Terraform MCP Server

The Terraform MCP Server is a Model Context Protocol (MCP) server that integrates seamlessly with Terraform Registry and HCP Terraform APIs, enabling advanced automation and interaction capabilities for Infrastructure as Code (IaC) development.

Table of Contents

Get started Client integrations Build and run

Features Prerequisites Command Line Options Instructions

Installation Visual Studio Code Cursor Claude Desktop, Amazon Q Developer, and Kiro CLI Claude Code Codex CLI Gemini extensions Bob IDE and Shell

Install from source Building the Docker Image locally Transport Support Stdio Transport StreamableHTTP Transport

Server capabilities Deployment and security Help and contributing

Available Tools Available Resources Available Metrics Tool Filtering

Session Modes Token Passthrough for Centralized Deployments Client IP Forwarding Trust model Trusted hops Limitations Migrating from earlier versions Supported Headers Security Considerations Centralized Deployment Example

Troubleshooting Corporate Proxy and TLS Inspection Development Contributing License Security Support

Features

• Dual Transport Support: Both Stdio and StreamableHTTP transports with configurable endpoints
• Terraform Registry Integration: Direct integration with public Terraform Registry APIs for providers, modules, and policies
• HCP Terraform & Terraform Enterprise Support: Full workspace management, organization/project listing, and private registry access
• Workspace Operations: Create, update, delete workspaces with support for variables, tags, and run management
• OTel metrics for monitoring tool usage: Integration with open telemetry meters to track tool-call volume, latency and failures in Streamable HTTP mode. Also exposes default http server metrics when this feature is enabled

Security Note: Depending on the query, the MCP server may expose certain Terraform data to the MCP client and LLM. Do not use the MCP server with untrusted MCP clients or LLMs.

Legal Note: Your use of a third party MCP Client/LLM is subject solely to the terms of use for such MCP/LLM, and IBM is not responsible for the performance of such third party tools. IBM expressly disclaims any and all warranties and liability for third party MCP Clients/LLMs, and may not be able to provide support to resolve issues which are caused by the third party tools.

Caution: The outputs and recommendations provided by the MCP server are generated dynamically and may vary based on the query, model, and the connected MCP client. Users should thoroughly review all outputs/recommendations to ensure they align with their organization’s security best practices, cost-efficiency goals, and compliance requirements before implementation.

Prerequisites

1. Ensure Docker is installed and running to use the server in a containerized environment.
2. Install an AI assistant that supports the Model Context Protocol (MCP).

Command Line Options

Environment Variables:

Variable	Description	Default
TFE_ADDRESS	Sets the Terraform Enterprise/HCP Terraform address for API calls. Must include the protocol (e.g., https://app.terraform.io). In streamable-http mode this is the only way to set the address; it cannot be supplied by clients via header or query parameter.	Optional
TFE_TOKEN	Terraform Enterprise API token	"" (empty)
TF_MCP_SHARED_SECRET	Shared secret sent as the X-Tf-Mcp-Secret header on requests to HCP Terraform / TFE, used to identify requests originating from a hosted MCP deployment. Should only be used over TLS.	"" (empty)
TFE_SKIP_TLS_VERIFY	Skip HCP Terraform or Terraform Enterprise TLS verification	false
LOG_LEVEL	Logging level: trace, debug, info, warn, error, fatal, panic (overrides --log-level flag)	info
LOG_FORMAT	Logging format: text or json (overrides --log-format flag)	text
TRANSPORT_MODE	Set to streamable-http to enable HTTP transport (legacy http value still supported)	stdio
TRANSPORT_HOST	Host to bind the HTTP server	127.0.0.1
TRANSPORT_PORT	HTTP server port	8080
MCP_ENDPOINT	HTTP server endpoint path	/mcp
MCP_REDIRECT_ROOT_URL	URL to redirect requests to / to	""
MCP_KEEP_ALIVE	Keep-alive interval for SSE connections (e.g., 30s, 1m). 0 to disable	0
MCP_SESSION_MODE	Session mode: stateful or stateless	stateful
MCP_ALLOWED_ORIGINS	Comma-separated list of allowed origins for CORS	"" (empty)
MCP_CORS_MODE	CORS mode: strict, development, or disabled	strict
MCP_TLS_CERT_FILE	Path to TLS cert file, required for non-localhost deployment (e.g. /path/to/cert.pem)	"" (empty)
MCP_TLS_KEY_FILE	Path to TLS key file, required for non-localhost deployment (e.g. /path/to/key.pem)	"" (empty)
MCP_RATE_LIMIT_GLOBAL	Global rate limit (format: rps:burst)	10:20
MCP_RATE_LIMIT_SESSION	Per-session rate limit (format: rps:burst)	5:10
MCP_ORGANIZATION_ALLOWLIST	CSV list of HCP Terraform organization names allowed to access the HTTP server	"" (empty)
MCP_FORWARD_CLIENT_IP	Forward the client IP to HCP Terraform / TFE via X-Forwarded-For. Set to true to enable	false
MCP_REMOTE_IP_METHOD	How the client IP is sourced when forwarding is enabled: RemoteAddr (direct connection only), X-Real-IP, or X-Forwarded-For	RemoteAddr
MCP_XFF_TRUSTED_HOPS	Number of trusted proxy hops counted from the right of the X-Forwarded-For chain. Only used when MCP_REMOTE_IP_METHOD=X-Forwarded-For	0
ENABLE_TF_OPERATIONS	Enable tools that