a Claude conversation.

What it does

Instead of switching to a terminal to run terraform plan, you can ask Claude:

"Plan the changes in /infra/staging and explain what will change"

"Apply it — but only if no resources will be destroyed"

"Show me all the outputs from the prod workspace"

"Something broke after the last apply — diagnose it"

The server translates these into real terraform CLI commands on your machine, with a built-in safety confirmation flow before any destructive operation runs.

Tools

Plan risk & cost summary

Every plan (and every apply preview) is analyzed via terraform show -json and annotated with a structured summary — destroyed resources are called out, and always-on resources that commonly cause bill shock are flagged with rough monthly costs:

── Plan Summary ──
+ 3 create, ~ 1 update, - 0 destroy, ± 0 replace

💸 EXPENSIVE — always-on resources being created:
   ⚠ aws_nat_gateway.main (~$32/month + data processing if left running)
   Remember to tf_destroy when you're done experimenting.

Cost-flagged resource types include NAT gateways, load balancers, EKS/AKS/GKE control planes, RDS/Cloud SQL instances, ElastiCache, Redshift, MSK, and Azure Firewall (~$900/month!).

Drift detection

tf_drift runs a refresh-only plan and reports resources that were changed outside Terraform (e.g. manually in the cloud console), with the changed attribute names and remediation options.

Audit logging

Set AUDITLOGPATH to a file path and every tool call is appended as a JSON line with timestamp, tool name, outcome, and duration. Variable values are always redacted (db_password=) — only names are logged.

Confirmation flow

tfapply and tfdestroy use a two-step safety flow:

  1. First call (no confirmed) → runs terraform plan, shows the diff, does nothing else
  2. Second call (confirmed: true) → actually applies or destroys

Claude is instructed to never pass confirmed: true without first presenting the plan to you.

Prompt

The server exposes a /tf-diagnose prompt that guides Claude through a systematic 5-step diagnosis of plan or apply failures.

Prerequisites

  • Node.js 18 or later
  • Terraform CLI on your PATH
  • Claude Desktop (or any MCP-compatible client)

Installation

No install needed — run it straight from npm:

npx @rajsir/mcp-server-terraform

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Terraform: common questions

Is Terraform MCP server safe?
Yes, by our scan: it is graded A (88/100). Read the Terraform safety report
How do I install Terraform?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Terraform need an API key?
No secret keys are declared. It reads 3 settings from the environment.
Is Terraform maintained?
The last commit was 118 days ago (2026-07-07). The latest release is v0.2.1.
What can I use instead of Terraform?
Servers from other publishers that do the same job: nable MCP server, TerraVision MCP server and cloud-audit MCP server.
How does Terraform compare with other Developer tools MCP servers?
safety score 88/100 (higher than 75% of 1,119 Developer tools servers); tools 11 (the typical Developer tools server has 7); tools that change things 18% (typical: 5%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Terraform

Same job from other publishers: the closest match first, then the best rated.

  • nable
    Local-first FinOps copilot: ask AWS, Azure, GCP, Kubernetes and SaaS cost questions in your editor.
    A
  • TerraVision
    Draw cloud architecture diagrams with official AWS, Azure and GCP icons from a prompt or Terraform.
    A
  • cloud-audit
    AWS security scanner with attack chain detection, IAM privilege escalation, and fixes
    A
  • Cloud FinOps Skill & MCP
    Cloud cost + FinOps knowledge for AI agents: AWS/Azure/GCP optimisation, AI spend, waste playbooks.
    A
  • Grasp — Code Architecture & Dependency Analysis
    Codebase analysis: dependency graphs, security scanning, and refactor plans for GitHub and GitLab.
    C