AWS Terraform MCP Server
Offers containerized deployment of the MCP server, allowing it to run in isolated environments with all dependencies included
Integrates with GitHub for source code management and package distribution through GitHub Container Registry (GHCR)
Provides access to AWS-IA GenAI modules for OpenSearch through the SearchSpecificAwsIaModules tool
Supports testing framework for validating MCP server functionality
Implements Semantic Versioning for release management with automated releases based on commit conventions
Provides access to AWS-IA GenAI modules for Streamlit through the SearchSpecificAwsIaModules tool
Provides tools for executing Terraform commands (init, plan, validate, apply, destroy) and searching AWS provider documentation to help with infrastructure as code management
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AWS Terraform MCP Servercreate an S3 bucket with encryption and versioning enabled"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AWS Terraform MCP Server
Docker containerized version of the AWS Labs Terraform MCP Server - a Model Context Protocol (MCP) server for Terraform on AWS best practices, infrastructure as code patterns, and security compliance with Checkov.
🚀 Quick Start
Using Docker (Recommended)
# Pull and run the latest image
docker run --rm --interactive ghcr.io/stv-io/aws-terraform-mcp-server:latestUsing with MCP Clients
Windsurf IDE
Add to your Windsurf MCP settings:
{
"name": "AWS Terraform MCP Server",
"command": "docker",
"args": [
"run", "--rm", "--interactive",
"--env", "FASTMCP_LOG_LEVEL=ERROR",
"ghcr.io/stv-io/aws-terraform-mcp-server:latest"
],
"env": {},
"disabled": false,
"autoApprove": []
}Cursor IDE
Add to your Cursor MCP configuration:
{
"mcpServers": {
"aws-terraform-mcp-server": {
"command": "docker",
"args": [
"run", "--rm", "--interactive",
"--env", "FASTMCP_LOG_LEVEL=ERROR",
"ghcr.io/stv-io/aws-terraform-mcp-server:latest"
],
"env": {},
"disabled": false,
"autoApprove": []
}
}
}Related MCP server: Terrakube MCP Server
🛠️ Features
Tools Available
ExecuteTerraformCommand - Run Terraform commands (init, plan, validate, apply, destroy)
ExecuteTerragruntCommand - Run Terragrunt workflows with advanced features
SearchAwsProviderDocs - Search AWS provider documentation
SearchAwsccProviderDocs - Search AWSCC provider documentation
SearchSpecificAwsIaModules - Access AWS-IA GenAI modules (Bedrock, OpenSearch, SageMaker, Streamlit)
RunCheckovScan - Security and compliance scanning with Checkov
SearchUserProvidedModule - Analyze Terraform Registry modules
Resources Available
terraform_development_workflow - Security-focused development process guide
terraform_aws_provider_resources_listing - Comprehensive AWS provider resources catalog
terraform_awscc_provider_resources_listing - AWSCC provider resources catalog
terraform_aws_best_practices - AWS Terraform best practices guidance
🔧 Development
Building Locally
# Clone the repository
git clone https://github.com/stv-io/aws-terraform-mcp-server.git
cd aws-terraform-mcp-server
# Build the Docker image
docker build -t aws-terraform-mcp-server .
# Run locally
docker run --rm --interactive aws-terraform-mcp-serverTesting
Local Docker Testing
# Test the locally built Docker image
python3 test_docker_mcp.py
# Test the published Docker image from GHCR
sed 's|aws-terraform-mcp-server:latest|ghcr.io/stv-io/aws-terraform-mcp-server:latest|g' test_docker_mcp.py > test_published.py
python3 test_published.pyDirect Server Testing (without Docker)
# Test the server directly using uv
python3 test_mcp_server.pyUnit Tests
# Run the comprehensive test suite
python3 -m pytest tests/ -vUsing UV (Alternative)
# Install dependencies
uv sync
# Run the server
uv run awslabs.terraform-mcp-server📋 Prerequisites
For local development:
uv - Python package manager
Python 3.10+
Terraform CLI (for workflow execution)
Checkov (for security scanning)
For Docker usage:
Docker or compatible container runtime
🔒 Security Considerations
Follow structured development workflow with integrated validation and security scanning
Review all Checkov warnings and fix security issues when possible
Use AWSCC provider for consistent API behavior and better security defaults
Conduct independent assessment before applying changes to production environments
🔄 Versioning
This project uses Semantic Versioning with automated releases based on Conventional Commits.
Available Tags
latest- Latest stable releasev1.2.3- Specific versionv1.2- Latest patch of minor versionv1- Latest minor of major version
See CONTRIBUTING.md for commit message guidelines.
📄 License
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
🙏 Acknowledgments
Original implementation by AWS Labs
Built on the Model Context Protocol
Uses FastMCP framework
📞 Support
For issues and questions:
Note: This is a containerized distribution of the AWS Labs Terraform MCP Server. All credit for the core functionality goes to the AWS Labs team.
Available Tools
7 toolsExecuteTerraformCommandA
Execute Terraform workflow commands against an AWS account.
This tool runs Terraform commands (init, plan, validate, apply, destroy) in the
specified working directory, with optional variables and region settings.
Parameters:
command: Terraform command to execute
working_directory: Directory containing Terraform files
variables: Terraform variables to pass
aws_region: AWS region to use
strip_ansi: Whether to strip ANSI color codes from output
Returns:
A TerraformExecutionResult object containing command output and status
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Terraform command to execute | |
| working_directory | Yes | Directory containing Terraform files | |
| variables | No | Terraform variables to pass | |
| aws_region | No | AWS region to use | |
| strip_ansi | No | Whether to strip ANSI color codes from output |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| stderr | No | |
| stdout | No | |
| command | Yes | |
| outputs | No | Terraform outputs (for apply command) |
| return_code | No | |
| error_message | No | |
| working_directory | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the tool executes commands (implying potential mutations like apply/destroy) and mentions output handling (strip_ansi), but does not cover critical behavioral aspects such as authentication requirements, rate limits, error handling, or safety warnings for destructive commands like destroy. It adds some context but leaves significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (overview, parameters, returns), front-loaded with the core purpose, and every sentence adds value without redundancy. It efficiently covers essential information in a compact format.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (5 parameters, mutation capabilities, no annotations) and the presence of an output schema (returns TerraformExecutionResult), the description is mostly complete. It covers purpose, parameters, and output type, but lacks details on behavioral traits (e.g., auth, safety) that would be crucial for a tool with commands like destroy, preventing a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by listing all parameters with brief explanations in a structured 'Parameters' section, clarifying their roles beyond the schema. However, it does not provide deep semantic insights (e.g., format examples for variables or region implications), keeping it at a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes Terraform workflow commands against an AWS account, specifying the exact commands (init, plan, validate, apply, destroy) and distinguishing it from sibling tools like ExecuteTerragruntCommand and RunCheckovScan. It provides a specific verb ('execute') and resource ('Terraform workflow commands') with clear scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for Terraform operations in AWS contexts but does not explicitly state when to use this tool versus alternatives like ExecuteTerragruntCommand or RunCheckovScan. It provides basic context (working with Terraform in AWS) but lacks explicit guidance on exclusions or comparative scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ExecuteTerragruntCommandA
Execute Terragrunt workflow commands against an AWS account.
This tool runs Terragrunt commands (init, plan, validate, apply, destroy, run-all) in the
specified working directory, with optional variables and region settings. Terragrunt extends
Terraform's functionality by providing features like remote state management, dependencies
between modules, and the ability to execute Terraform commands on multiple modules at once.
Parameters:
command: Terragrunt command to execute
working_directory: Directory containing Terragrunt files
variables: Terraform variables to pass
aws_region: AWS region to use
strip_ansi: Whether to strip ANSI color codes from output
include_dirs: Directories to include in a multi-module run
exclude_dirs: Directories to exclude from a multi-module run
run_all: Run command on all modules in subdirectories
terragrunt_config: Path to a custom terragrunt config file (not valid with run-all)
Returns:
A TerragruntExecutionResult object containing command output and status
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Terragrunt command to execute | |
| working_directory | Yes | Directory containing Terragrunt files | |
| variables | No | Terraform variables to pass | |
| aws_region | No | AWS region to use | |
| strip_ansi | No | Whether to strip ANSI color codes from output | |
| include_dirs | No | Directories to include in a multi-module run | |
| exclude_dirs | No | Directories to exclude from a multi-module run | |
| run_all | No | Run command on all modules in subdirectories | |
| terragrunt_config | No | Path to a custom terragrunt config file (not valid with run-all) |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| stderr | No | |
| stdout | No | |
| command | Yes | |
| outputs | No | Terragrunt outputs (for apply or output command) |
| return_code | No | |
| affected_dirs | No | Directories affected by a run-all command |
| error_message | No | |
| working_directory | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it executes commands that can be destructive (apply, destroy), mentions AWS account targeting, describes Terragrunt's extended functionality, and notes parameter constraints (terragrunt_config not valid with run-all). However, it doesn't cover authentication requirements, rate limits, or error handling specifics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with purpose statement, context about Terragrunt, parameter list, and return information. It's appropriately sized for a 9-parameter tool but could be more front-loaded; the Terragrunt explanation paragraph could be shortened. Most sentences earn their place, though some parameter explanations are redundant with schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, potential destructive operations) and absence of annotations, the description does reasonably well. It explains the tool's purpose, lists parameters, mentions return type, and provides Terragrunt context. However, with no annotations and significant behavioral implications (destructive commands), it should ideally cover more about authentication, safety warnings, or execution environment.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description lists all parameters with brief explanations but adds minimal semantic value beyond what's already in the schema descriptions. The note about 'terragrunt_config not valid with run-all' is the only significant addition, but most parameter explanations simply restate schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Execute Terragrunt workflow commands against an AWS account' with specific verbs (init, plan, validate, apply, destroy, run-all) and distinguishes it from sibling tools by mentioning Terragrunt's unique features like remote state management and multi-module execution. It differentiates from ExecuteTerraformCommand by focusing on Terragrunt workflows.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context through the mention of Terragrunt extending Terraform and AWS account targeting, but lacks explicit guidance on when to use this tool versus alternatives like ExecuteTerraformCommand or the various search tools. No when-not-to-use guidance or clear prerequisites are provided beyond the AWS context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
RunCheckovScanA
Run Checkov security scan on Terraform code.
This tool runs Checkov to scan Terraform code for security and compliance issues,
identifying potential vulnerabilities and misconfigurations according to best practices.
Checkov (https://www.checkov.io/) is an open-source static code analysis tool that
can detect hundreds of security and compliance issues in infrastructure-as-code.
Parameters:
working_directory: Directory containing Terraform files to scan
framework: Framework to scan (default: terraform)
check_ids: Optional list of specific check IDs to run
skip_check_ids: Optional list of check IDs to skip
output_format: Format for scan results (default: json)
Returns:
A CheckovScanResult object containing scan results and identified vulnerabilities
| Name | Required | Description | Default |
|---|---|---|---|
| working_directory | Yes | Directory containing Terraform files | |
| framework | No | Framework to scan (terraform, cloudformation, etc.) | terraform |
| check_ids | No | Specific check IDs to run | |
| skip_check_ids | No | Check IDs to skip | |
| output_format | No | Output format (json, cli, etc.) | json |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| summary | No | Summary of scan results |
| raw_output | No | Raw output from Checkov |
| return_code | No | |
| error_message | No | |
| vulnerabilities | No | List of found vulnerabilities |
| working_directory | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes the tool as running a scan and returning results, which implies a read-only operation, but does not detail execution characteristics such as runtime, error handling, or external dependencies (e.g., Checkov installation). It adds context by linking to Checkov's website and noting it's open-source, but lacks specifics on permissions or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and appropriately sized, with a clear purpose statement followed by parameter and return sections. It avoids redundancy, though the link to Checkov's website, while informative, could be considered slightly extraneous. Overall, it is efficient and front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (security scanning with multiple parameters), the description is reasonably complete. It explains the tool's purpose, parameters, and return value, and an output schema exists to detail results. However, it could improve by addressing usage guidelines and behavioral aspects like execution limits or error scenarios, which are not covered by annotations or schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description lists parameters with brief explanations (e.g., 'Directory containing Terraform files to scan'), but does not add significant meaning beyond what the schema provides, such as examples or constraints. The baseline score of 3 reflects adequate coverage without extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verb ('run') and resource ('Checkov security scan on Terraform code'), distinguishing it from sibling tools like ExecuteTerraformCommand or ExecuteTerragruntCommand. It explicitly mentions scanning for 'security and compliance issues' and 'identifying potential vulnerabilities and misconfigurations,' providing a precise scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lacks explicit guidance on when to use this tool versus alternatives. While it mentions scanning Terraform code, it does not specify prerequisites (e.g., whether Terraform files must be valid), exclusions (e.g., non-Terraform files), or comparisons to sibling tools like ExecuteTerraformCommand, which might handle other Terraform operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
SearchAwsccProviderDocsA
Search AWSCC provider documentation for resources and attributes.
The AWSCC provider is based on the AWS Cloud Control API
and provides a more consistent interface to AWS resources compared to the standard AWS provider.
This tool searches the Terraform AWSCC provider documentation for information about
a specific asset in the AWSCC Provider Documentation, assets can be either resources or data sources. It retrieves comprehensive details including descriptions, example code snippets, and schema references.
Use the 'asset_type' parameter to specify if you are looking for information about provider resources, data sources, or both. Valid values are 'resource', 'data_source' or 'both'.
The tool will automatically handle prefixes - you can search for either 'awscc_s3_bucket' or 's3_bucket'.
Examples:
- To get documentation for an S3 bucket resource:
search_awscc_provider_docs(asset_name='awscc_s3_bucket')
search_awscc_provider_docs(asset_name='awscc_s3_bucket', asset_type='resource')
- To search only for data sources:
search_aws_provider_docs(asset_name='awscc_appsync_api', kind='data_source')
- To search for both resource and data source documentation of a given name:
search_aws_provider_docs(asset_name='awscc_appsync_api', kind='both')
- Search of a resource without the prefix:
search_awscc_provider_docs(resource_type='ec2_instance')
Parameters:
asset_name: Name of the AWSCC Provider resource or data source to look for (e.g., 'awscc_s3_bucket', 'awscc_lambda_function')
asset_type: Type of documentation to search - 'resource' (default), 'data_source', or 'both'. Some resources and data sources share the same name
Returns:
A list of matching documentation entries with details including:
- Resource name and description
- URL to the official documentation
- Example code snippets
- Schema information (required, optional, read-only, and nested structures attributes)
| Name | Required | Description | Default |
|---|---|---|---|
| asset_name | Yes | Name of the AWSCC service (asset) to look for (e.g., awscc_s3_bucket, awscc_lambda_function) | |
| asset_type | No | Type of documentation to search - 'resource' (default), 'data_source', or 'both' | resource |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by detailing what the tool returns (list of documentation entries with specific details like URLs and schema information). It doesn't mention rate limits, authentication needs, or error handling, but covers the core behavior adequately for a search tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose but includes repetitive examples and a verbose 'Returns' section that overlaps with output schema. Sentences like 'The tool will automatically handle prefixes' are useful, but overall it could be more streamlined by removing redundancy and focusing on unique guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (searching documentation with two parameters), rich output schema (implied by 'Returns' section), and no annotations, the description is complete. It covers purpose, usage, parameters, and return details, making it sufficient for an AI agent to understand and invoke the tool correctly without gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value by explaining parameter usage with examples (e.g., handling prefixes, valid values for asset_type) and clarifying that some resources and data sources share names, which enhances understanding beyond the schema's basic descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches AWSCC provider documentation for resources and attributes, specifying it retrieves comprehensive details like descriptions, code snippets, and schema references. It distinguishes from sibling tools like SearchAwsProviderDocs by focusing on AWSCC (Cloud Control API) rather than standard AWS provider documentation, avoiding tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides when to use this tool with examples for different asset types (resource, data_source, both) and clarifies it handles prefixes automatically. It distinguishes from alternatives by specifying the AWSCC provider context, though it doesn't explicitly name when not to use it versus siblings like SearchAwsProviderDocs, but the context makes this clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
SearchAwsProviderDocsA
Search AWS provider documentation for resources and attributes.
This tool searches the Terraform AWS provider documentation for information about
a specific asset in the AWS Provider Documentation, assets can be either resources or data sources. It retrieves comprehensive details including descriptions, example code snippets, argument references, and attribute references.
Use the 'asset_type' parameter to specify if you are looking for information about provider resources, data sources, or both. Valid values are 'resource', 'data_source' or 'both'.
The tool will automatically handle prefixes - you can search for either 'aws_s3_bucket' or 's3_bucket'.
Examples:
- To get documentation for an S3 bucket resource:
search_aws_provider_docs(asset_name='aws_s3_bucket')
- To search only for data sources:
search_aws_provider_docs(asset_name='aws_ami', asset_type='data_source')
- To search for both resource and data source documentation of a given name:
search_aws_provider_docs(asset_name='aws_instance', asset_type='both')
Parameters:
asset_name: Name of the service (asset) to look for (e.g., 'aws_s3_bucket', 'aws_lambda_function')
asset_type: Type of documentation to search - 'resource' (default), 'data_source', or 'both'
Returns:
A list of matching documentation entries with details including:
- Resource name and description
- URL to the official documentation
- Example code snippets
- Arguments with descriptions
- Attributes with descriptions
| Name | Required | Description | Default |
|---|---|---|---|
| asset_name | Yes | Name of the AWS service (asset) to look for (e.g., "aws_s3_bucket", "aws_lambda_function") | |
| asset_type | No | Type of documentation to search - 'resource' (default), 'data_source', or 'both' | resource |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well by disclosing behavioral traits such as handling prefixes automatically (e.g., 'aws_s3_bucket' or 's3_bucket'), specifying valid values for asset_type, and describing the return format. It does not mention rate limits or authentication needs, but covers key operational aspects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately sized and front-loaded, starting with a clear purpose, followed by usage details, examples, and parameter explanations. Every sentence adds value without redundancy, making it efficient and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity and the presence of an output schema (which details return values), the description is complete enough. It covers purpose, usage, parameters, and behavioral aspects, providing sufficient context for an AI agent to understand and invoke the tool correctly without needing to repeat output details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description adds some value by explaining asset_type options and providing examples, but does not significantly enhance semantics beyond what the schema provides, aligning with the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches AWS provider documentation for resources and attributes, specifying it retrieves comprehensive details like descriptions, code snippets, and references. It distinguishes from siblings like ExecuteTerraformCommand by focusing on documentation search rather than execution or scanning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use this tool (e.g., for searching documentation) and includes examples for different scenarios. However, it does not explicitly state when not to use it or compare it to alternatives like SearchAwsccProviderDocs, which might handle different documentation sources.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
SearchSpecificAwsIaModulesA
Search for specific AWS-IA Terraform modules.
This tool checks for information about four specific AWS-IA modules:
- aws-ia/bedrock/aws - Amazon Bedrock module for generative AI applications
- aws-ia/opensearch-serverless/aws - OpenSearch Serverless collection for vector search
- aws-ia/sagemaker-endpoint/aws - SageMaker endpoint deployment module
- aws-ia/serverless-streamlit-app/aws - Serverless Streamlit application deployment
It returns detailed information about these modules, including their README content,
variables.tf content, and submodules when available.
The search is performed across module names, descriptions, README content, and variable
definitions. This allows you to find modules based on their functionality or specific
configuration options.
Examples:
- To get information about all four modules:
search_specific_aws_ia_modules()
- To find modules related to Bedrock:
search_specific_aws_ia_modules(query='bedrock')
- To find modules related to vector search:
search_specific_aws_ia_modules(query='vector search')
- To find modules with specific configuration options:
search_specific_aws_ia_modules(query='endpoint_name')
Parameters:
query: Optional search term to filter modules (empty returns all four modules)
Returns:
A list of matching modules with their details, including:
- Basic module information (name, namespace, version)
- Module documentation (README content)
- Input and output parameter counts
- Variables from variables.tf with descriptions and default values
- Submodules information
- Version details and release information
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Optional search term to filter modules (empty returns all four modules) |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure and does so effectively. It explains what information is returned (README content, variables.tf content, submodules), what the search covers (module names, descriptions, README content, variable definitions), and provides concrete examples of how the query parameter affects results. The only minor gap is lack of explicit mention of error conditions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: purpose statement, module listing, return details, examples, and parameters. While somewhat lengthy, every sentence adds value by explaining scope, behavior, or usage. The examples are particularly helpful and efficiently demonstrate different use cases.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema (true), the description doesn't need to explain return values in detail, yet it still provides a comprehensive list of what information is returned. With no annotations, the description fully covers the tool's behavior, scope, and usage. The examples bridge any potential gaps, making this complete for a search tool with one parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the baseline is 3. The description adds significant value by explaining that the query parameter is 'Optional' (contradicting the schema's 'required' designation), providing multiple concrete examples of query usage, and clarifying that an empty query returns all four modules. This goes well beyond what the schema provides, though it doesn't fully resolve the schema contradiction.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches for 'specific AWS-IA Terraform modules' and lists the exact four modules it targets (aws-ia/bedrock/aws, aws-ia/opensearch-serverless/aws, aws-ia/sagemaker-endpoint/aws, aws-ia/serverless-streamlit-app/aws). It distinguishes itself from sibling tools like SearchAwsProviderDocs and SearchUserProvidedModule by specifying this fixed set of AWS-IA modules rather than general searches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool through multiple examples: 'To get information about all four modules', 'To find modules related to Bedrock', 'To find modules related to vector search', and 'To find modules with specific configuration options'. It also clarifies that an empty query returns all four modules, establishing clear usage patterns.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
SearchUserProvidedModuleA
Search for a user-provided Terraform registry module and understand its inputs, outputs, and usage.
This tool takes a Terraform registry module URL and analyzes its input variables,
output variables, README, and other details to provide comprehensive information
about the module.
The module URL should be in the format "namespace/name/provider" (e.g., "hashicorp/consul/aws")
or "registry.terraform.io/namespace/name/provider".
Examples:
- To search for the HashiCorp Consul module:
search_user_provided_module(module_url='hashicorp/consul/aws')
- To search for a specific version of a module:
search_user_provided_module(module_url='terraform-aws-modules/vpc/aws', version='3.14.0')
- To search for a module with specific variables:
search_user_provided_module(
module_url='terraform-aws-modules/eks/aws',
variables={'cluster_name': 'my-cluster', 'vpc_id': 'vpc-12345'}
)
Parameters:
module_url: URL or identifier of the Terraform module (e.g., "hashicorp/consul/aws")
version: Optional specific version of the module to analyze
variables: Optional dictionary of variables to use when analyzing the module
Returns:
A SearchUserProvidedModuleResult object containing module information
| Name | Required | Description | Default |
|---|---|---|---|
| module_url | Yes | URL or identifier of the Terraform module (e.g., "hashicorp/consul/aws") | |
| version | No | Specific version of the module to analyze | |
| variables | No | Variables to use when analyzing the module |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| outputs | No | Outputs provided by the module |
| variables | No | Variables defined by the module |
| module_url | Yes | |
| module_name | Yes | |
| error_message | No | Error message if execution failed |
| module_version | Yes | |
| readme_content | No | README content of the module |
| module_description | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes what the tool does (analyzes modules) and mentions the return type, but does not cover aspects like rate limits, authentication needs, or error handling. It adds some context but lacks comprehensive behavioral traits beyond the basic operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded with the purpose, followed by examples and parameter details. It is appropriately sized, but could be slightly more concise by reducing redundancy in parameter explanations. Every sentence adds value, though some information overlaps with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, 100% schema coverage, and the presence of an output schema, the description is mostly complete. It explains the purpose, usage, and parameters adequately, but could improve by addressing behavioral aspects like permissions or limitations. The output schema reduces the need to detail return values, making it sufficient but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds minimal value by listing parameters and providing examples, but does not explain semantics beyond what the schema provides, such as format details or constraints. The baseline score of 3 is appropriate as the schema handles most documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Search for a user-provided Terraform registry module and understand its inputs, outputs, and usage.' It specifies the verb ('search'), resource ('Terraform registry module'), and scope ('analyzes its input variables, output variables, README, and other details'), distinguishing it from sibling tools like ExecuteTerraformCommand or RunCheckovScan, which perform different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool, such as analyzing module details, but does not explicitly state when not to use it or name specific alternatives. It implies usage for understanding module structures, which helps differentiate from siblings like SearchAwsProviderDocs, but lacks explicit exclusions or comparisons.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
- First observed
ExecuteTerraformCommand - First observed
ExecuteTerragruntCommand - First observed
RunCheckovScan - First observed
SearchAwsccProviderDocs - First observed
SearchAwsProviderDocs - First observed
SearchSpecificAwsIaModules - First observed
SearchUserProvidedModule
TDQS
Scored across 7 tools
Most tools have distinct purposes: Terraform/Terragrunt execution, Checkov scanning, and three types of documentation/module searches. However, there is some overlap between ExecuteTerraformCommand and ExecuteTerragruntCommand, as both handle similar infrastructure-as-code workflows with identical core commands, which could cause confusion if an agent doesn't understand the Terragrunt extension. The three search tools are well-differentiated by their targets (AWSCC docs, AWS docs, specific modules, user-provided modules).
Tool names follow a consistent PascalCase pattern (e.g., ExecuteTerraformCommand, RunCheckovScan, SearchAwsccProviderDocs), which is predictable and readable. The only minor deviation is that some names start with verbs like 'Execute' or 'Run', while others start with 'Search', but this aligns with their functional groups (execution vs. search), maintaining overall consistency.
With 7 tools, the count is well-scoped for an AWS Terraform server, covering execution, security scanning, and documentation/module searches. Each tool earns its place by addressing a specific aspect of Terraform workflows in AWS, without being overly sparse or bloated, making it manageable for agents to navigate.
The tool set provides good coverage for Terraform operations in AWS, including execution (Terraform/Terragrunt), security (Checkov), and documentation/search capabilities. Minor gaps exist, such as no direct tools for managing Terraform state (e.g., state locking, migration) or handling provider configurations, but core workflows are supported, and agents can likely work around these with the available tools.
Maintenance
Related MCP Connectors
The AWS Knowledge MCP server is a fully managed remote Model Context Protocol server that provides real-time access to official AWS content in an LLM-compatible format. It offers structured access to AWS documentation, code samples, blog posts, What's New announcements, Well-Architected best practices, and regional availability information for AWS APIs and CloudFormation resources. Key capabilities include searching and reading documentation in markdown format, getting content recommendations, listing AWS regions, and checking regional availability for services and features.
Devopness MCP server for DevOps happiness! Empower AI Agents to deploy apps and infra, to any cloud.
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Related MCP Servers
- FlicenseCqualityDmaintenanceA Model Context Protocol server allowing Claude AI to interact with AWS resources through natural language, enabling users to query and manage AWS services without using the traditional AWS Console or CLI.36-
- AlicenseAqualityDmaintenanceA Model Context Protocol server that enables managing Terrakube infrastructure through natural language, handling workspace management, variables, modules, and organization operations.164 npm3Apache 2.0

LocalStack MCP Serverofficial
AlicenseAqualityCmaintenanceA Model Context Protocol (MCP) server for LocalStack that enables management of local AWS development environments, including container lifecycle operations, infrastructure deployments, log analysis with IAM policy generation, chaos injection, and Cloud Pods state management.7168 npm27Apache 2.0- AlicenseNot gradedqualityCmaintenanceA secure, containerized MCP server that enables AI assistants to manage Terraform infrastructure using integrated Language Server Protocol (LSP) tools. It facilitates safe operations like initialization, validation, and planning while providing context-aware code completion and documentation.10MIT