Skip to main content
Glama

tfplan-mcp

Let your AI agent risk-review a Terraform / OpenTofu plan, without ever touching your cloud.

tfplan-mcp is an MCP server that reads the JSON from terraform show -json tfplan (or tofu show -json) and answers the questions you ask before apply: what is being destroyed, what is being replaced and why, did an IAM policy just get broader, is something now open to 0.0.0.0/0, what changed outside Terraform.

What is different about it. Other plan-review MCP servers exist (for example tfmcp, which also runs terraform for you, and tf-review-mcp / cloud-devops-mcp-server, which return findings). This one is built around two things:

  1. It is a plan reader, not a runner. It never executes terraform/tofu, never contacts a provider or cloud, depends only on the mcp package, and can be fenced into one directory with --dir.

  2. Two-layer secret masking. Values Terraform marks sensitive (before_sensitive / after_sensitive) and values whose names look like credentials (password, token, secret, key...) are always printed as (sensitive), even when the plan did not flag them. Findings only ever contain addresses, attribute names and network ranges, never attribute values. It also gives you attribute-level diffs, replace_paths explanations, dependents, and a two-plan comparison, not only a score.

Install

Claude Code:

claude mcp add tfplan -- uvx tfplan-mcp --dir /path/to/your/plans

Claude Desktop (claude_desktop_config.json):

{
  "mcpServers": {
    "tfplan": {
      "command": "uvx",
      "args": ["tfplan-mcp", "--dir", "C:\\Users\\you\\infra\\plans"]
    }
  }
}

Make a plan file first:

terraform plan -out=tfplan
terraform show -json tfplan > plan.json

Related MCP server: blastcheck-mcp

Tools

Tool

What it does

plan_summary

Counts of create/update/delete/replace/read/forget/no-op by resource type and module; empty or destroy plan; moved/imported; drift; output changes; failing checks; terraform version; warnings (errored, incomplete, deferred).

risky_changes

Ranked findings with reasons: destroy/replace of databases, buckets, disks, KMS keys, DNS zones; which attribute forced a replacement; IAM * and AdministratorAccess; 0.0.0.0/0 / ::/0 on admin and database ports; public access on; encryption off or key changed; deletion protection off; backup retention cut. Tags-only changes are demoted to low.

diff_resource

Attribute-level before -> after with nested paths, (known after apply), and masked secrets.

list_changes

Filter by action, type glob, module, address glob; capped and paged.

explain_replace

Why it is replaced (action_reason, replace_paths with values), destroy-then-create vs create-before-destroy, lifecycle hint, dependents.

compare_plans

Two plans of the same config: new, removed, different action, different planned values.

outputs_and_drift

Output changes and resource_drift (changed outside Terraform).

Try asking

  • "Summarize plan.json. Is anything being destroyed?"

  • "What are the riskiest changes in plan.json? Rank them."

  • "Why is aws_db_instance.main being replaced, and what depends on it?"

  • "Show me exactly what changes on module.network.aws_security_group.web."

  • "Did anyone change anything outside Terraform? (check drift)"

  • "Compare plan-before.json and plan-after.json: what did my refactor change?"

  • "List every deleted resource under module.legacy."

Limits and behaviour

  • Size: plan files up to 256 MB are accepted by default (--max-mb N changes it). Bigger files are refused with a clear message. The file is read once and parsed in one pass; expect roughly 5-10x the file size in RAM. The last two parsed plans are cached.

  • Input checks: a state file (terraform show -json of a state), a raw .tfstate, a binary tfplan, or the streaming log of terraform plan -json each get a specific explanation of what to run instead. NaN/Infinity are rejected; integers over 1000 digits are shown as "(huge integer)"; absurd nesting is a clean error.

  • Understands: format_version 1.x (Terraform 1.5 to 1.9, OpenTofu), count/for_each addresses with quotes, brackets and unicode, nested modules, moved/import/forget (no-op with previous_address / importing), deferred_changes, errored, empty plans.

  • Heuristics are heuristics. The risk table covers common aws/azurerm/google/kubernetes types plus generic name patterns. It will miss things and over-flag a few. Read the diff for anything that matters.

  • The plan JSON does not record lifecycle settings, so create_before_destroy is inferred from the action order.

Security

  • Read-only. No terraform/tofu execution, no network, no provider calls, nothing is written.

  • Sandbox. Only files under --dir (default: the working directory) can be read. Paths are resolved with symlinks followed, and anything outside is refused.

  • Secrets. Terraform's own sensitivity masks and a name heuristic are both applied before any value is shown; connection-string passwords, private key blocks, cloud access key ids and JWTs are scrubbed from displayed strings. The plan's top-level variables and generated_config are never printed. Heuristics can over-mask (a secret_id is masked) which is the safe side; a secret stored under an innocuous name inside a larger string (for example inside a JSON policy document) is shown as part of that string, so treat plan output like the plan file.

  • A plan contains real infrastructure details. Anything an agent reads goes to your model provider: only point it at plans you are willing to share with it.

Development

uv sync --extra test
uv run pytest tests
uv run ruff check src tests
uv run mypy --strict src

The fixtures in tests/fixtures/plans are generated by tests/fixtures/make_plans.py (hand-shaped Terraform 1.5-1.9 plans). An optional test that makes a real plan with a local binary (terraform_data only, no provider download) runs with TFPLAN_REAL_TERRAFORM=1.

Want to build it yourself? See tfplan-mcp-the-hard-way.

MIT licensed.

Available Tools

7 tools
compare_plansB

Compare two plans of the same configuration (for example before and after a code change, or two environments): resource changes new in B, gone in B, with a different action, or the same action but different planned values (shown as masked attribute diffs).

NameRequiredDescriptionDefault
limitNo
path_aYes
path_bYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. It does state the core precondition ('same configuration') and enumerates the diff categories returned (new in B, gone in B, changed action, changed planned values with masked diffs), but it never says the operation is read-only, what happens if the plans are incompatible or unparsable, or whether results are paginated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is a single well-formed sentence with the primary action front-loaded and the illustrative cases kept in a parenthetical. It is dense without being padded; only the masked-diff detail feels like it could be trimmed since an output schema already exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return-shape discussion is a bonus rather than a requirement, and the description is complete on intent. It is still thin for a tool with zero schema documentation: the meaning of path_a/path_b, the format of inputs, and the effect of limit on results are all left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% — parameters are bare titles like 'Path A' — so the description must compensate. It partially does by establishing that the two paths are plans and that diff semantics are B-relative ('new in B, gone in B'), which gives directionality the schema does not. However, it never clarifies what a 'path' actually is (file, directory, plan artifact) and the 'limit' parameter is not mentioned at all, so the compensation is incomplete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Compare two plans') and scopes it to plans of the same configuration, with concrete illustrative cases (pre/post code change, two environments). It is not explicitly differentiated from the sibling diff_resource, which sounds close in function, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical examples ('before and after a code change, or two environments') imply when the tool is appropriate, which is more than nothing. However, there is no explicit statement of when not to use it and no pointer to plan_summary, diff_resource, or list_changes as alternatives, leaving the agent to infer tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diff_resourceA

Attribute-level diff (before -> after) for one resource, with nested paths such as ingress[0].cidr_blocks[0]. Unknown values show as (known after apply). Sensitive values are ALWAYS shown as (sensitive): by Terraform's sensitivity masks and, as a second layer, by attribute names that look like credentials (password, secret, token, key...).

address: exact address as in the plan, e.g. aws_instance.web["a b"] or module.net.aws_vpc.main[0]. Use list_changes to find addresses; unknown addresses return close matches.

NameRequiredDescriptionDefault
pathYes
addressYes
max_attributesNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the (known after apply) placeholder for unknown values, the two-layer sensitivity masking including the credential-name heuristic, and the fuzzy-match fallback for bad addresses. It stops short of stating that the operation is read-only or how output is truncated, which are the remaining behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, then behavior, then the address format guidance. Every sentence carries information, though the sensitivity sentence is dense and the address paragraph could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the diff semantics are well covered. However, for a 3-parameter tool with zero schema coverage, leaving the required 'path' parameter and the 'max_attributes' cap undocumented is a meaningful completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does so thoroughly for 'address' (exact plan address, with quoted-index and module examples), but 'path' — a required parameter — is never explained, and 'max_attributes' (default 200) is not mentioned at all, leaving truncation behavior undefined.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Attribute-level diff (before -> after) for one resource') plus the scope of nested paths, which immediately separates it from plan_summary and risky_changes. An agent can tell this is the per-resource drill-down tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent to list_changes for discovering addresses and states what happens with an unknown address (close matches returned). It does not say when to prefer risky_changes or explain_replace over this tool, so the alternative-selection guidance is partial rather than complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

explain_replaceB

Explain why a resource is being replaced: the action_reason, the forcing attribute(s) from replace_paths with their before -> after values, the order (destroy-then-create vs create_before_destroy), what that means (downtime, name collisions), the lifecycle hint from the plan's configuration when present, and the dependents that reference it.

NameRequiredDescriptionDefault
pathYes
addressYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden, and it does disclose substantive interpretation behavior: it distinguishes destroy-then-create from create_before_destroy and explains the consequences (downtime, name collisions), plus notes that the lifecycle hint is only present "when present." However, it omits that this is a read-only analysis operation and says nothing about behavior when the resource is not actually being replaced (error vs. empty result).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence beginning with the verb and resource, followed by a comma-separated enumeration of what is returned. Dense but purposeful; no filler sentences, though the long list is slightly harder to scan than a short structured form.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The return content is well covered (and an output schema also exists, lowering that burden), but for a tool that requires two entirely undocumented required parameters and has no annotations, the definition leaves key calling prerequisites unexplained. An agent knows what it will learn, not how to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for both required parameters, and the description does not compensate: "path" is never clarified as a plan file/directory location, and "address" format (resource address syntax) is left entirely implicit. The mention of "replace_paths" refers to output content, not the input parameter, so it may even mislead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: "Explain why a resource is being replaced," and enumerates the exact contents of the explanation (action_reason, forcing attributes, ordering semantics, dependents). The scope is unmistakable without opening the schema, though it never contrasts itself with overlapping siblings such as diff_resource or risky_changes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description says what the tool explains but never states when to call it versus alternatives like diff_resource, risky_changes, or plan_summary, nor any prerequisite such as needing an existing plan. Usage is only inferable from the title phrasing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_changesB

List resource changes, filtered and capped.

action: create | update | delete | replace | read | forget | no-op | import | move | other (default: everything except plain no-ops). type: glob such as aws_s3_*. module: 'root' or a module address prefix such as module.network (includes nested modules). address: glob where only * and ? are wild (brackets in addresses are literal).

NameRequiredDescriptionDefault
pathYes
typeNo
limitNo
actionNo
moduleNo
offsetNo
addressNo

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses that action defaults to everything except plain no-ops, that module includes nested modules, that address globs treat brackets literally, and that results are capped. However, it does not explicitly state read-only/non-destructive behavior, permission requirements, or pagination behavior beyond 'capped'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and then compactly lists filter semantics with no filler. Each line adds useful information, and the structure is easy for an agent to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema exists, so return values need not be explained. Still, for a seven-parameter tool with no annotations and no schema descriptions, the definition leaves important gaps around the required path argument, limit/offset usage, and sibling differentiation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for seven parameters. It meaningfully explains action, type, module, and address semantics, including defaults and glob rules, but it leaves the required path parameter and the limit/offset pagination parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List resource changes', and adds the scope 'filtered and capped'. It is clear what the tool does, but it does not distinguish it from siblings such as risky_changes or plan_summary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit when-to-use guidance and does not name alternatives among the sibling tools. It documents filters and default behavior, but an agent must infer when this listing tool is preferable to plan_summary, risky_changes, or diff_resource.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

outputs_and_driftB

Output changes and resource_drift: what changed OUTSIDE Terraform (console edits, other tools) since the last apply, with masked attribute diffs. Sensitive outputs are masked.

NameRequiredDescriptionDefault
pathYes
limitNo

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningful behavior: sensitive output values are masked and attribute diffs are also masked. It does not state that this is a read-only operation, whether it reads local state vs remote backend (implying auth needs), or how the 'limit' parameter paginates results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the key scope ('OUTSIDE Terraform ... since the last apply') front-loaded. Minor waste from restating masking twice ('masked attribute diffs' then 'Sensitive outputs are masked'), but nothing is bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A return-value explanation is unnecessary because an output schema exists, and the drift concept is conveyed. Still, for an unannotated two-parameter tool the description leaves the semantics of both inputs and the read/auth profile unaddressed, which is a real gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so both parameters are undocumented in the schema, and the description adds nothing about them. It never explains what 'path' points to (working directory? state file?) or what 'limit' caps (outputs, drift entries, or both).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource pair: it reports output changes and resource drift, and clarifies drift as changes made OUTSIDE Terraform since the last apply. That out-of-band framing distinguishes it conceptually from plan-based siblings like plan_summary and compare_plans, though the compound 'outputs + drift' scope is not fully disentangled.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'since the last apply' implies the tool is for detecting out-of-band drift rather than diffing two plans, which is an implicit routing hint versus list_changes or diff_resource. However, no explicit when-to-use, when-not-to-use, or named alternative is given, so the agent must infer the selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plan_summaryA

Overview of a plan: counts of create/update/delete/replace/read/forget/no-op by resource type and module, whether it is an empty or destroy plan, moved/imported resources, drift, output changes, failing checks, terraform version and warnings (errored, incomplete, deferred changes). Call this first.

path: plan JSON from terraform show -json tfplan (relative to the server's --dir). Files over the size limit (256 MB default, --max-mb) are refused with a clear error.

NameRequiredDescriptionDefault
pathYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does add real operational context: the input must be JSON from `terraform show -json`, the path is resolved relative to the server's --dir, and oversized files (256 MB default, configurable via --max-mb) are refused with a clear error. It does not state that the tool is read-only or non-destructive, which is implied only by "Overview".

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose and content list are front-loaded, and the imperative "Call this first" is well placed immediately after. The long comma-separated enumeration of returned fields is dense but reflects genuine scope; the separate path paragraph cleanly isolates the input constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so the return shape need not be explained, yet the description still summarizes what the agent will get, and it covers the one input's provenance and failure mode. For a single-parameter read tool this is nearly complete; only the read-only guarantee and behavior on malformed plan JSON are unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% for the single parameter, so the description must compensate, and it does: it specifies the exact expected artifact (`terraform show -json tfplan`), the path resolution base (server's --dir), and the size constraint that can cause rejection. It stops short of noting path format details such as absolute vs relative handling beyond the --dir note.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (a Terraform plan) and enumerates exactly what the overview contains: action counts by resource type and module, empty/destroy status, moved/imported resources, drift, output changes, failing checks, version and warnings. That enumeration distinguishes it from detail-oriented siblings such as diff_resource, explain_replace and risky_changes, which an agent can rule out once it knows this is the aggregate view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Call this first" gives explicit ordering guidance, which is meaningful among six plan-analysis siblings. It does not name a specific alternative or state a when-not condition (e.g. use risky_changes when you only care about destructive actions), so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

risky_changesA

Ranked list of risky changes with reasons. Flags: destroy/replace of stateful resources (databases, buckets, disks, KMS keys, DNS zones, secrets; aws/azurerm/google/kubernetes plus generic name heuristics), which attribute forces a replacement, IAM wildcards and admin policies, security groups / firewalls opening 0.0.0.0/0 or ::/0 (admin and database ports rated highest), public access enabled, encryption disabled or key changed, deletion protection off, backup retention reduced. Tags-only updates are listed as low.

min_severity: info | low | medium | high | critical. Only the findings are listed; resources not mentioned had nothing notable. Values of attributes are never printed here.

NameRequiredDescriptionDefault
pathYes
limitNo
min_severityNolow

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does substantial work: it discloses that output is ranked, that it is findings-only ("resources not mentioned had nothing notable"), and critically that attribute values are never printed, which tells the agent to fetch details elsewhere rather than expect values here. It omits pagination/limit behavior and does not state whether this is a static analysis of a plan file, so it falls short of full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is front-loaded with the core claim and then spends its length on a dense but purposeful flag taxonomy where each item adds a distinct risk category. It is somewhat run-on in the parenthetical enumerations, but no sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers the behavioral and severity side well. The remaining gap is the input contract: for a required `path` argument with zero schema documentation, the description should state what kind of artifact to point at, and the limit/truncation semantics of the ranked list are unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It fully specifies min_severity with its five enum values (info|low|medium|high|critical), which the schema does not, but it says nothing about the required `path` parameter (plan file? directory? plan JSON?) or about what `limit` bounds, leaving two of three parameters, including the required one, to guesswork.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence gives a concrete verb+resource ("Ranked list of risky changes with reasons") and the following enumeration makes precise what counts as a risky change, so an agent knows exactly what this returns. It never names siblings like list_changes or plan_summary, so the boundary between this risk-scoped view and a plain change list is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the content: the flag taxonomy makes clear this is the tool for security/destructive-change triage, and the min_severity levels signal how to widen or narrow scope. However, there is no explicit when-to-use statement, no when-not-to-use, and no routing to alternatives such as list_changes for a full inventory or diff_resource for a single resource.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv0.1.0
    • First observedcompare_plans
    • First observeddiff_resource
    • First observedexplain_replace
    • First observedlist_changes
    • First observedoutputs_and_drift
    • First observedplan_summary
    • First observedrisky_changes

TDQS

A3.5/5.0

Scored across 7 tools

Disambiguation4/5

Each tool targets a distinct facet of plan analysis: overview, risk ranking, single-resource diff, filtered listing, replacement explanation, plan-to-plan comparison, and outputs/drift. The main potential confusion is between list_changes, compare_plans, and plan_summary, since all surface resource changes, but the descriptions draw clear boundaries (filter/cap vs two-plan comparison vs counts).

Naming Consistency3/5

Most names are verb_noun (diff_resource, list_changes, explain_replace, compare_plans), but plan_summary, risky_changes, and outputs_and_drift are noun-first, mixing conventions. Names remain readable and descriptive despite the inconsistency.

Tool Count5/5

Seven tools is well-scoped for a Terraform plan analysis server, with each tool covering a clearly separate analytical need. Nothing feels redundant or missing at the count level.

Completeness4/5

The surface covers the plan lifecycle well: summary, change listing, attribute diffs, replacement reasoning, risk assessment, plan comparison, and outputs/drift. Minor gaps exist, such as no way to dump a full resource's planned configuration beyond a diff or to query state/configuration outside the plan.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables state-aware Terraform/OpenTofu plan evaluation against live AWS topology and CloudWatch telemetry, detecting reliability blast radius and FinOps waste before merge.
    Apache 2.0
  • A
    license
    A
    quality
    A
    maintenance
    Enables AI coding agents to compute a 0-1 diff risk score for the current branch or any pull request, exposing the driving signals, evidence, tier and resulting auto-approve or human-review policy decision. Agents can use it to decide whether a low-blast-radius, AI-reviewed PR is safe to merge automatically while flagging risky changes for a human.
    6
    202 npm
    2
    MIT