# Terraform — MCP Server

> Look up real provider and module docs before writing HCL.

**Source:** https://mcpplaygroundonline.com/mcp-servers/terraform  
**Transport:** stdio  
**Requires auth:** No

---

## What it does

The Terraform MCP server is a documentation and registry tool first. An agent searches for a provider, resolves it to a concrete version, and pulls the actual documentation for a resource or data source before it writes a single line of HCL — which is the difference between generated configuration that plans cleanly and configuration that fails on an unknown argument. The same search-then-fetch pattern covers registry modules and Sentinel policies. Beyond the public registry, setting a TFE address and token unlocks the HCP Terraform and Terraform Enterprise APIs, so an agent can list organizations and workspaces, inspect runs and read state versions. It runs over stdio for local clients and can also be started in streamable-HTTP mode when you want to host it for a team.

## Tools exposed

- search_providers — find a provider in the registry and resolve a documentation ID
- get_provider_details — the real documentation for a resource or data source at a version
- search_modules / get_module_details — registry modules, their inputs and outputs
- get_latest_provider_version / get_latest_module_version — pin against what actually exists
- search_policies / get_policy_details — Sentinel policy libraries from the registry
- HCP Terraform tools — organizations, workspaces, runs and state versions with a TFE token

## Example queries you can run

- "What are the required arguments for aws_ecs_service in the latest AWS provider?"
- "Find a registry module for a VPC with private subnets and show me its inputs."
- "Write a Terraform config for a Cloudflare DNS record, checking the real docs first."
- "Which of my HCP Terraform workspaces have runs that errored this week?"

## Details

- **Recommended model:** anthropic/claude-sonnet-4.5 — Writing HCL against fetched documentation is a code-generation task with a verification step. Sonnet 4.5 reliably reads the docs before it writes rather than after.
- **Transport:** stdio
- **Authentication:** Not required — No credentials for public registry lookups. Add TFE_TOKEN and TFE_ADDRESS to reach HCP Terraform or Terraform Enterprise workspaces and runs.
- **Official source:** [hashicorp/terraform-mcp-server — official repository](https://github.com/hashicorp/terraform-mcp-server)

## Connecting to Terraform

### Environment variables

- `TFE_ADDRESS` — Base URL of your HCP Terraform or Terraform Enterprise instance. Defaults to app.terraform.io.
- `TFE_TOKEN` — API token for HCP Terraform or Terraform Enterprise. Required only for the workspace, run and state tools.
- `TRANSPORT_MODE` — Set to http to run the server in streamable-HTTP mode instead of stdio, for hosting it centrally.

### Client configuration

**Docker (recommended)**

HashiCorp publishes the image; nothing to install on the host beyond Docker itself.

```
{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "hashicorp/terraform-mcp-server"]
    }
  }
}
```

**With HCP Terraform access**

Adds the workspace, run and state-version tools on top of the public registry lookups.

```
{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "TFE_ADDRESS", "-e", "TFE_TOKEN",
        "hashicorp/terraform-mcp-server"
      ],
      "env": {
        "TFE_ADDRESS": "https://app.terraform.io",
        "TFE_TOKEN": "YOUR_TOKEN"
      }
    }
  }
}
```

## Frequently asked questions

### What is the Terraform MCP server?

It is HashiCorp’s official MCP server for the Terraform ecosystem. It gives an AI agent live access to Terraform Registry provider documentation, modules and policies, and optionally to HCP Terraform or Terraform Enterprise workspaces and runs.

### Does it run terraform plan or apply?

Not against your local working directory. The public tools are registry lookups, and the HCP Terraform tools read organizations, workspaces, runs and state versions through the API. It is a research and inspection server, not a local execution wrapper.

### Why does this reduce hallucinated Terraform code?

Because the model stops guessing. A provider’s arguments change between versions, and a model trained months ago will confidently produce an attribute that was renamed or never existed. Resolving the provider version and fetching the real documentation removes that whole failure mode.

### Do I need a HashiCorp account?

Not for registry lookups, which are public and need no credentials. A TFE token is only required for the HCP Terraform and Terraform Enterprise tools.

### Can I host it for a whole team?

Yes. Setting TRANSPORT_MODE to http starts the server in streamable-HTTP mode, so one instance can serve many clients instead of every developer running their own stdio process.

---

_Test this server across 40+ models on MCP Playground: https://mcpplaygroundonline.com/mcp-servers/terraform — free, no install._