List providers and their PINNED versions for a Terraform root module (default: cwd). Call this first so code targets the versions actually locked in .terraform.lock.hcl, not the latest release. Lists only the providers locked in THIS directory; it does not search the registry. For registry search, provider docs or the latest version, use the official terraform MCP server (search_provider_docs / get_latest_provider_version).

Find resource / data source / ephemeral resource type names containing query (e.g. 's3_bucket') in the pinned providers. kind: resource | data | ephemeral.

Exact arguments and nested blocks for one type at the PINNED provider version. Use BEFORE writing or editing any resource/data/ephemeral block; only arguments listed here exist. 'computed (read-only)' attributes cannot be set. kind: resource | data | ephemeral.

Validate argument / nested-block paths against the PINNED schema before writing them, e.g. ["bucket", "region", "versioning.enabled"]. Flags unknown, read-only and deprecated paths.

Summarize a saved Terraform plan: deletes and replaces first (with the attribute that forces each replace), updates with changed paths, creates, imports, moves, forgets, drift and output changes, plus a destroy warning that names renames needing a moved block. Pass plan_file (binary from terraform plan -out, rendered with terraform show -json in dir, or a plan JSON file) or plan_json (e.g. from the official terraform MCP server's get_plan_json_output(plan_id) for an HCP run; get the plan id from its get_run_details). Prints no values: sensitive paths are truncated, import IDs omitted.

Variables (exact type expression, required/optional, default, sensitive/nullable/ephemeral, validation count), outputs and module calls of a module in THIS working directory: the root, a local module directory, or an installed module by address (module.network, resolved through .terraform/modules/modules.json, so downloaded registry/git modules work). Module calls are checked against what is installed. For public registry modules you have not installed, use the official terraform MCP server.

List resource instance addresses in the current Terraform state (terraform state list), optionally filtered. Read-only: never locks, never refreshes. With a remote backend this reads S3/GCS/HCP using the server's credentials; a non-default workspace that does not exist is refused (reading it would create it).

Show one resource instance's attribute values from the current Terraform state (terraform show -json). Read-only: never locks, never refreshes. Sensitive values are redacted: Terraform's own markers, plus values equal to a marked one, secret-like names and secret-shaped strings; a footer says what was hidden and why.

What breaks if a pinned provider is upgraded (or downgraded) to an exact version: compares the pinned schema with the target's for the arguments, nested blocks and attribute reads this configuration uses (root and installed modules), checks version constraints, and confirms with terraform validate on a temp copy. Downloads the target provider from the registry into a cache (temp dirs only; never touches dir). For the latest version number or upgrade guides, use the official terraform MCP server.