nwiizo/tfmcp

*⚠️ This project includes production-ready security features but is still under active development. While the security system provides robust protection, please review all operations carefully in production environments. ⚠️*
tfmcp runs local Terraform workflows through the Model Context Protocol (MCP).
It helps AI assistants inspect a project, prepare execution, review a saved plan,
apply that same plan, and check the result. Registry and HCP/TFE tools support
these local workflows.
🎮 Demo
See tfmcp in action with Claude Desktop:
- Reading Terraform configuration files
- Analyzing Terraform plan outputs
- Applying Terraform configurations
- Managing Terraform state
- Creating and modifying Terraform configurations
🎉 Current Release
tfmcp v0.2.4 is the current release:
What's new in v0.2.4
- Reviewed destroy plans with the same saved-plan and permission checks as apply
- Saved-plan listing and disposal to reclaim the 64-plan capacity
- Retained apply results, failed/unknown outcomes, and recovery guidance
- Sensitive output redaction for both full and named output queries
- RMCP 3.5.0, updated dependencies and images, with the Rust 1.88 MSRV retained
Features
| Area | Capabilities |
| --- | --- |
| Local Terraform | Validate, format, plan/apply workflows, import guidance, outputs, providers, dependency graphs, refresh-only flows, and guarded state operations |
| Repository intelligence | Entrypoint/project detection, configuration analysis, quality checks, security checks, module health, plan review, and drift/state-safety inspection |
| Registry | Public/private provider, module, and policy lookup with HashiCorp-compatible aliases |
| HCP Terraform / TFE | Organizations, projects, workspaces, runs, plans, applies, variables, policy sets, variable sets, tags, stacks, and gated operations |
| MCP deployment | stdio and Streamable HTTP, MCP 2026-07-28 discovery, structured tool results, cache hints, toolsets, resources, health/metrics, sessions, Host/Origin validation, rate limits, TLS wiring, and audit logging |
| Packaging | Cargo, Docker/OCI metadata, MCP Registry metadata, Rust Edition 2024 |
Installation
From Source
From Crates.io
Using Docker
Requirements
- Rust 1.88.0+ (Rust Edition 2024)
- Terraform CLI 1.15.8 installed and available in PATH
- An MCP-compatible AI client (for example, Claude Desktop or Codex)
- Docker (optional, for containerized deployment)
Usage
Using Docker
When using Docker, you can run tfmcp commands like this:
Integrating with Claude Desktop
To use tfmcp with Claude Desktop:
1. If you haven't already, install tfmcp:
Alternatively, you can use Docker:
2. Find the path to your installed tfmcp executable:
3. Add the following configuration to ~/Library/Application\ Support/Claude/claude_desktop_config.json:
If you're using Docker with Claude Desktop, you can set up the configuration like this:
4. Restart Claude Desktop and enable the tfmcp tool.
5. tfmcp will automatically create a sample Terraform project in ~/terraform if one doesn't exist, ensuring Claude can start working with Terraform right away. The sample project is based on the examples included in the example/demo directory of this repository.
Local plan/apply workflow
Start with tfmcp --dir /path/to/project mcp --toolsets terraform.
The default toolset supports preparation and plan review; the terraform
toolset also exposes initialization and gated local writes.
1. Call prepare_terraform_change to inspect the selected directory, Terraform
version, workspace, backend, configuration validity, and state readability.
ready means the inspected prerequisites passed; input variables and provider
credentials are checked by the actual plan. Initialize with init_terraform
when required, then repeat preparation.
2. Call get_terraform_plan with {} or, for example,
{"var_files":["environment.tfvars"]}. The result includes a plan_id,
target, created_at, has_changes, and a redacted Terraform JSON plan string.
Use replace for resource replacement addresses or refresh_only:true to
preview drift without modifying state.
3. Pass the returned plan_id to analyze_plan, review_terraform_plan, and
summarize_plan_for_pr. These calls reuse the saved result. Omitting the ID
creates a new plan. A review decision is advisory and does not authorize apply.
4. After reviewing and approving the change, call apply_terraform with
{"plan_id":" ","auto_approve":true}. Both
TFMCP_ALLOW_DANGEROUS_OPS=true and TFMCP_ALLOW_AUTO_APPROVE=true must already