What it is
The Terraform MCP Server connects agents to the public Terraform Registry, so they can look up current provider docs, modules and policies while writing infrastructure code. With an HCP Terraform or Terraform Enterprise token it also manages organisations, projects, teams, workspaces, variables, tags, runs and state versions. HashiCorp's reference lists 61 tools: 9 for the public Registry, 4 for private registries and 48 for HCP Terraform.
It usually runs as a Docker image (docker run -i --rm hashicorp/terraform-mcp-server) over stdio, or as a Go binary. A Streamable HTTP mode serves shared deployments, with a Helm chart, TLS, rate limits, strict CORS, an organisation allowlist and per-user token passthrough. The latest release is 1.3.0, from 26 August 2026, under MPL-2.0.
Install
docker run -i --rm hashicorp/terraform-mcp-serverOur review
The most common failure when a model writes Terraform is using old or invented resource arguments. Live Registry lookups through nine tools such as search_providers and get_provider_details fix much of that, and this part needs no token and no HashiCorp account.
The HCP Terraform side needs more thought than the README implies. ENABLE_TF_OPERATIONS gates only five destructive tools (action_run, delete_workspace_safely, force_unlock_workspace, delete_project and delete_team) plus the auto_approve and is_destroy options on create_run. create_run itself, update_workspace, which the docs call potentially destructive, variable writes and grant_team_access stay available to any agent holding a token. The --tools flag, which takes an explicit allowlist, is the real control; the token's own permissions are the second.
Data exposure is plain from the tool list. get_plan_json_output, get_plan_logs and get_state_version can carry resource attributes and sensitive values into the model's context, and HashiCorp's README tells you not to use the server with untrusted clients or models. The HTTP mode is hardened sensibly: clients cannot override TFE_ADDRESS, which stops a request redirecting your token to another host, tokens in query strings are rejected, and an earlier X-Forwarded-For handling that trusted spoofable values has been replaced with an explicit trusted-hops setting.
Context is the quieter cost. Without a --toolsets flag the server enables every toolset, and once a token is present all 61 tool definitions load into each session. Teams that only want documentation lookups can run --toolsets=default and keep the nine Registry tools, which is also the safest configuration HashiCorp offers.
Where it earns its place
A platform engineer writing AWS modules in Claude Code
Stop the agent inventing resource arguments that fail at plan time
Run the container with --toolsets=default; the agent checks provider docs and the latest provider version before writing HCL. No token, no account, and nine tool definitions instead of 61.
An SRE on HCP Terraform
Explain why last night's run failed without opening the console
With a read-scoped token and --tools limited to list_runs, get_run_details and get_plan_logs, the agent reads the failure and proposes a fix. HCP Terraform's API allows 30 requests per second per user, which an agent loop rarely reaches.
A platform team at a 300-engineer company on Terraform Enterprise
Offer one shared MCP endpoint while keeping each engineer's permissions
Deploy HTTP mode from the Helm chart with TLS, MCP_ALLOWED_ORIGINS and an organisation allowlist; each user sends their own token, so Terraform Enterprise RBAC still applies, and OpenTelemetry metrics show tool-call volume and errors.
Before you commit
- Setup
- claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server, adding TFE_TOKEN and TFE_ADDRESS for HCP features. HashiCorp documents VS Code, Cursor, Claude Desktop, Claude Code, Codex CLI, Amazon Q, Kiro, Gemini extensions and IBM Bob.
- Integrations
- 61 tools: 9 public Registry, 4 private registry and 48 HCP Terraform tools covering projects, teams, workspaces, runs, plans, applies, state versions, policy sets, variable sets, tags and Stacks (read-only). Toolsets or individual tools can be enabled by flag.
- Data and privacy
- Runs locally or on your own host; nothing passes through HashiCorp beyond normal Registry and HCP API calls. The token's permissions bound what the agent can do, and plan and state output can expose sensitive values to the model.
- Cost at scale
- The server is free under MPL-2.0; HCP Terraform or Terraform Enterprise is billed under your HashiCorp plan, not covered here. HCP's API allows 30 requests per second per user regardless of token count, and the HTTP mode adds its own defaults of 10 per second globally (burst 20) and 5 per session (burst 10).
- Limits
- The reference does not label tools as read or write; create_workspace and update_workspace are flagged destructive yet not gated; TLS certificates are required for any non-localhost HTTP deployment.
What's good
- Live provider, module and policy docs with no token
- Fine-grained --tools allowlist
- Hardened HTTP mode with per-user tokens and org allowlist
- Most destructive operations off by default
What's not
- Runs, workspace updates and variable writes are not gated
- Plan and state tools can put secrets in model context
- 61 tool definitions load by default with a token
- Docker or Go needed; corporate TLS inspection needs a CA mount
Best for
Teams writing Terraform with AI help, especially those on HCP Terraform or Terraform Enterprise who will configure a tool allowlist.
Alternatives
Terraform MCP Server: common questions
- Is Terraform MCP Server worth it?
- Registry lookups alone justify installing it; hand it an HCP Terraform token only after deciding which of its 48 workspace tools an agent should hold. We rate it 4.2 out of 5.
- How much does Terraform MCP Server cost?
- Free under MPL-2.0. HCP Terraform features depend on your HashiCorp plan.
- What are the downsides of Terraform MCP Server?
- Runs, workspace updates and variable writes are not gated; plan and state tools can put secrets in model context; 61 tool definitions load by default with a token; docker or Go needed; corporate TLS inspection needs a CA mount.
- Who is Terraform MCP Server best for?
- Teams writing Terraform with AI help, especially those on HCP Terraform or Terraform Enterprise who will configure a tool allowlist.
- How much does Terraform MCP Server cost for a team or in production?
- The server is free under MPL-2.0; HCP Terraform or Terraform Enterprise is billed under your HashiCorp plan, not covered here. HCP's API allows 30 requests per second per user regardless of token count, and the HTTP mode adds its own defaults of 10 per second globally (burst 20) and 5 per session (burst 10).
- Is Terraform MCP Server safe for company data?
- Runs locally or on your own host; nothing passes through HashiCorp beyond normal Registry and HCP API calls. The token's permissions bound what the agent can do, and plan and state output can expose sensitive values to the model.
- What are the best Terraform MCP Server alternatives?
- The closest alternatives we have reviewed are AWS MCP Server and Azure MCP Server.
Answers checked Oct 22, 2026.
Make Terraform MCP Server? Show this rating on your site
