---
title: "Terraform MCP Server: Registry Docs and HCP Terraform"
url: "https://mcpshelf.co/servers/terraform"
description: "HashiCorp's server gives an assistant current provider and module docs from the Terraform Registry, plus HCP Terraform workspaces and runs. Docker setup."
updated: "2026-10-27"
site: "MCP Shelf"
---

# Terraform MCP Server

> Current Terraform provider and module docs for your assistant, plus HCP Terraform if you want it.

Source: https://mcpshelf.co/servers/terraform  
Markdown: https://mcpshelf.co/servers/terraform.md  
Generated: 2026-10-27T13:26:06.561Z

## Facts

- **Name:** Terraform MCP Server
- **Tagline:** Current Terraform provider and module docs for your assistant, plus HCP Terraform if you want it.
- **Description:** Terraform MCP Server is HashiCorp's server that gives an assistant current provider and module docs from the Terraform Registry, plus optional HCP Terraform workspaces and runs.
- **Repository:** https://github.com/hashicorp/terraform-mcp-server
- **Install:** `claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server:1.4.1`
- **Transport:** stdio (local)
- **Auth:** No required keys or settings listed
- **Tools exposed:** 61: `get_latest_module_version`, `get_latest_provider_version`, `get_module_details`, `get_policy_details`, `get_provider_capabilities`, `get_provider_details`, `search_modules`, `search_policies`, `search_provider_docs`, `action_run`, `add_team_member`, `create_no_code_workspace`, `create_project`, `create_run`, `create_team`, `create_workspace`, `delete_project`, `delete_team`, `delete_workspace_safely`, `force_unlock_workspace`, `get_apply_details`, `get_apply_logs`, `get_plan_details`, `get_plan_json_output`, `get_plan_logs`, `get_private_module_details`, `get_private_provider_details`, `get_project`, `get_run_comments`, `get_run_details`, `get_sentinel_mock`, `get_stack_details`, `get_state_version`, `get_team`, `get_token_permissions`, `get_workspace_details`, `grant_team_access`, `list_runs`, `list_stacks`, `list_state_versions`, `list_teams`, `list_terraform_orgs`, `list_terraform_projects`, `list_workspaces`, `attach_policy_set_to_workspaces`, `list_workspace_policy_sets`, `search_private_modules`, `search_private_providers`, `update_workspace`, `list_variable_sets`, `create_variable_set`, `create_variable_in_variable_set`, `delete_variable_in_variable_set`, `attach_variable_set_to_workspaces`, `detach_variable_set_from_workspaces`, `whoami`, `create_workspace_tags`, `read_workspace_tags`, `list_workspace_variables`, `create_workspace_variable`, `update_workspace_variable`
- **Category:** Cloud and operations (https://mcpshelf.co/categories/cloud-and-ops)
- **Stats:** 1.6K GitHub stars, 543 downloads a week, last commit 26 Oct 2026, 0 upvotes on MCP Shelf
- **Install check:** Needs your setup first
- **Listed:** 2026-10-27
- **Page updated:** 2026-10-27

## Full description

### What is Terraform MCP Server?

**Terraform MCP Server is HashiCorp's server that gives an assistant current provider and module docs from the Terraform Registry, plus optional HCP Terraform workspaces and runs.**

HashiCorp's own Terraform server looks things up in the public Terraform Registry so the model writes configuration against the provider version that exists today, not the one it remembers. It can search provider docs, read a resource's arguments, find modules and their inputs, and check the latest version of either. Policy libraries from the registry are searchable too.

With an HCP Terraform or Terraform Enterprise token it can go further: list and create workspaces, set variables and variable sets, start runs, and read plan and apply logs. Only the public registry tools are on by default. Tools that apply or discard runs, delete things or force-unlock a workspace stay off until you set ENABLE_TF_OPERATIONS.

|  |  |
| --- | --- |
| Made by | HashiCorp (hashicorp/terraform-mcp-server) |
| GitHub | https://github.com/hashicorp/terraform-mcp-server |
| Licence | MPL-2.0 |
| GitHub stars | 1.6K |
| Downloads | 543 a week |
| Last commit | 26 Oct 2026 |
| Tools | 61 |
| Runs on | Your computer |
| Install check | Needs your setup first |
| Category | [Cloud and operations](https://mcpshelf.co/categories/cloud-and-ops) |
| Setup checked | 27 Oct 2026 |
| Page updated | 27 Oct 2026 |

**Our check:** It needs something our Linux test machine does not have (an account, a desktop app, a Mac or a running service), so on 27 Oct 2026 we read its tools from the source code instead of running this config. The npm package called terraform-mcp-server is not published by HashiCorp. HashiCorp ships this server as a Docker image and a Go binary.

#### MCP Shelf take

> Terraform needs something our Linux test machine does not have (an account, an app or a service), so on 27 Oct 2026 we read its source and counted 61 tools. 39 of the 61 only read; the other 22 can change things. Other directories point at a package with the same name that belongs to someone else; the config on this page installs the real one. It sits 5th of 5 in its category on our shelf by GitHub stars (1.6K, with 543 downloads a week).

— MCP Shelf tests (numbers from our own runs), tested on 27 Oct 2026

### What tools does Terraform MCP Server have?

We listed 61 tools on 27 Oct 2026. 39 only read; the rest can change things or run commands.

| Tool | Kind | What it is for |
| --- | --- | --- |
| `get_latest_module_version` | reads | Returns the newest published version of a module. |
| `get_latest_provider_version` | reads | Returns the newest published version of a provider. |
| `get_module_details` | reads | Reads a module's inputs, outputs, dependencies and usage notes. |
| `get_policy_details` | reads | Reads one policy library and its rules. |
| `get_provider_capabilities` | reads | Summarises what a provider offers: resources, data sources, functions and guides. |
| `get_provider_details` | reads | Reads one provider doc page by its ID: arguments, attributes and examples. |
| `search_modules` | reads | Searches the public registry for modules and returns IDs to look up. |
| `search_policies` | reads | Searches the registry's policy libraries. |
| `search_provider_docs` | reads | Finds the provider doc pages for a service, such as a resource or data source, and returns their IDs. |
| `action_run` | runs | Applies, discards or cancels a run. Needs ENABLE_TF_OPERATIONS. |
| `add_team_member` | changes |  |
| `create_no_code_workspace` | changes |  |
| `create_project` | changes |  |
| `create_run` | runs | Starts a plan in a workspace. Applying it needs action_run. |
| `create_team` | changes |  |
| `create_workspace` | changes | Creates a workspace. |
| `delete_project` | changes |  |
| `delete_team` | changes |  |
| `delete_workspace_safely` | changes | Deletes a workspace only if it manages no resources. Needs ENABLE_TF_OPERATIONS. |
| `force_unlock_workspace` | changes | Unlocks a stuck workspace. Needs ENABLE_TF_OPERATIONS. |
| `get_apply_details` | reads |  |
| `get_apply_logs` | reads | Reads the log of an apply. |
| `get_plan_details` | reads |  |
| `get_plan_json_output` | reads | Reads a plan as structured JSON, resource by resource. |
| `get_plan_logs` | reads | Reads the log of a plan. |
| `get_private_module_details` | reads | Reads a private module's inputs, outputs and versions. |
| `get_private_provider_details` | reads |  |
| `get_project` | reads |  |
| `get_run_comments` | reads |  |
| `get_run_details` | reads | Reads a run's status, plan and apply. |
| `get_sentinel_mock` | reads |  |
| `get_stack_details` | reads |  |
| `get_state_version` | reads |  |
| `get_team` | reads |  |
| `get_token_permissions` | reads |  |
| `get_workspace_details` | reads | Reads a workspace's settings, variables and latest run. |
| `grant_team_access` | changes |  |
| `list_runs` | reads | Lists the runs in a workspace, with filters. |
| `list_stacks` | reads |  |
| `list_state_versions` | reads | Lists a workspace's state versions. |
| `list_teams` | reads |  |
| `list_terraform_orgs` | reads | Lists the organisations the token can see. |
| `list_terraform_projects` | reads |  |
| `list_workspaces` | reads | Lists or searches the workspaces in an organisation. |
| `attach_policy_set_to_workspaces` | changes |  |
| `list_workspace_policy_sets` | reads |  |
| `search_private_modules` | reads | Searches the private registry of your HCP Terraform or Terraform Enterprise organisation. |
| `search_private_providers` | reads |  |
| `update_workspace` | changes | Changes a workspace's settings. |
| `list_variable_sets` | reads | Lists the variable sets in an organisation. |
| `create_variable_set` | changes |  |
| `create_variable_in_variable_set` | changes |  |
| `delete_variable_in_variable_set` | changes |  |
| `attach_variable_set_to_workspaces` | changes |  |
| `detach_variable_set_from_workspaces` | changes |  |
| `whoami` | reads | Shows which user or team the token belongs to. |
| `create_workspace_tags` | changes |  |
| `read_workspace_tags` | reads |  |
| `list_workspace_variables` | reads | Lists a workspace's variables. |
| `create_workspace_variable` | changes | Adds a variable to a workspace. |
| `update_workspace_variable` | changes |  |

#### Tool groups

| Group | Covers |
| --- | --- |
| `registry` | The 9 public registry tools for providers, modules and policies. On by default and needs no token. |
| `registry-private` | Searching and reading private modules and providers in your organisation. Needs a token. |
| `terraform` | About 50 tools for organisations, projects, teams, workspaces, variables, runs, plans, applies, stacks and state. Needs a token. |

### How do I install Terraform MCP Server?

#### What you need first

- Docker, or Go to install the binary yourself
- Nothing else for the public registry tools
- An HCP Terraform or Terraform Enterprise API token for workspace and run tools

#### Claude Code

Where: Your terminal

```bash
claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server:1.4.1
```

This adds it for every project with the public registry tools. For HCP Terraform, add -e TFE_TOKEN=your-token before the image name and --toolsets=all after it.

#### Cursor

Where: ~/.cursor/mcp.json, or .cursor/mcp.json in a project

```json
{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

#### Claude Desktop

Where: claude_desktop_config.json (Settings → Developer → Edit Config)

```json
{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

#### VS Code

Where: .vscode/mcp.json in your project

```json
{
  "servers": {
    "terraform": {
      "type": "stdio",
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

HashiCorp's VS Code example asks for TFE_TOKEN and TFE_ADDRESS as inputs, so the token is not saved in the file. Leave both empty for registry lookups only.

#### Windsurf

Where: ~/.codeium/windsurf/mcp_config.json

```json
{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

#### ChatGPT

Where: Not supported

ChatGPT only connects to remote servers by URL. This one runs on your computer, so use Claude, Cursor or VS Code.

This starts the public registry tools only. For HCP Terraform, add "-e", "TFE_TOKEN" (and "-e", "TFE_ADDRESS" for Terraform Enterprise) before the image name, put the values in "env", and pass --toolsets=all after the image. Without Docker, run go install github.com/hashicorp/terraform-mcp-server/cmd/terraform-mcp-server@latest and use "terraform-mcp-server" with the argument "stdio".

Checked against the project's own install docs on 27 Oct 2026: https://github.com/hashicorp/terraform-mcp-server#readme, https://developer.hashicorp.com/terraform/mcp-server

### How do I configure Terraform MCP Server?

| Setting | Kind | Required | What it does |
| --- | --- | --- | --- |
| `--toolsets` | flag | no | Which groups of tools to load: registry, registry-private, terraform, all or default. Default is registry only. Example: `--toolsets=registry,terraform` |
| `--tools` | flag | no | Load named tools instead of whole groups. Cannot be combined with --toolsets. Example: `--tools=search_modules,get_module_details` |
| `TFE_TOKEN` | env | no | An HCP Terraform or Terraform Enterprise API token. Needed for every tool outside the public registry. |
| `TFE_ADDRESS` | env | no | The address of your Terraform Enterprise install, with https://. Leave it unset for HCP Terraform. Example: `https://tfe.example.com` |
| `ENABLE_TF_OPERATIONS` | env | no | Set to true to load the tools that apply or discard runs, delete projects, teams or workspaces, and force an unlock. Example: `true` |
| `TFE_SKIP_TLS_VERIFY` | env | no | Skips certificate checks against Terraform Enterprise. Only for a test install with a self-signed certificate. |
| `TRANSPORT_MODE` | env | no | Set to streamable-http to serve over HTTP instead of stdio. TRANSPORT_HOST and TRANSPORT_PORT set where it listens. Example: `streamable-http` |

### What can Terraform MCP Server read and change?

**It can read**

- Public provider, module and policy docs on registry.terraform.io
- With a token: workspaces, variables, runs, plans, logs and state in your organisation

**It can change**

- With a token: workspaces, projects, teams, variables, tags and new runs
- With ENABLE_TF_OPERATIONS: applies and discards runs, deletes and unlocks

**Safer setup:** Run it without a token for registry lookups only. When you add a token, use one with read access, or a team token limited to the workspaces you want the model to see, and leave ENABLE_TF_OPERATIONS off.

### Good for

- Writing Terraform for a provider resource you have not used before
- Picking a registry module and seeing its inputs and outputs
- Reading the plan logs of a failed HCP Terraform run

### Terraform MCP Server not working? Common fixes

**Certificate errors behind a corporate proxy such as Zscaler**
Mount your company's CA certificate into the container and point SSL_CERT_FILE at it, or install it in the system store if you run the binary.

**Only registry tools show up**
That is the default. Pass --toolsets=all after the image name and set TFE_TOKEN.

**The apply and delete tools are missing**
They load only when ENABLE_TF_OPERATIONS is true, as well as a token being set.

**docker: command not found in the client log**
Install Docker Desktop and make sure it is running, or install the Go binary and use terraform-mcp-server stdio instead.

### What are the alternatives to Terraform MCP Server?

| Server | What it does | Tools | Runs on | Licence | Stars |
| --- | --- | --- | --- | --- | --- |
| [Terraform MCP Server](https://mcpshelf.co/servers/terraform) | Current Terraform provider and module docs for your assistant, plus HCP Terraform if you want it. | 61 | Your computer | MPL-2.0 | 1.6K |
| [AWS Knowledge MCP Server](https://mcpshelf.co/servers/aws-knowledge) | AWS's free hosted server for current AWS docs, API references and region checks. | 5 | Hosted | Apache-2.0 | 9.8K |
| [Cloudflare MCP Servers](https://mcpshelf.co/servers/cloudflare) | Cloudflare's own hosted servers, starting with a docs search that needs no sign-in. | 2 | Hosted | Apache-2.0 | 4.4K |
| [Grafana MCP](https://mcpshelf.co/servers/grafana) | Dashboards, metrics, logs, alerts and incidents from your Grafana, in one server. | 62 | Your computer | Apache-2.0 | 3.6K |
| [Azure DevOps MCP](https://mcpshelf.co/servers/azure-devops) | Microsoft's server for Azure DevOps boards, repos, pipelines, wikis and test plans. | 44 | Hosted or your computer | MIT | 2.1K |

### Terraform MCP Server FAQ

#### How do I add the Terraform MCP Server to Claude Code?

With Docker running, run claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server:1.4.1. That gives the registry tools in every project.

#### How do I use the Terraform MCP Server in Cursor or VS Code?

Add an entry that runs docker run -i --rm with the hashicorp/terraform-mcp-server image. For HCP Terraform, pass TFE_TOKEN into the container and add --toolsets=all after the image name.

#### Do I need an HCP Terraform account?

No. The public registry tools work with no account and no token. A token only adds the workspace, variable and run tools.

#### Can the Terraform MCP Server run terraform plan on my laptop?

No. It does not run the Terraform CLI locally. Runs it starts happen in HCP Terraform or Terraform Enterprise, and it reads their plan and apply logs.

#### Can it apply or destroy infrastructure?

Only if you allow it. Applying or discarding runs, deleting workspaces and force-unlocking stay off until ENABLE_TF_OPERATIONS is true and a token is set.

#### Is the npm package called terraform-mcp-server the same thing?

No. HashiCorp publishes this server as a Docker image and a Go binary, not on npm. Use the hashicorp/terraform-mcp-server image.

#### Does it work with ChatGPT?

Not directly. It runs on your machine, and ChatGPT only connects to remote servers by URL. HashiCorp documents an HTTP mode for hosting it yourself, but that needs your own public endpoint.

#### Is the Terraform MCP Server free?

Yes. The server is open source under MPL-2.0. HCP Terraform, if you connect it, has its own plans.

Full docs on GitHub: https://github.com/hashicorp/terraform-mcp-server

## Notes for agents

Fetch these instead of parsing the HTML page:

- llms.txt: https://mcpshelf.co/llms.txt
- llms-full.txt: https://mcpshelf.co/llms-full.txt
- ai.txt: https://mcpshelf.co/ai.txt
- Full catalog (.md): https://mcpshelf.co/catalog.md
- API spec: https://mcpshelf.co/openapi.json
- MCP server: https://mcpshelf.co/mcp
- MCP manifest: https://mcpshelf.co/.well-known/mcp.json
- Developer docs: https://mcpshelf.co/developers

MCP endpoint (Streamable HTTP, no key): https://mcpshelf.co/mcp. REST API: https://mcpshelf.co/api/v1.