Terraform MCP Server
Officialby hashicorp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| LOG_LEVEL | No | Logging level: trace, debug, info, warn, error, fatal, panic (overrides --log-level flag) | info |
| TFE_TOKEN | No | Terraform Enterprise API token | |
| LOG_FORMAT | No | Logging format: text or json (overrides --log-format flag) | text |
| TFE_ADDRESS | No | Sets the Terraform Enterprise/HCP Terraform address for API calls. Must include the protocol (e.g., https://app.terraform.io). In streamable-http mode this is the only way to set the address; it cannot be supplied by clients via header or query parameter. | |
| MCP_ENDPOINT | No | HTTP server endpoint path | /mcp |
| MCP_CORS_MODE | No | CORS mode: strict, development, or disabled | strict |
| MCP_KEEP_ALIVE | No | Keep-alive interval for SSE connections (e.g., 30s, 1m). 0 to disable | 0 |
| TRANSPORT_HOST | No | Host to bind the HTTP server | 127.0.0.1 |
| TRANSPORT_MODE | No | Set to streamable-http to enable HTTP transport (legacy http value still supported) | stdio |
| TRANSPORT_PORT | No | HTTP server port | 8080 |
| INSTANA_ENABLED | No | Enable Instana instrumentation (metrics and HTTP request tracing) for the streamable-http server. Requires an Instana agent that is reachable by the server. | false |
| MCP_SESSION_MODE | No | Session mode: stateful or stateless | stateful |
| MCP_TLS_KEY_FILE | No | Path to TLS key file, required for non-localhost deployment (e.g. /path/to/key.pem) | |
| MCP_TLS_CERT_FILE | No | Path to TLS cert file, required for non-localhost deployment (e.g. /path/to/cert.pem) | |
| MCP_ALLOWED_ORIGINS | No | Comma-separated list of allowed origins for CORS | |
| TFE_SKIP_TLS_VERIFY | No | Skip HCP Terraform or Terraform Enterprise TLS verification | false |
| ENABLE_TF_OPERATIONS | No | Enable tools that require explicit approval | false |
| INSTANA_SERVICE_NAME | No | If Instana instrumentation is enabled, the service name to use for the MCP server | terraform-mcp-server |
| MCP_REMOTE_IP_METHOD | No | How the client IP is sourced when forwarding is enabled: RemoteAddr (direct connection only), X-Real-IP, or X-Forwarded-For | RemoteAddr |
| MCP_XFF_TRUSTED_HOPS | No | Number of trusted proxy hops counted from the right of the X-Forwarded-For chain. Only used when MCP_REMOTE_IP_METHOD=X-Forwarded-For | 0 |
| OTEL_METRICS_ENABLED | No | Enable tools and server metrics using otel | false |
| TF_MCP_SHARED_SECRET | No | Shared secret sent as the X-Tf-Mcp-Secret header on requests to HCP Terraform / TFE, used to identify requests originating from a hosted MCP deployment. Should only be used over TLS. | |
| MCP_FORWARD_CLIENT_IP | No | Forward the client IP to HCP Terraform / TFE via X-Forwarded-For. Set to true to enable | false |
| MCP_RATE_LIMIT_GLOBAL | No | Global rate limit (format: rps:burst) | 10:20 |
| MCP_REDIRECT_ROOT_URL | No | URL to redirect requests to / to | |
| OTEL_METRICS_ENDPOINT | No | URL of your OTel Collector or backend | localhost:4318 |
| MCP_RATE_LIMIT_SESSION | No | Per-session rate limit (format: rps:burst) | 5:10 |
| OTEL_METRICS_SERVICE_NAME | No | Identifies the source of the metrics (e.g., "terraform-mcp-server") | terraform-mcp-server |
| MCP_ORGANIZATION_ALLOWLIST | No | CSV list of HCP Terraform organization names allowed to access the HTTP server | |
| OTEL_METRICS_EXPORT_INTERVAL | No | Controls the frequency of metric flushes | 2 |
| OTEL_METRICS_SERVICE_VERSION | No | Version of the terraform-mcp-server sending metrics, which is used to set metric attributes. It also helps track metrics across different deployments | latest |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Server capabilities have not been inspected yet.
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
No tools | |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/hashicorp/terraform-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server