mcp-server-terraform

A Model Context Protocol (MCP) server that lets Claude manage Terraform infrastructure through natural language.

Run plans, apply changes, inspect state, and diagnose failures — all from a Claude conversation.

What it does

Instead of switching to a terminal to run terraform plan, you can ask Claude:

"Plan the changes in /infra/staging and explain what will change"

"Apply it — but only if no resources will be destroyed"

"Show me all the outputs from the prod workspace"

"Something broke after the last apply — diagnose it"

The server translates these into real terraform CLI commands on your machine, with a built-in safety confirmation flow before any destructive operation runs.

Tools

Plan risk & cost summary

Every plan (and every apply preview) is analyzed via terraform show -json and annotated with a structured summary — destroyed resources are called out, and always-on resources that commonly cause bill shock are flagged with rough monthly costs:

── Plan Summary ──
+ 3 create, ~ 1 update, - 0 destroy, ± 0 replace

💸 EXPENSIVE — always-on resources being created:
   ⚠ aws_nat_gateway.main (~$32/month + data processing if left running)
   Remember to tf_destroy when you're done experimenting.

Cost-flagged resource types include NAT gateways, load balancers, EKS/AKS/GKE control planes, RDS/Cloud SQL instances, ElastiCache, Redshift, MSK, and Azure Firewall (~$900/month!).

Drift detection

tf_drift runs a refresh-only plan and reports resources that were changed outside Terraform (e.g. manually in the cloud console), with the changed attribute names and remediation options.

Audit logging

Set AUDIT_LOG_PATH to a file path and every tool call is appended as a JSON line with timestamp, tool name, outcome, and duration. Variable values are always redacted (db_password=<redacted>) — only names are logged.

Confirmation flow

tf_apply and tf_destroy use a two-step safety flow:

1. First call (no confirmed) → runs terraform plan, shows the diff, does nothing else
2. Second call (confirmed: true) → actually applies or destroys

Claude is instructed to never pass confirmed: true without first presenting the plan to you.

Prompt

The server exposes a /tf-diagnose prompt that guides Claude through a systematic 5-step diagnosis of plan or apply failures.

Prerequisites

• Node.js 18 or later
• Terraform CLI on your PATH
• Claude Desktop (or any MCP-compatible client)

Installation

No install needed — run it straight from npm:

npx @rajsir/mcp-server-terraform

Or, for development, from source

... View full README on GitHub