HashiCorp MCP server for Terraform Registry data, providers, modules and HCP Terraform workflows.
The Terraform MCP Server is a Model Context Protocol (MCP)
server that integrates seamlessly with Terraform Registry and HCP Terraform APIs, enabling advanced
automation and interaction capabilities for Infrastructure as Code (IaC) development.
Security Note: Depending on the query, the MCP server may expose certain Terraform data to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.
Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.
Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.
Environment Variables:
| Variable | Description | Default |
|---|---|---|
TFE_ADDRESS | Sets the Terraform Enterprise/HCP Terraform address for API calls. Must include the protocol (e.g., https://app.terraform.io). In streamable-http mode this is the only way to set the address; it cannot be supplied by clients via header or query parameter. | Optional |
TFE_TOKEN | Terraform Enterprise API token | "" (empty) |
TF_MCP_QUERY_WORKSPACE | Proposed source workspace used by Search/query tools unless the user supplies an explicit workspace override. The agent confirms the resolved source before the query workflow. Independent of the import destination. | Unset; falls back to TF_WORKSPACE |
TF_MCP_IMPORT_WORKSPACE | Proposed import destination used by import tools unless the user supplies an explicit target override. The agent must always present and confirm the target before calling an import tool. Separate from the query workspace. | Unset; falls back to TF_WORKSPACE |
TF_WORKSPACE | Fallback source-workspace default when TF_MCP_QUERY_WORKSPACE is unset and fallback import-target default when TF_MCP_IMPORT_WORKSPACE is unset. Neither use replaces agent confirmation. | Unset |
TF_CLOUD_ORGANIZATION | Proposed Search source organization used when no explicit organization override is supplied. The agent confirms the resolved source before the query workflow. | Unset |
TF_MCP_SHARED_SECRET | Shared secret sent as the X-Tf-Mcp-Secret header on requests to HCP Terraform / TFE, used to identify requests originating from a hosted MCP deployment. Should only be used over TLS. | "" (empty) |
TFE_SKIP_TLS_VERIFY | Skip HCP Terraform or Terraform Enterprise TLS verification | false |
LOG_LEVEL | Logging level: trace, debug, info, warn, error, fatal, panic (overrides --log-level flag) | info |
LOG_FORMAT | Logging format: text or json (overrides --log-format flag) | text |
TRANSPORT_MODE | Set to streamable-http to enable HTTP transport (legacy http value still supported) | stdio |
TRANSPORT_HOST | Host to bind the HTTP server | 127.0.0.1 |
TRANSPORT_PORT | HTTP server port | 8080 |
MCP_ENDPOINT | HTTP server endpoint path | /mcp |
MCP_REDIRECT_ROOT_URL | URL to redirect requests to / to | "" |
MCP_KEEP_ALIVE | Keep-alive interval for SSE connections (e.g., 30s, 1m). 0 to disable | 0 |
MCP_SESSION_MODE | Session mode: stateful or stateless | stateful |
MCP_ALLOWED_ORIGINS | Comma-separated list of allowed origins for CORS | "" (empty) |
MCP_CORS_MODE | CORS mode: strict, development, or disabled | strict |
MCP_TLS_CERT_FILE | Path to TLS cert file, required for non-localhost deployment (e.g. /path/to/cert.pem) | "" (empty) |
MCP_TLS_KEY_FILE | Path to TLS key file, required for non-localhost deployment (e.g. /path/to/key.pem) | "" (empty) |
MCP_RATE_LIMIT_GLOBAL | Global rate limit (format: rps:burst) | 10:20 |
MCP_RATE_LIMIT_SESSION | Per-session rate limit (format: rps:burst) | 5:10 |
MCP_ORGANIZATION_ALLOWLIST | CSV list of HCP Terraform organization names allowed to access the HTTP server | "" (empty) |
MCP_FORWARD_CLIENT_IP | Forward the client IP to HCP Terraform / TFE via X-Forwarded-For. Set to true to enable | false |
MCP_REMOTE_IP_METHOD | How the client IP is sourced when forwarding is enabled: RemoteAddr (direct connection only), X-Real-IP, or X-Forwarded-For | RemoteAddr |
MCP_XFF_TRUSTED_HOPS | Number of trusted proxy hops counted from the right of the X-Forwarded-For chain. Only used when MCP_REMOTE_IP_METHOD=X-Forwarded-For | 0 |
MCP_PPROF_ADDR | Address to serve Go pprof profiling endpoints on, like 127.0.0.1:6060. Off when unset. See Profiling | "" (empty) |
ENABLE_TF_OPERATIONS | Enable tools that require explicit approval | false |
OTEL_METRICS_ENABLED | Enable tools and server metrics using otel | false |
OTEL_METRICS_SERVICE_VERSION | Version of the terraform-mcp-server sending metrics, which is used to set metric attributes. It also helps track metrics across different deployments | latest |
OTEL_METRICS_SERVICE_NAME | Identifies the source of the metrics (e.g., "terraform-mcp-server") | terraform-mcp-server |
OTEL_METRICS_EXPORT_INTERVAL | Controls the frequency of metric flushes | 2 |
OTEL_METRICS_ENDPOINT | URL of your OTel Collector or backend | localhost:4318 |
INSTANA_ENABLED | Enable Instana instrumentation (metrics and HTTP request tracing) for the streamable-http server. Requires an Instana agent that is reachable by the server. | false |
INSTANA_SERVICE_NAME | If Instana instrumentation is enabled, the service name to use for the MCP server | terraform-mcp-server |
## Stdio mode
terraform-mcp-server stdio [--log-file /path/to/log] [--log-level info] [--log-format text] [--toolsets <toolsets>] [--tools <tools>]
## StreamableHTTP mode
terraform-mcp-server streamable-http [--transport-port 8080] [--transport-host 127.0.0.1] [--mcp-endpoint /mcp] [--organization-allowlist <orgs-csv>] [--log-file /path/to/log] [--log-level info] [--log-format text] [--toolsets <toolsets>] [--tools <tools>]
Default instructions for the MCP server is located in cmd/terraform-mcp-server/instructions.md, if those do not seem appropriate for your organization's Terraform practices or if the MCP server is producing inaccurate responses, please replace them with your own instructions and rebuild the container or binary. An example of such instruction is located in instructions/example-mcp-instructions.md
AGENTS.md essentially behaves as READMEs for coding agents: a dedicated, predictable place to provide the context and instructions to help AI coding agents work on your project. One AGENTS.md file works with different coding agents. An example of such instruction is located in instructions/example-AGENTS.md, in order to use it commit a file name AGENTS.md to the directory where your Terraform configurations reside.
Add the following JSON block to your User Settings (JSON) file in VS Code. You can do this by pressing Ctrl + Shift + P and typing Preferences: Open User Settings (JSON).
More about using MCP server tools in VS Code's agent mode documentation.
| Local | Remote |
|---|---|
|
|
Optionally, you can add a similar example (i.e. without the mcp key) to a file called .vscode/mcp.json in your workspace. This will allow you to share the configuration with others.
| Local | Remote |
|---|---|
|
|
Add this to your Cursor config (~/.cursor/mcp.json) or via Settings → Cursor Settings → MCP:
| Local | Remote |
|---|---|
|
|
More about using MCP server tools in Claude Desktop user documentation. Read more about using MCP server in Amazon Q Developer and Kiro CLI.
| Local | Remote |
|---|---|
|
|
NOTE: Claude Desktop does not support configuring remote MCP servers via configuration file, use Custom Connectors instead.
More about using and adding MCP server tools in Claude Code user documentation
| Local | Remote |
|---|---|
|
|
More about using and adding MCP server tools in Codex CLI user documentation.
Note: Add
TFE_ADDRESSandTFE_TOKENto the Docker commands for authenticated HCP Terraform or Terraform Enterprise tools.
| Local | Remote |
|---|---|
|
|
For security, avoid hardcoding your credentials, create or update ~/.gemini/.env (where ~ is your home or project directory) for storing HCP Terraform or Terraform Enterprise credentials
## ~/.gemini/.env
TFE_ADDRESS=your_tfe_address_here
TFE_TOKEN=your_tfe_token_here
Install the extension & run Gemini
gemini extensions install https://github.com/hashicorp/terraform-mcp-server
gemini
More about using and adding MCP servers tools in Bob IDE or Shell Using MCP in Bob.
| Local | Remote |
|---|---|
|
|
More about using and adding MCP servers in OpenCode user documentation. Add the server to your project opencode.json or the global ~/.config/opencode/opencode.json.
| Local | Remote |
|---|---|
|
|
A Helm chart for deploying the server on Kubernetes is available under helm/terraform-mcp-server.
Use the latest release version:
go install github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@latest
Use the main branch:
go install github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@main
| Local | Remote |
|---|---|
|
|
Before using the server, you need to build the Docker image locally:
git clone https://github.com/hashicorp/terraform-mcp-server.git
cd terraform-mcp-server
make docker-build
## Run in stdio mode
docker run -i --rm terraform-mcp-server:dev
## Run in streamable-http mode
docker run -p 8080:8080 --rm -e TRANSPORT_MODE=streamable-http -e TRANSPORT_HOST=0.0.0.0 terraform-mcp-server:dev
## Filter tools (optional)
docker run -i --rm terraform-mcp-server:dev --toolsets=registry,terraform
docker run -i --rm terraform-mcp-server:dev --tools=search_provider_docs,get_provider_details
Note: When running in Docker, you should set
TRANSPORT_HOST=0.0.0.0to allow connections from outside the container.
## Test the connection
curl http://localhost:8080/health
{
"mcpServers": {
"terraform": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"terraform-mcp-server:dev"
]
}
}
}
When a tool fails because of an HCP Terraform or TFE API response we can identify, the error text starts with a code and the result's _meta carries the code and HTTP status:
{
"isError": true,
"content": [{ "type": "text", "text": "unauthorized: failed to read run run-123: unauthorized" }],
"_meta": { "error_code": "unauthorized", "http_status": 401 }
}
error_code | http_status | Meaning |
|---|---|---|
unauthorized | 401 | The token is invalid or expired |
not_found | 404 | The resource doesn't exist, or the token can't see it |
conflict | 409 | The workspace is locked, not locked, or can't be safely deleted |
Other failures, like network errors or validation errors from the API, don't get a code.
These are normal tool results, so the HTTP status is still 200. A missing token doesn't get a code since it fails before calling the API. To reject requests without a token with an HTTP 401, set MCP_REQUIRE_TOKEN=true.
Two kinds of metrics are collected.
First, standard HTTP server metrics are added by wrapping the HTTP mux with otelhttp.NewHandler(...). This emits:
Second, the MCP server records custom tool metrics around tool execution using MCP hooks (BeforeCallTool / AfterCallTool). These emit:
Control which tools are available using --toolsets (groups) or --tools (individual):
## Enable tool groups (default: registry)
terraform-mcp-server --toolsets=registry,terraform
## Enable specific tools only
terraform-mcp-server --tools=search_provider_docs,get_provider_details,list_workspaces
Available toolsets: registry, registry-private, terraform, all, default. See pkg/toolsets/mapping.go for individual tool names. Cannot use both flags together.
Search tools resolve a proposed source from explicit arguments first, then server-configured query defaults. Without an override, the source workspace uses TF_MCP_QUERY_WORKSPACE, then TF_WORKSPACE, and the source organization uses TF_CLOUD_ORGANIZATION. Import tools independently resolve a proposed target workspace from an explicit argument, then TF_MCP_IMPORT_WORKSPACE, then TF_WORKSPACE; they never use TF_MCP_QUERY_WORKSPACE as the target default. The target organization uses an explicit argument, then TF_CLOUD_ORGANIZATION, and must still match the QueryRun source organization. Overrides apply independently to each field. If either field was omitted, present and confirm the complete resolved pair before continuing. Empty and whitespace-only values are treated as unset. No TF_MCP_ORGANIZATION variable is used.
On a remote server, these environment variables are server-wide defaults shared by all users of that server. Explicit terraform_org_name and workspace_name arguments override the corresponding defaults for that request; they do not change the server configuration or other users' requests. organization_name is not accepted as a Search tool input alias.
When either scope field is omitted, the Mark3Labs route returns a normal, non-error JSON result with status (input_required), proposed_scope, and missing_inputs before tool-handler client acquisition or scoped API access. The agent presents the complete proposal, obtains confirmation or corrections, and retries with explicit terraform_org_name and workspace_name. The official SDK route requests the same complete pair through CallToolResult.InputRequests. Both routes require explicit scope on the continued call and make no scoped API request while requesting input.
Source confirmation and query execution approval: Before provider discovery for a new query, the agent confirms the resolved source organization and workspace. Before calling execute_search_query, the agent separately summarizes that source and the query selections (provider, resource types, and filters, if any), explains that execution starts a query run without creating or modifying infrastructure, and waits for user approval. If the source or query selections change, approval must be obtained again. This is agent-driven guidance, not a server-enforced approval parameter or status; clients calling the tool directly are not blocked by an approval check.
Pass workspace variables to the MCP server process, for example through the environment settings in OpenCode's JSON/JSONC configuration or an equivalent MCP-client configuration. A container or remote deployment must receive them in its own environment. The server does not read client configuration files or inherit the agent's separate shell environment. When import is requested, the agent always asks for and confirms the target organization, target workspace, and existing local configuration directory. A query default or configured import default never authorizes that target. After confirmation, pass the complete target explicitly to prepare_import and verify_import_plan. The read-only import tools do not upload configuration, create a speculative Run, apply an import, or modify infrastructure.
The Terraform MCP Server supports multiple transport protocols:
Standard input/output communication using JSON-RPC messages. Ideal for local development and direct integration with MCP clients.
Modern HTTP-based transport supporting both direct HTTP requests and Server-Sent Events (SSE) streams. This is the recommended transport for remote/distributed setups.
Features:
http://{hostname}:8080/mcphttp://{hostname}:8080/healthTRANSPORT_MODE=http or TRANSPORT_PORT=8080 to enableMCP_ORGANIZATION_ALLOWLIST or --organization-allowlist to a CSV list of allowed HCP Terraform organization namesThe Terraform MCP Server supports two session modes when using the StreamableHTTP transport:
To enable stateless mode, set the environment variable:
export MCP_SESSION_MODE=stateless
When running the MCP server centrally (StreamableHTTP mode) for multiple users, each user can pass their own Terraform token via HTTP headers for RBAC enforcement. This allows a single server instance to serve multiple users with different permissions.
When MCP_ORGANIZATION_ALLOWLIST or --organization-allowlist is configured, the allowlist must be a CSV list of HCP Terraform organization names. The server requires Authorization: Bearer <token> and rejects requests unless that token can access at least one organization in the CSV allowlist. The bearer token takes precedence if the request also includes a TFE_TOKEN header, ensuring the token validated by the allowlist is the token used for Terraform API requests. Organization name matching is case-insensitive. If the configured CSV value parses to zero organization names, the server exits with a malformed organization allowlist error.
When running the MCP server centrally behind a proxy or load balancer, you can forward the originating client's IP to HCP Terraform / TFE via the X-Forwarded-For header. This is off by default and must be enabled with MCP_FORWARD_CLIENT_IP=true.
When enabled, the server sources the client IP according to MCP_REMOTE_IP_METHOD:
| Method | Behavior |
|---|---|
RemoteAddr (default) | Uses only the address of the direct TCP connection. Ignores X-Forwarded-For and X-Real-IP. |
X-Real-IP | Uses the X-Real-IP header if it is a valid IP, otherwise falls back to RemoteAddr. |
X-Forwarded-For | Uses the X-Forwarded-For header, selecting the entry MCP_XFF_TRUSTED_HOPS positions from the right. Falls back to RemoteAddr if the value is missing or invalid. |
X-Forwarded-For and X-Real-IP are set by clients and intermediary proxies, so they can be spoofed unless a trusted proxy in front of the server overwrites them. For this reason the default is RemoteAddr, which trusts only the peer the server is directly connected to. Only enable X-Real-IP or X-Forwarded-For when the server sits behind a proxy you control that sets these headers. Some load balancers, including AWS Application Load Balancers, do not set X-Real-IP, so with those the header comes straight from the client and should not be used.
When using X-Forwarded-For, set MCP_XFF_TRUSTED_HOPS to the number of proxies you operate in front of the server. Each proxy appends the address it received the request from, not its own address, so the client IP is the entry that many positions from the right. Everything to the left of it was sent by the client and can be spoofed.
For example, behind a single load balancer such as an AWS ALB, set MCP_XFF_TRUSTED_HOPS=1. A header of 198.51.100.7 resolves to 198.51.100.7, and a header of 1.2.3.4, 198.51.100.7, where the client sent 1.2.3.4 itself, also resolves to 198.51.100.7. With MCP_XFF_TRUSTED_HOPS=2 and 1.2.3.4, 198.51.100.7, 10.0.0.5, the server selects 198.51.100.7. If the hop count is greater than the number of entries, or the selected entry is not a valid IP, the server falls back to RemoteAddr.
Setting the hop count too high will trust a client-supplied value; setting it too low will select an address from your own infrastructure. Set it to the exact number of proxies you run.
X-Forwarded-For headers, the server joins them in order before selecting an entry. X-Forwarded-For header.RemoteAddr.Earlier versions used the leftmost X-Forwarded-For value when the header was present, with no configuration. This was insecure, since the leftmost value is the most easily spoofed. The default is now RemoteAddr. If you run the server behind a proxy and rely on X-Forwarded-For being forwarded to HCP Terraform / TFE, set MCP_REMOTE_IP_METHOD=X-Forwarded-For and MCP_XFF_TRUSTED_HOPS to the number of proxies you operate.
| Header | Description |
|---|---|
TFE_TOKEN | Terraform API token |
Authorization: Bearer <token> | Alternative method using standard Bearer auth |
## Using TFE_TOKEN header
curl -X POST http://localhost:8080/mcp \
-H "Content-Type: application/json" \
-H "TFE_TOKEN: your-user-token" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize",...}'
## Using Authorization Bearer header
curl -X POST http://localhost:8080/mcp \
-H "Content-Type: application/json" \
-H "Authorization: Bearer your-user-token" \
-d '{"jsonrpc":"2.0","id":1,"method":"initialize",...}'
In streamable-http mode every request gets its own correlation ID. The server sends it as the X-Request-Id header on its calls to HCP Terraform / TFE and the public registry, returns it to the client in the X-Request-Id response header, and logs it as request_id on tool calls. In stdio mode each tool call gets its own ID. The server always generates the ID itself, so an X-Request-Id sent by the client is ignored.
TFE_ADDRESS environment variable (or the default). Requests that attempt to set TFE_ADDRESS via HTTP header or query parameter are rejected with a 403. This prevents a client from redirecting requests, and the Authorization token, to a malicious server.TF_MCP_SHARED_SECRET sends that value as the X-Tf-Mcp-Secret header on every HCP Terraform / TFE request, letting the backend identify requests from a known hosted deployment (e.g. to apply IP allowlists). It is a static secret sent in a header, so only use it over TLS and treat the value as a credential.MCP_TLS_CERT_FILE/MCP_TLS_KEY_FILE) when deploying centrally to protect tokens in transit.MCP_ALLOWED_ORIGINS to restrict which clients can connect.## Start server centrally (no token set server-side)
docker run -p 8080:8080 \
-e TRANSPORT_MODE=streamable-http \
-e TRANSPORT_HOST=0.0.0.0 \
-e TFE_ADDRESS=https://tfe.company.com \
-e MCP_TLS_CERT_FILE=/certs/server.pem \
-e MCP_TLS_KEY_FILE=/certs/server-key.pem \
-e MCP_ALLOWED_ORIGINS=https://ide.company.com \
-e MCP_ORGANIZATION_ALLOWLIST=team-alpha,team-beta \
-v /path/to/certs:/certs \
hashicorp/terraform-mcp-server:1.4.1
Users then connect with their individual tokens passed via headers, enabling per-user RBAC enforcement.
Set MCP_PPROF_ADDR to serve Go's pprof endpoints on a separate port from the MCP server. It's off by default and works in every transport mode.
MCP_PPROF_ADDR=127.0.0.1:6060 TRANSPORT_MODE=streamable-http terraform-mcp-server
Then grab a profile with go tool pprof:
## 30 second CPU profile
go tool pprof http://127.0.0.1:6060/debug/pprof/profile?seconds=30
## memory in use right now
go tool pprof http://127.0.0.1:6060/debug/pprof/heap
## every goroutine and what it's doing
curl http://127.0.0.1:6060/debug/pprof/goroutine?debug=1
http://127.0.0.1:6060/debug/pprof/ lists everything you can grab. Profiles show the server's internals, so keep it on loopback, the server logs a warning if it's bound to anything else. In Kubernetes, bind it to 127.0.0.1 and use kubectl port-forward pod/<pod> 6060:6060 to get to it.
If you're behind a corporate proxy that performs TLS inspection (like Zscaler Internet Access), you may see certificate errors:
tls: failed to verify certificate: x509: certificate signed by unknown authority
Solution: Mount your corporate CA certificate into the container:
docker run -i --rm \
-v /path/to/corporate-ca.pem:/etc/ssl/certs/corporate-ca.pem \
-e SSL_CERT_FILE=/etc/ssl/certs/corporate-ca.pem \
hashicorp/terraform-mcp-server:1.4.1
For MCP client configurations:
{
"mcpServers": {
"terraform": {
"command": "docker",
"args": [
"run",
"-i",
"--rm",
"-v", "/path/to/corporate-ca.pem:/etc/ssl/certs/corporate-ca.pem",
"-e", "SSL_CERT_FILE=/etc/ssl/certs/corporate-ca.pem",
"-e", "TFE_TOKEN=<>",
"hashicorp/terraform-mcp-server:1.4.1"
]
}
}
}
Alternative: Run the binary directly
If Docker is not permitted in your environment, you can install and run the server binary directly, which will use your system's certificate store:
go install github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@latest
terraform-mcp-server stdio
| Command | Description |
|---|---|
make build | Build the binary |
make test | Run all tests |
make test-e2e | Run end-to-end tests |
make docker-build | Build Docker image |
make run-http | Run HTTP server locally |
make docker-run-http | Run HTTP server in Docker |
make test-http | Test HTTP health endpoint |
make clean | Remove build artifacts |
make help | Show all available commands |
This project is licensed under the terms of the MPL-2.0 open source license. Please refer to LICENSE file for the full terms.
For security issues, please contact security@hashicorp.com or follow our security policy.
For bug reports and feature requests, please open an issue on GitHub.
For general questions and discussions, open a GitHub Discussion.
What is Terraform MCP Server? Terraform MCP Server is a coding tool listed on Scriptiii AI Tools. HashiCorp MCP server for Terraform Registry data, providers, modules and HCP Terraform workflows. Pricing: Free. Free to use. Best for: ai-agents, mcp-server, infrastructure.
Everything you need to know about Terraform MCP Server
Similar tools in Coding
Open-source vector database that stores objects and vectors with hybrid search and filtering.
Coding·Free
Browserbase SDK for browser automation that combines code with natural-language actions.
Coding·Free