RajeevSirohi/mcp-server-terraform

A Model Context Protocol (MCP) server that lets Claude manage Terraform infrastructure through natural language.
> Run plans, apply changes, inspect state, and diagnose failures — all from a Claude conversation.
What it does
Instead of switching to a terminal to run terraform plan, you can ask Claude:
> "Plan the changes in /infra/staging and explain what will change"
> "Apply it — but only if no resources will be destroyed"
> "Show me all the outputs from the prod workspace"
> "Something broke after the last apply — diagnose it"
The server translates these into real terraform CLI commands on your machine, with a built-in safety confirmation flow before any destructive operation runs.
Tools
| Tool | Description | Destructive |
|------|-------------|-------------|
| tf_init | Initialize a Terraform working directory | No |
| tf_validate | Validate configuration syntax | No |
| tf_plan | Run a plan and return the diff + risk/cost summary | No |
| tf_apply | Apply changes (requires confirmed: true) | Yes |
| tf_destroy | Destroy infrastructure (requires confirmed: true) | Yes |
| tf_output | Read output values from state | No |
| tf_state | List, show, move, or remove state entries | Partial |
| tf_workspace | List, show, select, or create workspaces | No |
| tf_preflight | Check provider CLI authentication before running | No |
| tf_drift | Detect resources changed outside Terraform | No |
| tf_resource | Import, taint, untaint, or refresh resources | Yes |
Plan risk & cost summary
Every plan (and every apply preview) is analyzed via terraform show -json and
annotated with a structured summary — destroyed resources are called out, and
always-on resources that commonly cause bill shock are flagged with rough
monthly costs:
Cost-flagged resource types include NAT gateways, load balancers, EKS/AKS/GKE
control planes, RDS/Cloud SQL instances, ElastiCache, Redshift, MSK, and
Azure Firewall (~$900/month!).
Drift detection
tf_drift runs a refresh-only plan and reports resources that were changed
outside Terraform (e.g. manually in the cloud console), with the changed
attribute names and remediation options.
Audit logging
Set AUDIT_LOG_PATH to a file path and every tool call is appended as a JSON
line with timestamp, tool name, outcome, and duration. Variable **values** are
always redacted (db_password= ) — only names are logged.
Confirmation flow
tf_apply and tf_destroy use a two-step safety flow:
1. **First call** (no confirmed) → runs terraform plan, shows the diff, does nothing else
2. **Second call** (confirmed: true) → actually applies or destroys
Claude is instructed to never pass confirmed: true without first presenting the plan to you.
Prompt
The server exposes a /tf-diagnose prompt that guides Claude through a systematic 5-step diagnosis of plan or apply failures.
Prerequisites
- Node.js 18 or later
- Terraform CLI on your PATH
- Claude Desktop (or any MCP-compatible client)
Installation
No install needed — run it straight from npm:
Or, for development, from source:
Claude Desktop setup
Add to your Claude Desktop config file:
**macOS**: ~/Library/Application Support/Claude/claude_desktop_config.json
**Windows**: %APPDATA%\Claude\claude_desktop_config.json
(If running from source instead, use "command": "node" with "args": ["/absolute/path/to/dist/index.js"].)