Validate Terraform configuration files for syntax and internal consistency. Does not access remote state or APIs.

Run terraform plan and return a human-readable diff of what will change. Safe — makes no changes to infrastructure.

Read Terraform output values from the current state. Returns all outputs as JSON, or a specific output by name.

Check which cloud providers are used in a Terraform workspace and verify authentication status for each. Call this before plan or apply to catch credential issues early.

Detect infrastructure drift — resources that were changed outside of Terraform (e.g. manually in the cloud console). Runs a refresh-only plan and reports differences between state and reality. Read-only, makes no changes.

Apply Terraform changes to real infrastructure.

TWO-STEP SAFETY FLOW:

1. Call without confirmed=true → runs terraform plan, shows the diff, returns without applying.

2. Call with confirmed=true after reviewing the diff → actually applies the changes.

Never pass confirmed=true without first showing the plan output to the user.

Destroy all Terraform-managed infrastructure in the workspace.

TWO-STEP SAFETY FLOW:

1. Call without confirmed=true → shows the destroy plan (what will be deleted).

2. Call with confirmed=true after the user explicitly approves → destroys everything.

This is irreversible. Always show the plan and get explicit user approval first.

Manage Terraform state. Supports the following operations:

• list: List all resources in state

• show: Show attributes of a specific resource

• mv: Move/rename a resource in state (use with care)

• rm: Remove a resource from state without destroying it (destructive)

Resource-level state operations:

• import: Bring an existing cloud resource under Terraform management (requires address + id)

• taint: Mark a resource for recreation on next apply (requires address)

• untaint: Remove the taint mark (requires address)

• refresh: Sync state with real infrastructure (accepts drift into state)

Initialize a Terraform working directory. Downloads providers and modules. Run this before plan or apply on a fresh workspace.

Manage Terraform workspaces. Supports:

• list: List all workspaces and show which is active

• show: Show the current workspace name

• select: Switch to a workspace

• new: Create a new workspace