HashiCorp Terraform Registry & Cloud

hashicorp

Search the Terraform Registry for providers, modules, and policies, and manage HCP Terraform / Enterprise workspaces via the official Terraform MCP server.

Installs: 1.4k
Namespace: hashicorp-terraform
Version: >=1.0.0 <2.0.0
Last attach: reviewed1 months ago

Add to your mcp.json

{
  "mcpServers": {
    "hashicorp-terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "TFE_TOKEN",
        "-e",
        "TFE_ADDRESS",
        "hashicorp/terraform-mcp-server"
      ]
    }
  }
}

Open in VS CodeDon't have it? Install FrootAI for VS Code

Attach in a FrootAI play (fai-manifest)

mcp_scope:
  attached:
    - hashicorp-terraform

Authentication

noneapi-token

no credentials needed for the public Terraform Registry tools; for HCP Terraform / Enterprise workspace tools set TFE_TOKEN (and TFE_ADDRESS for self-hosted TFE).

No credentials required.

Environment variables

Variable	Required	Auth mode	Description
TFE_TOKEN	no	api-token	HCP Terraform / Terraform Enterprise API token. Only needed for the workspace and private-registry tools; the public Registry tools work without it. Pass via env, never inline in args (doctrine #6).
TFE_ADDRESS	no	any	HCP Terraform or Terraform Enterprise address (default https://app.terraform.io).
TFE_SKIP_TLS_VERIFY	no	any	Set to `true` to skip HCP/TFE TLS verification. Development/testing only.
ENABLE_TF_OPERATIONS	no	any	Set to `true` to enable mutating workspace tools that require explicit approval (create/update/delete workspace, runs). Off by default.

Sample tools

hashicorp-terraform.search_providers
Search the Terraform Registry for providers matching a query.
hashicorp-terraform.get_provider_details
Get documentation and details for a Terraform provider.
hashicorp-terraform.search_modules
Search the Terraform Registry for modules.
hashicorp-terraform.get_module_details
Get details for a Terraform Registry module.
hashicorp-terraform.search_policies
Search the Terraform Registry for Sentinel policies.
hashicorp-terraform.list_workspaces
List HCP Terraform / Enterprise workspaces (requires TFE_TOKEN).

Destructive-action audit

1 destructive tool — confirm per call

Each runs only when the trust policy allows it; under allowDestructive: false they prompt per call.

hashicorp-terraform.delete_workspace

Destructive-action audit (X2.18): delete_workspace is flagged in `destructive_tools` (and additionally gated behind ENABLE_TF_OPERATIONS); blocked when the trust policy sets allowDestructive:false.

Known limitations

Public Terraform Registry tools (providers, modules, policies) need no auth; HCP Terraform / Terraform Enterprise workspace tools require an API token (TFE_TOKEN) and TFE_ADDRESS.
Distributed as a Docker image (hashicorp/terraform-mcp-server) — Docker must be installed and running; a Go binary is also installable from source.
Workspace mutation tools (create/update/delete workspace, runs) are gated behind ENABLE_TF_OPERATIONS=true and are off by default.

Spec contributors

Maintainers who landed commits onmcp-specs/hashicorp-terraform.json.

pspsbali

Freshness

When this spec was last reviewed by a maintainer and last machine-validated against the live server.

Spec last reviewed: 1 months ago(2026-06-25)
Auto-validated: never