tf-approval-gate
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| APPROVAL_MODE | No | Approval mode: 'cli' for terminal-based approval, 'slack' for Slack approval (default). | slack |
| SLACK_APP_TOKEN | No | Slack app-level token (xapp-...) with Socket Mode enabled. | |
| SLACK_BOT_TOKEN | No | Slack bot token (xoxb-...) from your Slac app. | |
| SLACK_APPROVAL_CHANNEL | No | Slack channel where approal requests are posted. | |
| SLACK_APPROVER_USER_IDS | No | Comma-separated Slac user IDs allowed to click Approve/Reject. | |
| TF_APPROVAL_GATE_SECRET | No | Secret used to sign single-use approval tokens. Generate with `openssl rand -hex 32`. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| tf_workspace_initC | Checks out/copies a Terraform project into a sandboxed workdir. |
| tf_write_fileA | Writes a .tf/.tfvars file into a sandboxed workspace (for agents with no native filesystem access). |
| tf_planB | Runs terraform init+plan and returns a resource-level change summary. |
| tf_policy_checkB | Runs Checkov (and OPA/Conftest if configured) against the current plan and returns a merged policy report. |
| tf_cost_estimateB | Runs Infracost against the current plan and returns a monthly cost delta (skipped if INFRACOST_API_KEY is unset). |
| tf_propose_changeB | Composite tool: runs plan, policy check, and cost estimate together and returns one bundled Proposal with a recommendation (safe/needs_review/blocked). Call this before tf_request_approval. |
| tf_request_approvalB | Sends the current plan for human approval (Slack, or the server's terminal in APPROVAL_MODE=cli). Refuses if policy findings are blocking. Returns an approvalId to poll. |
| tf_check_approval_statusB | Polls the status of a pending approval. Returns a signed approvalToken once a human approves. |
| tf_applyA | The only tool that runs terraform apply. Requires a valid approvalId + approvalToken minted by a real human approval; verifies signature, expiry, single-use, plan checksum, and drift server-side before applying. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
Each tool has a distinct role in the Terraform approval workflow: workspace setup, file writing, planning, policy/cost checks, bundled proposal, approval request, polling, and apply. The composite tf_propose_change is clearly described as an aggregate of the three analysis tools, so there is no real ambiguity about when to use it.
All tools share the tf_ prefix and snake_case style, making them recognizable as part of the same family. However, naming order is not perfectly uniform: tf_workspace_init, tf_policy_check, and tf_cost_estimate are object-first/noun phrases while tf_write_file, tf_propose_change, and tf_request_approval are verb-first.
9 tools is well-scoped for an approval-gate server covering workspace setup, plan analysis, policy/cost evaluation, human approval, and guarded apply. Each tool adds necessary functionality without redundancy or bloat.
The tool surface covers the full Terraform approval lifecycle: prepare workspace, write config, plan, run policy and cost checks, bundle results, request approval, poll for approval status, and apply with server-side validation. There are no obvious dead ends or missing operations for the stated domain.