MCP server · Cloud and DevOps

Terraform MCP server

Lets an assistant look up current Terraform provider, module and policy docs and manage HCP Terraform workspaces, runs and variables.

Maintainer: HashiCorp (official)
Licence: MPL-2.0
Runs: Locally (docker)
Sign-in: Optional token
Registry version: 1.0.0 (updated 2026-06-10)
Last activity: 2026-10-13
Source: github.com/hashicorp/terraform-mcp-server Official docs

Overview

What it does

The Terraform MCP Server connects an assistant to the public Terraform Registry and, if you supply a token, to HCP Terraform or Terraform Enterprise. HashiCorp distributes it as a Docker image and documents both stdio and Streamable HTTP transports. With no token the default registry toolset still works, so the assistant can search providers, read resource documentation, find the latest provider and module versions and look up Sentinel policies.

Adding TFE_TOKEN (and TFE_ADDRESS for Terraform Enterprise) enables the terraform toolset: list organisations, projects and workspaces, inspect runs, plans and applies, manage variables and variable sets, and search private modules and providers. It is a good fit when you write Terraform with an assistant and want it to use real, current provider schemas instead of guessing. You can narrow tools with --toolsets or --tools, and HashiCorp warns not to use it with untrusted clients or models.

Tools

What the assistant can do

Provider tools: search providers, get provider details, capabilities and latest version
Module tools: search modules, get module details and latest version
Policy tools: search Sentinel policies and get policy details
HCP Terraform and Terraform Enterprise: organisations, projects, workspaces and runs
Plan and apply details, logs and JSON plan output
Variable and variable set management
Private registry modules and providers

Install

Install Terraform MCP server in your app

You need:

Docker
An HCP Terraform or Terraform Enterprise API token only for workspace and run tools

Run in your project. --scope local keeps the servers private to you in this project; use user for every project.

Terminal

claude mcp add --env TFE_TOKEN="${TFE_TOKEN}" --scope local terraform -- docker run -i --rm -e TFE_TOKEN hashicorp/terraform-mcp-server:1.3.0

Native Windows (PowerShell)

claude mcp add --env TFE_TOKEN="$env:TFE_TOKEN" --scope local terraform -- docker run -i --rm -e TFE_TOKEN hashicorp/terraform-mcp-server:1.3.0

Set TFE_TOKEN first, e.g. export TFE_TOKEN=… in your shell. The command saves the value, not the variable.

Project root. Commit it to share the servers with your team; each person sets the variables in their own shell.

.mcp.json

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "TFE_TOKEN",
        "hashicorp/terraform-mcp-server:1.3.0"
      ],
      "env": {
        "TFE_TOKEN": "${TFE_TOKEN}"
      }
    }
  }
}

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json · Windows: %APPDATA%\Claude\claude_desktop_config.json (Settings → Developer → Edit Config). Restart Claude after saving.

claude_desktop_config.json

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "TFE_TOKEN",
        "hashicorp/terraform-mcp-server:1.3.0"
      ],
      "env": {
        "TFE_TOKEN": "<TFE_TOKEN>"
      }
    }
  }
}

Claude Desktop doesn’t read variables in this file: replace <TFE_TOKEN> with the real values.
This file contains your keys once filled in. It lives in your user folder; never commit or share it.

In your project, or ~/.cursor/mcp.json for every project.

mcp.json

{
  "mcpServers": {
    "terraform": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "TFE_TOKEN",
        "hashicorp/terraform-mcp-server:1.3.0"
      ],
      "env": {
        "TFE_TOKEN": "${env:TFE_TOKEN}"
      }
    }
  }
}

In your workspace. VS Code asks for each secret the first time a server starts and stores it securely.

mcp.json

{
  "inputs": [
    {
      "type": "promptString",
      "id": "tfe-token",
      "description": "TFE_TOKEN",
      "password": true
    }
  ],
  "servers": {
    "terraform": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "TFE_TOKEN",
        "hashicorp/terraform-mcp-server:1.3.0"
      ],
      "env": {
        "TFE_TOKEN": "${input:tfe-token}"
      }
    }
  }
}

macOS/Linux: ~/.config/devin/mcp_config.json · Windows: %APPDATA%\devin\mcp_config.json. Read by the default Devin Local agent and by the legacy Cascade agent.

mcp_config.json

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "TFE_TOKEN",
        "hashicorp/terraform-mcp-server:1.3.0"
      ],
      "env": {
        "TFE_TOKEN": "${env:TFE_TOKEN}"
      }
    }
  }
}

Devin’s docs confirm ${env:…} references for the legacy Cascade agent; for the default Devin Local agent they only document them in OAuth settings. If a server can’t authenticate, check Devin’s MCP docs.

Want it alongside other servers? Open Terraform MCP Server in the MCP config generator and add the rest; it writes one file per app. The snippets follow the setup in the server’s README, checked on 2026-10-14.

Before you install

With TFE_TOKEN set, the server can read workspace state and variables and create runs; scope the token to what the assistant needs.
ENABLE_TF_OPERATIONS=true (off by default) gates only action_run (apply, discard, cancel), delete_workspace_safely, force_unlock_workspace, delete_project, delete_team and create_run’s auto_approve and is_destroy options. create_workspace and update_workspace work with any valid token.
A local MCP server runs with your user account’s permissions. Install it only from the source linked above. See how to choose a safe server.

Why it’s listed

Why we list it

HashiCorp’s own server keeps an assistant’s Terraform code in line with real registry docs, with risky operations off by default.

All MCP servers MCP config generator Guide: MCP servers in Claude Code Guide: what is MCP?

What it does

What the assistant can do

Install Terraform MCP server in your app

Before you install

Why we list it

More MCP servers