severity1/terraform-cloud-mcp

A Model Context Protocol (MCP) server that integrates AI assistants with the Terraform Cloud API, allowing you to manage your infrastructure through natural conversation. Built with Pydantic models and structured around domain-specific modules, this server is compatible with any MCP-supporting platform including Claude, Claude Code CLI, Claude Desktop, Cursor, Copilot Studio, and others.
---
Features
- **Account Management**: Get account details for authenticated users or service accounts.
- **Workspace Management**: Create, read, update, lock/unlock workspaces, and optionally delete workspaces (with safety controls).
- **Project Management**: Create, list, update projects, and optionally delete projects; manage project tag bindings and move workspaces between projects.
- **Run Management**: Create runs, list runs, get run details, apply/discard/cancel runs.
- **Plan Management**: Retrieve plan details and JSON execution output with advanced HTTP redirect handling.
- **Apply Management**: Get apply details and recover from failed state uploads.
- **Organization Management**: List, create, update organizations, view organization entitlements, and optionally delete organizations (with safety controls).
- **Cost Estimation**: Retrieve detailed cost estimates for infrastructure changes including proposed monthly costs, prior costs, resource counts, and usage projections.
- **Assessment Results**: Retrieve health assessment details, JSON output, schema files, and logs from Terraform Cloud health assessments.
- **State Version Management**: List, retrieve, create, and download state versions; get current state for workspaces.
- **State Version Outputs**: List and retrieve specific outputs from state versions including values and sensitivity information.
- **Variables Management**: Complete workspace variable and variable set management including creation, updates, assignments, and optionally deletion (with safety controls).
Performance Features
- **Audit-Safe Response Filtering**: Conservative token optimization (5-15% reduction) with 100% audit compliance - preserves all user accountability, security configuration, and change tracking data for comprehensive compliance scenarios.
Safety Features
- **Destructive Operation Controls**: Delete operations are disabled by default and require explicit enablement via environment variable
- **Read-Only Mode**: All write operations can be disabled with READ_ONLY_TOOLS=true for maximum safety in production environments
- **Destructive Hints**: MCP clients receive proper destructive operation warnings for potentially dangerous tools
- **Environment-Based Safety**: Production and development environments can have different safety configurations
---
Quick Start
Prerequisites
- Python 3.12+
- MCP (includes FastMCP and development tools)
- uv package manager (recommended) or pip
- Terraform Cloud API token
Creating a Terraform Cloud API Token
To use this MCP server, you need a Terraform Cloud (or Terraform Enterprise) API token:
1. Sign in to HCP Terraform (or your Terraform Enterprise instance)
2. Click your avatar in the top-right corner and select **User Settings**
3. Navigate to **Tokens** in the left sidebar
4. Click **Create an API token**
5. Provide a description (e.g., "MCP Server")
6. Set an expiration date (recommended for security)
7. Click **Generate token**
8. **Copy the token immediately** - it will only be shown once
Use this token as your TFC_TOKEN environment variable in the configuration steps below.
For more information about API token types and permissions, see the HCP Terraform API Tokens documentation.
Environment Variables
- TFC_TOKEN - Terraform Cloud API token (required)
- TFC_ADDRESS - Terraform Cloud/Enterprise address (optional, defaults to https://app.terraform.io)
- ENABLE_DELETE_TOOLS - Enable/disable destructive operations (optional, defaults to false)
- READ_ONLY_TOOLS - Enable only read-only operations (optional, defaults to false)
- ENABLE_RAW_RESPONSE - Return raw vs filtered responses (optional, defaults to false)