mcp-server-terraform
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ALLOWED_TOOLS | No | Comma-separated list of allowed tools, e.g. 'tf_plan,tf_output'. | |
| AUDIT_LOG_PATH | No | File path for audit logging. Every tool call is appended as a JSON line. | |
| ALLOW_ONLY_READONLY_TOOLS | No | If set to 'true', only readonly tools are available (tf_validate, tf_plan, tf_output). | |
| ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS | No | If set to 'true', blocks destructive tools (tf_apply, tf_destroy, tf_state mv/rm). |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
| prompts | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| tf_validateA | Validate Terraform configuration files for syntax and internal consistency. Does not access remote state or APIs. |
| tf_planA | Run terraform plan and return a human-readable diff of what will change. Safe — makes no changes to infrastructure. |
| tf_outputA | Read Terraform output values from the current state. Returns all outputs as JSON, or a specific output by name. |
| tf_preflightA | Check which cloud providers are used in a Terraform workspace and verify authentication status for each. Call this before plan or apply to catch credential issues early. |
| tf_driftA | Detect infrastructure drift — resources that were changed outside of Terraform (e.g. manually in the cloud console). Runs a refresh-only plan and reports differences between state and reality. Read-only, makes no changes. |
| tf_applyA | Apply Terraform changes to real infrastructure. TWO-STEP SAFETY FLOW:
Never pass confirmed=true without first showing the plan output to the user. |
| tf_destroyA | Destroy all Terraform-managed infrastructure in the workspace. TWO-STEP SAFETY FLOW:
This is irreversible. Always show the plan and get explicit user approval first. |
| tf_stateA | Manage Terraform state. Supports the following operations:
|
| tf_resourceA | Resource-level state operations:
|
| tf_initA | Initialize a Terraform working directory. Downloads providers and modules. Run this before plan or apply on a fresh workspace. |
| tf_workspaceA | Manage Terraform workspaces. Supports:
|
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| tf-diagnose | Systematically diagnose a Terraform plan or apply failure |
| tf-login | Detect cloud providers in a Terraform workspace and guide the user through authentication |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 11 tools
Each tool has a distinct purpose: tf_apply applies changes, tf_destroy destroys, tf_drift detects drift, tf_init initializes, tf_output reads outputs, tf_plan plans, tf_preflight checks auth, tf_resource handles resource-level state ops, tf_state manages state, tf_validate validates config, tf_workspace manages workspaces. No overlap.
All tools follow the tf_ prefix with clear verb names (e.g., apply, destroy, drift, init, output, plan, preflight, resource, state, validate, workspace). The pattern is consistent and predictable.
11 tools cover the essential Terraform operations comprehensively—init, validate, plan, apply, destroy, state management, resource ops, drift detection, outputs, workspace management, and preflight checks. The count is well-scoped for the domain.
The tool set covers the full Terraform workflow: init, validate, plan, apply, destroy, plus state manipulation, resource import/taint/untaint/refresh, drift detection, output reading, workspace management, and preflight authentication checks. No obvious gaps.