Terraform MCP Server: Setup for Claude, Cursor and Other Apps

• Finds provider documentation

  Looks up documentation pages in the public Terraform Registry for a provider service, such as resources, data sources, functions and guides, and returns their IDs and titles.

  Try: “Find the docs for the aws_s3_bucket resource in the AWS provider.”

  Network · search_provider_docs

• Reads one provider doc page

  Returns the full text of one provider documentation page. You get the page ID from search_provider_docs first.

  Try: “Show me how to configure versioning on an S3 bucket.”

  Network · get_provider_details

• Gets a provider's newest version

  Returns the latest published version of a provider in the public registry.

  Try: “What is the latest version of the hashicorp/google provider?”

  Network · get_latest_provider_version

• Lists what a provider supports

  Lists the resource types, data sources, functions and guides that a provider offers, so you can see what exists before looking up one.

  Try: “What resources does the Azure provider support for networking?”

  Network · get_provider_capabilities

• Searches public modules

  Searches the public registry for modules by name or purpose and returns matches with download counts and verification status. It also gives the module ID that get_module_details needs.

  Try: “Find popular modules for a Kubernetes cluster on AWS.”

  Network · search_modules

• Reads a module's docs

  Returns a module's documentation: inputs, outputs, examples and submodules. Run search_modules first to get the ID.

  Try: “Show the inputs and outputs of the terraform-aws-modules/vpc module.”

  Network · get_module_details

• Gets a module's newest version

  Returns the latest published version of a public registry module.

  Try: “What is the newest version of the aws vpc module?”

  Network · get_latest_module_version

• Searches Sentinel policies

  Searches the registry for Sentinel governance policies by topic and returns IDs, names and download counts.

  Try: “Find Sentinel policies that enforce encryption on storage.”

  Network · search_policies

• Reads a policy's docs

  Returns the documentation for one registry policy. Run search_policies first to get its ID.

  Try: “Explain how the first policy you found is used.”

  Network · get_policy_details

• Searches your private modules

  Searches the private registry of your HCP Terraform or Terraform Enterprise organisation for modules. It needs a token.

  Try: “Search our private registry for a network module.”

  Network · search_private_modules

• Reads a private module

  Returns a private module's inputs, outputs, dependencies, versions, submodules and usage examples.

  Try: “Show how to use our private rds module.”

  Network · get_private_module_details

• Searches your private providers

  Searches your organisation's private registry for providers.

  Try: “List our private providers.”

  Network · search_private_providers

• Reads a private provider

  Returns details about one private provider in your organisation.

  Try: “Show the details of our internal dns provider.”

  Network · get_private_provider_details

• Shows whose token is in use

  Returns the user or service account that the current token belongs to.

  Try: “Which Terraform account am I connected as?”

  Network · whoami

• Shows what your token can do

  Returns the permissions your token has in one organisation.

  Try: “What can my token do in the acme org?”

  Network · get_token_permissions

• Lists your organisations

  Lists the HCP Terraform or Terraform Enterprise organisations you can see, with paging.

  Try: “Which Terraform organisations do I belong to?”

  Network · list_terraform_orgs

• Lists projects

  Lists the projects in an organisation, with paging.

  Try: “List the projects in the acme org.”

  Network · list_terraform_projects

• Reads one project

  Returns details of a project by ID.

  Try: “Show me the Platform project.”

  Network · get_project

• Creates a project

  Creates a new project in an organisation.

  Try: “Create a project named Payments in the acme org.”

  Write · create_project

• Deletes a project

  Deletes a project by ID. It fails if the project still holds workspaces or stacks. Only available when ENABLE_TF_OPERATIONS is true.

  Try: “Delete the empty Sandbox project.”

  Delete · delete_project

• Lists teams

  Lists teams in an organisation with their IDs, names and member counts. You can filter by name.

  Try: “List the teams in the acme org.”

  Network · list_teams

• Reads one team

  Returns a team by ID, including members, organisation access and SSO settings.

  Try: “Who is on the platform-admins team?”

  Network · get_team

• Creates a team

  Creates a team in an organisation.

  Try: “Create a team called release-managers.”

  Write · create_team

• Adds a person to a team

  Adds one member to a team, by username or by organisation membership ID.

  Try: “Add jane.doe to the release-managers team.”

  Write · add_team_member

• Gives a team access

  Grants a team permission to a workspace or a project.

  Try: “Give release-managers write access to the prod workspace.”

  Write · grant_team_access

• Deletes a team

  Permanently deletes a team, which also removes its memberships and the access it gave to workspaces and projects. Organisation users and workspaces stay. Only available when ENABLE_TF_OPERATIONS is true.

  Try: “Delete the old-contractors team.”

  Delete · delete_team

• Lists workspaces

  Searches the workspaces in an organisation by name pattern, tag or query, and returns a short summary of each, with paging.

  Try: “List workspaces tagged production.”

  Network · list_workspaces

• Reads one workspace

  Returns a workspace's configuration, variables and current state information.

  Try: “Show the settings of the prod-network workspace.”

  Network · get_workspace_details

• Creates a workspace

  Creates a workspace in an organisation. The tool text warns that this can create infrastructure resources.

  Try: “Create a workspace called staging-web.”

  Write · create_workspace

• Creates a workspace from a no-code module

  Creates a workspace from a no-code module and asks you for the module's required variables as it goes.

  Try: “Deploy the no-code VPC module into a new workspace.”

  Write · create_no_code_workspace

• Changes a workspace's settings

  Updates the configuration of an existing workspace. The tool text warns that this can affect infrastructure.

  Try: “Turn on auto-apply for the staging-web workspace.”

  Write · update_workspace

• Deletes a workspace that manages nothing

  Deletes a workspace by ID only when it manages no resources. Only available when ENABLE_TF_OPERATIONS is true.

  Try: “Delete the empty scratch workspace.”

  Delete · delete_workspace_safely

• Breaks a workspace lock

  Force-unlocks a workspace stuck in a lock. It needs workspace admin permission, and the tool text says to try discarding or cancelling the run first. Only available when ENABLE_TF_OPERATIONS is true.

  Try: “Force unlock the prod-network workspace.”

  Write · force_unlock_workspace

• Lists runs in a workspace

  Lists or searches the runs of one workspace.

  Try: “Show the last 5 runs in prod-network.”

  Network · list_runs

• Reads one run

  Returns the status, plan and apply details of a run.

  Try: “What is the status of run-abc123?”

  Network · get_run_details

• Reads comments on a run

  Lists the comments people left on a run, including approval notes.

  Try: “What did reviewers say on run-abc123?”

  Network · get_run_comments

• Starts a run

  Starts a plan, a refresh or a plan-and-apply run in a workspace. Without ENABLE_TF_OPERATIONS it cannot auto-approve or destroy; with it, those options are added.

  Try: “Start a plan-only run in staging-web.”

  Write · create_run

• Approves, discards or cancels a run

  Applies, discards or cancels a run, which can change real infrastructure. Only available when ENABLE_TF_OPERATIONS is true.

  Try: “Approve and apply run-abc123.”

  Write · action_run

• Reads a plan

  Returns details of one plan.

  Try: “Summarise plan-abc123.”

  Network · get_plan_details

• Reads plan logs

  Returns the log text of a plan.

  Try: “Show me the log of plan-abc123.”

  Network · get_plan_logs

• Reads a plan as structured data

  Returns the structured JSON of a plan: resource changes, values before and after, and plan metadata.

  Try: “Which resources will plan-abc123 destroy?”

  Network · get_plan_json_output

• Reads an apply

  Returns details of one apply.

  Try: “Did apply-abc123 succeed?”

  Network · get_apply_details

• Reads apply logs

  Returns the log text of an apply.

  Try: “Show the log of apply-abc123.”

  Network · get_apply_logs

• Downloads Sentinel mock data

  Exports and downloads the Sentinel mock bundle for a plan, waiting until the export is ready. You can use it to test policies against plan output.

  Try: “Export the Sentinel mock for plan-abc123.”

  Network · get_sentinel_mock

• Lists a workspace's variables

  Lists the variables of a workspace.

  Try: “Which variables does prod-network have?”

  Network · list_workspace_variables

• Adds a workspace variable

  Creates a variable in a workspace, and you can mark it sensitive.

  Try: “Add a sensitive variable db_password to staging-web.”

  Write · create_workspace_variable

• Changes a workspace variable

  Updates an existing variable in a workspace.

  Try: “Change the instance_type variable in staging-web to t3.large.”

  Write · update_workspace_variable

• Lists variable sets

  Lists the variable sets in an organisation, optionally filtered by name.

  Try: “List our variable sets.”

  Network · list_variable_sets

• Creates a variable set

  Creates a new variable set in an organisation.

  Try: “Create a variable set called aws-credentials.”

  Write · create_variable_set

• Adds a variable to a set

  Creates a variable inside a variable set.

  Try: “Add region=eu-west-1 to the aws-defaults set.”

  Write · create_variable_in_variable_set

• Removes a variable from a set

  Deletes one variable from a variable set. This tool is not behind ENABLE_TF_OPERATIONS.

  Try: “Delete the old_key variable from aws-defaults.”

  Delete · delete_variable_in_variable_set

• Applies a variable set to workspaces

  Attaches a variable set to one or more workspaces.

  Try: “Attach aws-defaults to staging-web and prod-web.”

  Write · attach_variable_set_to_workspaces

• Removes a variable set from workspaces

  Detaches a variable set from one or more workspaces.

  Try: “Detach aws-defaults from the old-app workspace.”

  Write · detach_variable_set_from_workspaces

• Tags a workspace

  Adds tags to a workspace.

  Try: “Tag staging-web with team-web.”

  Write · create_workspace_tags

• Reads a workspace's tags

  Lists the tags on a workspace.

  Try: “What tags does prod-network have?”

  Network · read_workspace_tags

• Applies a policy set to workspaces

  Attaches a policy set to one or more workspaces. Global policy sets cannot be attached to single workspaces.

  Try: “Attach the security policy set to prod-web.”

  Write · attach_policy_set_to_workspaces

• Lists a workspace's policy sets

  Lists the policy sets that apply to a workspace, both attached and global.

  Try: “Which policy sets govern prod-network?”

  Network · list_workspace_policy_sets

• Lists stacks

  Lists Terraform Stacks in an organisation, optionally by project or query.

  Try: “List the stacks in the Platform project.”

  Network · list_stacks

• Reads one stack

  Returns details of a Stack.

  Try: “Show me the stack named networking.”

  Network · get_stack_details

• Lists state versions

  Lists the saved state versions of a workspace.

  Try: “How many state versions does prod-network have?”

  Network · list_state_versions

• Reads a state version

  Returns a state version by ID, or the latest one for a workspace.

  Try: “Show the latest state version of prod-network.”

  Network · get_state_version

Watch out for

• A token lets it delete a variable and change workspaces

  With a token, delete_variable_in_variable_set is on even without ENABLE_TF_OPERATIONS, and so are the tools that create, edit and tag workspaces and start runs. Use a token limited to the organisation or workspaces you need. github.com

• ENABLE_TF_OPERATIONS adds delete and apply tools

  Setting it to true turns on delete_project, delete_team, delete_workspace_safely, force_unlock_workspace and action_run (approve and apply). It also lets create_run auto-approve and destroy. Leave it off unless you review every call. github.com

• All toolsets load by default

  The README says the default toolset is registry, but the code in the current release defaults the flag to all. A token therefore turns on every account tool unless you pass --toolsets registry. github.com

• Logs, plans and state can contain secrets

  get_plan_logs, get_apply_logs, get_plan_json_output and get_state_version return raw content from your infrastructure. The README warns the server may expose Terraform data to the client and model, so do not use untrusted clients. github.com

• Docker with a token puts it in your config file

  The Docker setup passes the token with -e in your client config. Keep that file private, or pass the token from the environment. github.com

Security advisories