Skip to main content
Glama
stv-io

AWS Terraform MCP Server

by stv-io

AWS Terraform MCP Server

Docker Image GitHub License

Docker containerized version of the AWS Labs Terraform MCP Server - a Model Context Protocol (MCP) server for Terraform on AWS best practices, infrastructure as code patterns, and security compliance with Checkov.

🚀 Quick Start

# Pull and run the latest image
docker run --rm --interactive ghcr.io/stv-io/aws-terraform-mcp-server:latest

Using with MCP Clients

Windsurf IDE

Add to your Windsurf MCP settings:

{
  "name": "AWS Terraform MCP Server",
  "command": "docker",
  "args": [
    "run", "--rm", "--interactive",
    "--env", "FASTMCP_LOG_LEVEL=ERROR",
    "ghcr.io/stv-io/aws-terraform-mcp-server:latest"
  ],
  "env": {},
  "disabled": false,
  "autoApprove": []
}

Cursor IDE

Add to your Cursor MCP configuration:

{
  "mcpServers": {
    "aws-terraform-mcp-server": {
      "command": "docker",
      "args": [
        "run", "--rm", "--interactive",
        "--env", "FASTMCP_LOG_LEVEL=ERROR",
        "ghcr.io/stv-io/aws-terraform-mcp-server:latest"
      ],
      "env": {},
      "disabled": false,
      "autoApprove": []
    }
  }
}

Related MCP server: Terrakube MCP Server

🛠️ Features

Tools Available

  • ExecuteTerraformCommand - Run Terraform commands (init, plan, validate, apply, destroy)

  • ExecuteTerragruntCommand - Run Terragrunt workflows with advanced features

  • SearchAwsProviderDocs - Search AWS provider documentation

  • SearchAwsccProviderDocs - Search AWSCC provider documentation

  • SearchSpecificAwsIaModules - Access AWS-IA GenAI modules (Bedrock, OpenSearch, SageMaker, Streamlit)

  • RunCheckovScan - Security and compliance scanning with Checkov

  • SearchUserProvidedModule - Analyze Terraform Registry modules

Resources Available

  • terraform_development_workflow - Security-focused development process guide

  • terraform_aws_provider_resources_listing - Comprehensive AWS provider resources catalog

  • terraform_awscc_provider_resources_listing - AWSCC provider resources catalog

  • terraform_aws_best_practices - AWS Terraform best practices guidance

🔧 Development

Building Locally

# Clone the repository
git clone https://github.com/stv-io/aws-terraform-mcp-server.git
cd aws-terraform-mcp-server

# Build the Docker image
docker build -t aws-terraform-mcp-server .

# Run locally
docker run --rm --interactive aws-terraform-mcp-server

Testing

Local Docker Testing

# Test the locally built Docker image
python3 test_docker_mcp.py

# Test the published Docker image from GHCR
sed 's|aws-terraform-mcp-server:latest|ghcr.io/stv-io/aws-terraform-mcp-server:latest|g' test_docker_mcp.py > test_published.py
python3 test_published.py

Direct Server Testing (without Docker)

# Test the server directly using uv
python3 test_mcp_server.py

Unit Tests

# Run the comprehensive test suite
python3 -m pytest tests/ -v

Using UV (Alternative)

# Install dependencies
uv sync

# Run the server
uv run awslabs.terraform-mcp-server

📋 Prerequisites

For local development:

  1. uv - Python package manager

  2. Python 3.10+

  3. Terraform CLI (for workflow execution)

  4. Checkov (for security scanning)

For Docker usage:

  1. Docker or compatible container runtime

🔒 Security Considerations

  • Follow structured development workflow with integrated validation and security scanning

  • Review all Checkov warnings and fix security issues when possible

  • Use AWSCC provider for consistent API behavior and better security defaults

  • Conduct independent assessment before applying changes to production environments

🔄 Versioning

This project uses Semantic Versioning with automated releases based on Conventional Commits.

Available Tags

  • latest - Latest stable release

  • v1.2.3 - Specific version

  • v1.2 - Latest patch of minor version

  • v1 - Latest minor of major version

See CONTRIBUTING.md for commit message guidelines.

📄 License

This project is licensed under the Apache License 2.0 - see the LICENSE file for details.

🙏 Acknowledgments

📞 Support

For issues and questions:


Note: This is a containerized distribution of the AWS Labs Terraform MCP Server. All credit for the core functionality goes to the AWS Labs team.

Available Tools

7 tools
ExecuteTerraformCommandA

Execute Terraform workflow commands against an AWS account.

This tool runs Terraform commands (init, plan, validate, apply, destroy) in the
specified working directory, with optional variables and region settings.

Parameters:
    command: Terraform command to execute
    working_directory: Directory containing Terraform files
    variables: Terraform variables to pass
    aws_region: AWS region to use
    strip_ansi: Whether to strip ANSI color codes from output

Returns:
    A TerraformExecutionResult object containing command output and status
ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesTerraform command to execute
working_directoryYesDirectory containing Terraform files
variablesNoTerraform variables to pass
aws_regionNoAWS region to use
strip_ansiNoWhether to strip ANSI color codes from output

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
stderrNo
stdoutNo
commandYes
outputsNoTerraform outputs (for apply command)
return_codeNo
error_messageNo
working_directoryYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool executes commands (implying potential mutations like apply/destroy) and mentions output handling (strip_ansi), but does not cover critical behavioral aspects such as authentication requirements, rate limits, error handling, or safety warnings for destructive commands like destroy. It adds some context but leaves significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (overview, parameters, returns), front-loaded with the core purpose, and every sentence adds value without redundancy. It efficiently covers essential information in a compact format.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (5 parameters, mutation capabilities, no annotations) and the presence of an output schema (returns TerraformExecutionResult), the description is mostly complete. It covers purpose, parameters, and output type, but lacks details on behavioral traits (e.g., auth, safety) that would be crucial for a tool with commands like destroy, preventing a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by listing all parameters with brief explanations in a structured 'Parameters' section, clarifying their roles beyond the schema. However, it does not provide deep semantic insights (e.g., format examples for variables or region implications), keeping it at a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool executes Terraform workflow commands against an AWS account, specifying the exact commands (init, plan, validate, apply, destroy) and distinguishing it from sibling tools like ExecuteTerragruntCommand and RunCheckovScan. It provides a specific verb ('execute') and resource ('Terraform workflow commands') with clear scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for Terraform operations in AWS contexts but does not explicitly state when to use this tool versus alternatives like ExecuteTerragruntCommand or RunCheckovScan. It provides basic context (working with Terraform in AWS) but lacks explicit guidance on exclusions or comparative scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ExecuteTerragruntCommandA

Execute Terragrunt workflow commands against an AWS account.

This tool runs Terragrunt commands (init, plan, validate, apply, destroy, run-all) in the
specified working directory, with optional variables and region settings. Terragrunt extends
Terraform's functionality by providing features like remote state management, dependencies
between modules, and the ability to execute Terraform commands on multiple modules at once.

Parameters:
    command: Terragrunt command to execute
    working_directory: Directory containing Terragrunt files
    variables: Terraform variables to pass
    aws_region: AWS region to use
    strip_ansi: Whether to strip ANSI color codes from output
    include_dirs: Directories to include in a multi-module run
    exclude_dirs: Directories to exclude from a multi-module run
    run_all: Run command on all modules in subdirectories
    terragrunt_config: Path to a custom terragrunt config file (not valid with run-all)

Returns:
    A TerragruntExecutionResult object containing command output and status
ParametersJSON Schema
NameRequiredDescriptionDefault
commandYesTerragrunt command to execute
working_directoryYesDirectory containing Terragrunt files
variablesNoTerraform variables to pass
aws_regionNoAWS region to use
strip_ansiNoWhether to strip ANSI color codes from output
include_dirsNoDirectories to include in a multi-module run
exclude_dirsNoDirectories to exclude from a multi-module run
run_allNoRun command on all modules in subdirectories
terragrunt_configNoPath to a custom terragrunt config file (not valid with run-all)

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
stderrNo
stdoutNo
commandYes
outputsNoTerragrunt outputs (for apply or output command)
return_codeNo
affected_dirsNoDirectories affected by a run-all command
error_messageNo
working_directoryYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it executes commands that can be destructive (apply, destroy), mentions AWS account targeting, describes Terragrunt's extended functionality, and notes parameter constraints (terragrunt_config not valid with run-all). However, it doesn't cover authentication requirements, rate limits, or error handling specifics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with purpose statement, context about Terragrunt, parameter list, and return information. It's appropriately sized for a 9-parameter tool but could be more front-loaded; the Terragrunt explanation paragraph could be shortened. Most sentences earn their place, though some parameter explanations are redundant with schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (9 parameters, potential destructive operations) and absence of annotations, the description does reasonably well. It explains the tool's purpose, lists parameters, mentions return type, and provides Terragrunt context. However, with no annotations and significant behavioral implications (destructive commands), it should ideally cover more about authentication, safety warnings, or execution environment.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description lists all parameters with brief explanations but adds minimal semantic value beyond what's already in the schema descriptions. The note about 'terragrunt_config not valid with run-all' is the only significant addition, but most parameter explanations simply restate schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Execute Terragrunt workflow commands against an AWS account' with specific verbs (init, plan, validate, apply, destroy, run-all) and distinguishes it from sibling tools by mentioning Terragrunt's unique features like remote state management and multi-module execution. It differentiates from ExecuteTerraformCommand by focusing on Terragrunt workflows.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context through the mention of Terragrunt extending Terraform and AWS account targeting, but lacks explicit guidance on when to use this tool versus alternatives like ExecuteTerraformCommand or the various search tools. No when-not-to-use guidance or clear prerequisites are provided beyond the AWS context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

RunCheckovScanA

Run Checkov security scan on Terraform code.

This tool runs Checkov to scan Terraform code for security and compliance issues,
identifying potential vulnerabilities and misconfigurations according to best practices.

Checkov (https://www.checkov.io/) is an open-source static code analysis tool that
can detect hundreds of security and compliance issues in infrastructure-as-code.

Parameters:
    working_directory: Directory containing Terraform files to scan
    framework: Framework to scan (default: terraform)
    check_ids: Optional list of specific check IDs to run
    skip_check_ids: Optional list of check IDs to skip
    output_format: Format for scan results (default: json)

Returns:
    A CheckovScanResult object containing scan results and identified vulnerabilities
ParametersJSON Schema
NameRequiredDescriptionDefault
working_directoryYesDirectory containing Terraform files
frameworkNoFramework to scan (terraform, cloudformation, etc.)terraform
check_idsNoSpecific check IDs to run
skip_check_idsNoCheck IDs to skip
output_formatNoOutput format (json, cli, etc.)json

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
summaryNoSummary of scan results
raw_outputNoRaw output from Checkov
return_codeNo
error_messageNo
vulnerabilitiesNoList of found vulnerabilities
working_directoryYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It describes the tool as running a scan and returning results, which implies a read-only operation, but does not detail execution characteristics such as runtime, error handling, or external dependencies (e.g., Checkov installation). It adds context by linking to Checkov's website and noting it's open-source, but lacks specifics on permissions or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and appropriately sized, with a clear purpose statement followed by parameter and return sections. It avoids redundancy, though the link to Checkov's website, while informative, could be considered slightly extraneous. Overall, it is efficient and front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (security scanning with multiple parameters), the description is reasonably complete. It explains the tool's purpose, parameters, and return value, and an output schema exists to detail results. However, it could improve by addressing usage guidelines and behavioral aspects like execution limits or error scenarios, which are not covered by annotations or schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description lists parameters with brief explanations (e.g., 'Directory containing Terraform files to scan'), but does not add significant meaning beyond what the schema provides, such as examples or constraints. The baseline score of 3 reflects adequate coverage without extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verb ('run') and resource ('Checkov security scan on Terraform code'), distinguishing it from sibling tools like ExecuteTerraformCommand or ExecuteTerragruntCommand. It explicitly mentions scanning for 'security and compliance issues' and 'identifying potential vulnerabilities and misconfigurations,' providing a precise scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lacks explicit guidance on when to use this tool versus alternatives. While it mentions scanning Terraform code, it does not specify prerequisites (e.g., whether Terraform files must be valid), exclusions (e.g., non-Terraform files), or comparisons to sibling tools like ExecuteTerraformCommand, which might handle other Terraform operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

SearchAwsccProviderDocsA

Search AWSCC provider documentation for resources and attributes.

The AWSCC provider is based on the AWS Cloud Control API
and provides a more consistent interface to AWS resources compared to the standard AWS provider.

This tool searches the Terraform AWSCC provider documentation for information about
a specific asset in the AWSCC Provider Documentation, assets can be either resources or data sources. It retrieves comprehensive details including descriptions, example code snippets, and schema references.

Use the 'asset_type' parameter to specify if you are looking for information about provider resources, data sources, or both. Valid values are 'resource', 'data_source' or 'both'.

The tool will automatically handle prefixes - you can search for either 'awscc_s3_bucket' or 's3_bucket'.

Examples:
    - To get documentation for an S3 bucket resource:
      search_awscc_provider_docs(asset_name='awscc_s3_bucket')
      search_awscc_provider_docs(asset_name='awscc_s3_bucket', asset_type='resource')

    - To search only for data sources:
      search_aws_provider_docs(asset_name='awscc_appsync_api', kind='data_source')

    - To search for both resource and data source documentation of a given name:
      search_aws_provider_docs(asset_name='awscc_appsync_api', kind='both')

    - Search of a resource without the prefix:
      search_awscc_provider_docs(resource_type='ec2_instance')

Parameters:
    asset_name: Name of the AWSCC Provider resource or data source to look for (e.g., 'awscc_s3_bucket', 'awscc_lambda_function')
    asset_type: Type of documentation to search - 'resource' (default), 'data_source', or 'both'. Some resources and data sources share the same name

Returns:
    A list of matching documentation entries with details including:
    - Resource name and description
    - URL to the official documentation
    - Example code snippets
    - Schema information (required, optional, read-only, and nested structures attributes)
ParametersJSON Schema
NameRequiredDescriptionDefault
asset_nameYesName of the AWSCC service (asset) to look for (e.g., awscc_s3_bucket, awscc_lambda_function)
asset_typeNoType of documentation to search - 'resource' (default), 'data_source', or 'both'resource

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does well by detailing what the tool returns (list of documentation entries with specific details like URLs and schema information). It doesn't mention rate limits, authentication needs, or error handling, but covers the core behavior adequately for a search tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose but includes repetitive examples and a verbose 'Returns' section that overlaps with output schema. Sentences like 'The tool will automatically handle prefixes' are useful, but overall it could be more streamlined by removing redundancy and focusing on unique guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (searching documentation with two parameters), rich output schema (implied by 'Returns' section), and no annotations, the description is complete. It covers purpose, usage, parameters, and return details, making it sufficient for an AI agent to understand and invoke the tool correctly without gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds value by explaining parameter usage with examples (e.g., handling prefixes, valid values for asset_type) and clarifying that some resources and data sources share names, which enhances understanding beyond the schema's basic descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches AWSCC provider documentation for resources and attributes, specifying it retrieves comprehensive details like descriptions, code snippets, and schema references. It distinguishes from sibling tools like SearchAwsProviderDocs by focusing on AWSCC (Cloud Control API) rather than standard AWS provider documentation, avoiding tautology.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides when to use this tool with examples for different asset types (resource, data_source, both) and clarifies it handles prefixes automatically. It distinguishes from alternatives by specifying the AWSCC provider context, though it doesn't explicitly name when not to use it versus siblings like SearchAwsProviderDocs, but the context makes this clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

SearchAwsProviderDocsA

Search AWS provider documentation for resources and attributes.

This tool searches the Terraform AWS provider documentation for information about
a specific asset in the AWS Provider Documentation, assets can be either resources or data sources. It retrieves comprehensive details including descriptions, example code snippets, argument references, and attribute references.

Use the 'asset_type' parameter to specify if you are looking for information about provider resources, data sources, or both. Valid values are 'resource', 'data_source' or 'both'.

The tool will automatically handle prefixes - you can search for either 'aws_s3_bucket' or 's3_bucket'.

Examples:
    - To get documentation for an S3 bucket resource:
      search_aws_provider_docs(asset_name='aws_s3_bucket')

    - To search only for data sources:
      search_aws_provider_docs(asset_name='aws_ami', asset_type='data_source')

    - To search for both resource and data source documentation of a given name:
      search_aws_provider_docs(asset_name='aws_instance', asset_type='both')

Parameters:
    asset_name: Name of the service (asset) to look for (e.g., 'aws_s3_bucket', 'aws_lambda_function')
    asset_type: Type of documentation to search - 'resource' (default), 'data_source', or 'both'

Returns:
    A list of matching documentation entries with details including:
    - Resource name and description
    - URL to the official documentation
    - Example code snippets
    - Arguments with descriptions
    - Attributes with descriptions
ParametersJSON Schema
NameRequiredDescriptionDefault
asset_nameYesName of the AWS service (asset) to look for (e.g., "aws_s3_bucket", "aws_lambda_function")
asset_typeNoType of documentation to search - 'resource' (default), 'data_source', or 'both'resource

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does well by disclosing behavioral traits such as handling prefixes automatically (e.g., 'aws_s3_bucket' or 's3_bucket'), specifying valid values for asset_type, and describing the return format. It does not mention rate limits or authentication needs, but covers key operational aspects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded, starting with a clear purpose, followed by usage details, examples, and parameter explanations. Every sentence adds value without redundancy, making it efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and the presence of an output schema (which details return values), the description is complete enough. It covers purpose, usage, parameters, and behavioral aspects, providing sufficient context for an AI agent to understand and invoke the tool correctly without needing to repeat output details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description adds some value by explaining asset_type options and providing examples, but does not significantly enhance semantics beyond what the schema provides, aligning with the baseline for high coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches AWS provider documentation for resources and attributes, specifying it retrieves comprehensive details like descriptions, code snippets, and references. It distinguishes from siblings like ExecuteTerraformCommand by focusing on documentation search rather than execution or scanning.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use this tool (e.g., for searching documentation) and includes examples for different scenarios. However, it does not explicitly state when not to use it or compare it to alternatives like SearchAwsccProviderDocs, which might handle different documentation sources.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

SearchSpecificAwsIaModulesA

Search for specific AWS-IA Terraform modules.

This tool checks for information about four specific AWS-IA modules:
- aws-ia/bedrock/aws - Amazon Bedrock module for generative AI applications
- aws-ia/opensearch-serverless/aws - OpenSearch Serverless collection for vector search
- aws-ia/sagemaker-endpoint/aws - SageMaker endpoint deployment module
- aws-ia/serverless-streamlit-app/aws - Serverless Streamlit application deployment

It returns detailed information about these modules, including their README content,
variables.tf content, and submodules when available.

The search is performed across module names, descriptions, README content, and variable
definitions. This allows you to find modules based on their functionality or specific
configuration options.

Examples:
    - To get information about all four modules:
      search_specific_aws_ia_modules()

    - To find modules related to Bedrock:
      search_specific_aws_ia_modules(query='bedrock')

    - To find modules related to vector search:
      search_specific_aws_ia_modules(query='vector search')

    - To find modules with specific configuration options:
      search_specific_aws_ia_modules(query='endpoint_name')

Parameters:
    query: Optional search term to filter modules (empty returns all four modules)

Returns:
    A list of matching modules with their details, including:
    - Basic module information (name, namespace, version)
    - Module documentation (README content)
    - Input and output parameter counts
    - Variables from variables.tf with descriptions and default values
    - Submodules information
    - Version details and release information
ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesOptional search term to filter modules (empty returns all four modules)

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure and does so effectively. It explains what information is returned (README content, variables.tf content, submodules), what the search covers (module names, descriptions, README content, variable definitions), and provides concrete examples of how the query parameter affects results. The only minor gap is lack of explicit mention of error conditions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: purpose statement, module listing, return details, examples, and parameters. While somewhat lengthy, every sentence adds value by explaining scope, behavior, or usage. The examples are particularly helpful and efficiently demonstrate different use cases.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has an output schema (true), the description doesn't need to explain return values in detail, yet it still provides a comprehensive list of what information is returned. With no annotations, the description fully covers the tool's behavior, scope, and usage. The examples bridge any potential gaps, making this complete for a search tool with one parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, so the baseline is 3. The description adds significant value by explaining that the query parameter is 'Optional' (contradicting the schema's 'required' designation), providing multiple concrete examples of query usage, and clarifying that an empty query returns all four modules. This goes well beyond what the schema provides, though it doesn't fully resolve the schema contradiction.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches for 'specific AWS-IA Terraform modules' and lists the exact four modules it targets (aws-ia/bedrock/aws, aws-ia/opensearch-serverless/aws, aws-ia/sagemaker-endpoint/aws, aws-ia/serverless-streamlit-app/aws). It distinguishes itself from sibling tools like SearchAwsProviderDocs and SearchUserProvidedModule by specifying this fixed set of AWS-IA modules rather than general searches.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool through multiple examples: 'To get information about all four modules', 'To find modules related to Bedrock', 'To find modules related to vector search', and 'To find modules with specific configuration options'. It also clarifies that an empty query returns all four modules, establishing clear usage patterns.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

SearchUserProvidedModuleA

Search for a user-provided Terraform registry module and understand its inputs, outputs, and usage.

This tool takes a Terraform registry module URL and analyzes its input variables,
output variables, README, and other details to provide comprehensive information
about the module.

The module URL should be in the format "namespace/name/provider" (e.g., "hashicorp/consul/aws")
or "registry.terraform.io/namespace/name/provider".

Examples:
    - To search for the HashiCorp Consul module:
      search_user_provided_module(module_url='hashicorp/consul/aws')

    - To search for a specific version of a module:
      search_user_provided_module(module_url='terraform-aws-modules/vpc/aws', version='3.14.0')

    - To search for a module with specific variables:
      search_user_provided_module(
          module_url='terraform-aws-modules/eks/aws',
          variables={'cluster_name': 'my-cluster', 'vpc_id': 'vpc-12345'}
      )

Parameters:
    module_url: URL or identifier of the Terraform module (e.g., "hashicorp/consul/aws")
    version: Optional specific version of the module to analyze
    variables: Optional dictionary of variables to use when analyzing the module

Returns:
    A SearchUserProvidedModuleResult object containing module information
ParametersJSON Schema
NameRequiredDescriptionDefault
module_urlYesURL or identifier of the Terraform module (e.g., "hashicorp/consul/aws")
versionNoSpecific version of the module to analyze
variablesNoVariables to use when analyzing the module

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
outputsNoOutputs provided by the module
variablesNoVariables defined by the module
module_urlYes
module_nameYes
error_messageNoError message if execution failed
module_versionYes
readme_contentNoREADME content of the module
module_descriptionYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It describes what the tool does (analyzes modules) and mentions the return type, but does not cover aspects like rate limits, authentication needs, or error handling. It adds some context but lacks comprehensive behavioral traits beyond the basic operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the purpose, followed by examples and parameter details. It is appropriately sized, but could be slightly more concise by reducing redundancy in parameter explanations. Every sentence adds value, though some information overlaps with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, 100% schema coverage, and the presence of an output schema, the description is mostly complete. It explains the purpose, usage, and parameters adequately, but could improve by addressing behavioral aspects like permissions or limitations. The output schema reduces the need to detail return values, making it sufficient but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description adds minimal value by listing parameters and providing examples, but does not explain semantics beyond what the schema provides, such as format details or constraints. The baseline score of 3 is appropriate as the schema handles most documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Search for a user-provided Terraform registry module and understand its inputs, outputs, and usage.' It specifies the verb ('search'), resource ('Terraform registry module'), and scope ('analyzes its input variables, output variables, README, and other details'), distinguishing it from sibling tools like ExecuteTerraformCommand or RunCheckovScan, which perform different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool, such as analyzing module details, but does not explicitly state when not to use it or name specific alternatives. It implies usage for understanding module structures, which helps differentiate from siblings like SearchAwsProviderDocs, but lacks explicit exclusions or comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updates
    • First observedExecuteTerraformCommand
    • First observedExecuteTerragruntCommand
    • First observedRunCheckovScan
    • First observedSearchAwsccProviderDocs
    • First observedSearchAwsProviderDocs
    • First observedSearchSpecificAwsIaModules
    • First observedSearchUserProvidedModule

TDQS

A4/5.0

Scored across 7 tools

Disambiguation4/5

Most tools have distinct purposes: Terraform/Terragrunt execution, Checkov scanning, and three types of documentation/module searches. However, there is some overlap between ExecuteTerraformCommand and ExecuteTerragruntCommand, as both handle similar infrastructure-as-code workflows with identical core commands, which could cause confusion if an agent doesn't understand the Terragrunt extension. The three search tools are well-differentiated by their targets (AWSCC docs, AWS docs, specific modules, user-provided modules).

Naming Consistency4/5

Tool names follow a consistent PascalCase pattern (e.g., ExecuteTerraformCommand, RunCheckovScan, SearchAwsccProviderDocs), which is predictable and readable. The only minor deviation is that some names start with verbs like 'Execute' or 'Run', while others start with 'Search', but this aligns with their functional groups (execution vs. search), maintaining overall consistency.

Tool Count5/5

With 7 tools, the count is well-scoped for an AWS Terraform server, covering execution, security scanning, and documentation/module searches. Each tool earns its place by addressing a specific aspect of Terraform workflows in AWS, without being overly sparse or bloated, making it manageable for agents to navigate.

Completeness4/5

The tool set provides good coverage for Terraform operations in AWS, including execution (Terraform/Terragrunt), security (Checkov), and documentation/search capabilities. Minor gaps exist, such as no direct tools for managing Terraform state (e.g., state locking, migration) or handling provider configurations, but core workflows are supported, and agents can likely work around these with the available tools.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

  • The AWS Knowledge MCP server is a fully managed remote Model Context Protocol server that provides real-time access to official AWS content in an LLM-compatible format. It offers structured access to AWS documentation, code samples, blog posts, What's New announcements, Well-Architected best practices, and regional availability information for AWS APIs and CloudFormation resources. Key capabilities include searching and reading documentation in markdown format, getting content recommendations, listing AWS regions, and checking regional availability for services and features.

  • Devopness MCP server for DevOps happiness! Empower AI Agents to deploy apps and infra, to any cloud.

  • The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.

  • A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…

Related MCP Servers

  • F
    license
    C
    quality
    D
    maintenance
    A Model Context Protocol server allowing Claude AI to interact with AWS resources through natural language, enabling users to query and manage AWS services without using the traditional AWS Console or CLI.
    3
    6
    -
  • A
    license
    A
    quality
    D
    maintenance
    A Model Context Protocol server that enables managing Terrakube infrastructure through natural language, handling workspace management, variables, modules, and organization operations.
    16
    4 npm
    3
    Apache 2.0
  • A
    license
    A
    quality
    C
    maintenance
    A Model Context Protocol (MCP) server for LocalStack that enables management of local AWS development environments, including container lifecycle operations, infrastructure deployments, log analysis with IAM policy generation, chaos injection, and Cloud Pods state management.
    7
    168 npm
    27
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    A secure, containerized MCP server that enables AI assistants to manage Terraform infrastructure using integrated Language Server Protocol (LSP) tools. It facilitates safe operations like initialization, validation, and planning while providing context-aware code completion and documentation.
    10
    MIT