Terraform Cloud

You can manage Terraform Cloud resources through natural conversation by running a dedicated MCP server that exposes Terraform Cloud actions as chat-friendly tools. This server lets you view and modify accounts, workspaces, projects, runs, plans, applies, state versions, variables, and more, while keeping safety controls and auditability in place for production use.

How to use

Start the MCP server locally or on a hostable environment. Connect your MCP client (such as Claude Code CLI, Claude Desktop, Cursor, Copilot Studio, or another MCP-enabled platform) and point it at the running server. You can perform common Terraform Cloud operations through natural language prompts, for example: asking to list workspaces, create a project, start a run, view plan outputs, or retrieve cost estimates. When you enable destructive operations with the proper environment flag, you can also delete resources and modify configurations, but default safety settings disable destructive actions and require explicit approval.

How to install

Prerequisites you need before installing the MCP server are: Python 3.12 or higher, MCP tooling, and either the uv package manager or pip to install Python packages.

# Prerequisites
python3 --version
python3 -m venv .venv
source .venv/bin/activate  # or .venv\Scripts\activate on Windows

# Install in development mode (uses local code)
mcp dev terraform_cloud_mcp/server.py

# Alternatively, install in a lightweight local environment
uv venv
source .venv/bin/activate
uv pip install .

# Run in development mode (if you installed via MCP tooling)
mcp dev terraform_cloud_mcp/server.py

Configuration and security

You control access and safety through environment variables. The following flags are available to tailor safety for production use:

• TFC_TOKEN: Terraform Cloud API token (required for authentication)

• TFC_ADDRESS: Terraform Cloud or Enterprise address (defaults to https://app.terraform.io)

• ENABLE_DELETE_TOOLS: Enable destructive operations (default false)

• READ_ONLY_TOOLS: Enable only read-only operations (default false)

• ENABLE_RAW_RESPONSE: Return raw vs filtered responses (default false)

Troubleshooting

If you run into issues, check the server logs for debug information. The MCP Inspector can assist with debugging by inspecting your running MCP setup. Ensure the required environment variables are set and that the MCP server is reachable by your client.

Notes and examples

The server exposes a comprehensive set of TerraForm Cloud operations through a consistent MCP interface. Use the client’s conversation capabilities to perform tasks such as listing workspaces, creating projects, managing runs, and retrieving state or plan outputs. Remember to respect safety settings when enabling destructive actions in non-development environments.

Available tools

get_account_details

Gets account information for the authenticated user or service account.

list_workspaces

List and filter workspaces within an organization.

get_workspace_details

Get detailed information about a specific workspace.

create_workspace

Create a new workspace with optional parameters.

update_workspace

Update an existing workspace's configuration.

delete_workspace

Delete a workspace and all its content. Requires ENABLE_DELETE_TOOLS=true.

safe_delete_workspace

Delete a workspace only if it is not managing resources. Requires ENABLE_DELETE_TOOLS=true.

lock_workspace

Lock a workspace to prevent runs.

unlock_workspace

Unlock a workspace to allow runs.

force_unlock_workspace

Force unlock a workspace locked by another user.

create_run

Create and queue a Terraform run in a workspace.

list_runs_in_workspace

List runs in a specific workspace.

list_runs_in_organization

List runs across an organization.

get_run_details

Get details about a specific run.

apply_run

Apply a run awaiting confirmation.

discard_run

Discard a run awaiting confirmation.

cancel_run

Cancel a running or planned run.

force_cancel_run

Force cancel a running or pending run.

force_execute_run

Force execute a pending run by canceling prior runs.

get_plan_details

Get detailed information about a specific plan.

get_plan_json_output

Retrieve the JSON plan output with proper redirects.

get_run_plan_json_output

Retrieve the JSON plan for a run.

get_plan_logs

Retrieve logs from a plan operation.

get_apply_details

Get details about a specific apply.

get_errored_state

Retrieve errored state from a failed apply for recovery.

get_apply_logs

Retrieve logs from an apply operation.

create_project

Create a new project with optional parameters.

update_project

Update an existing project's configuration.

list_projects

List and filter projects in an organization.

get_project_details

Get detailed information about a specific project.

delete_project

Delete a project (fails if it contains workspaces). Requires ENABLE_DELETE_TOOLS=true.

list_project_tag_bindings

List tags bound to a project.

add_update_project_tag_bindings

Add or update tag bindings on a project.

move_workspaces_to_project

Move workspaces into a project.

get_organization_details

Get detailed information about an organization.

get_organization_entitlements

Show entitlements for an organization.

list_organizations

List and filter organizations.

create_organization

Create a new organization with optional parameters.

update_organization

Update an organization's settings.

delete_organization

Delete an organization and all its content. Requires ENABLE_DELETE_TOOLS=true.

get_cost_estimate_details

Get cost estimate details for infrastructure changes.

get_assessment_result_details

Get details about a health assessment result.

get_assessment_json_output

Retrieve the JSON output of an assessment.

get_assessment_json_schema

Retrieve the JSON schema for an assessment.

get_assessment_log_output

Retrieve logs from an assessment operation.

list_state_versions

List state versions in a workspace.

get_current_state_version

Get the current state version for a workspace.

get_state_version

Get details for a specific state version.

create_state_version

Create a new state version in a workspace.

download_state_file

Download the raw or JSON-formatted state file.

list_state_version_outputs

List outputs for a specific state version.

get_state_version_output

Get details for a specific state version output.

list_workspace_variables

List all variables for a workspace.

create_workspace_variable

Create a new variable in a workspace.

update_workspace_variable

Update an existing workspace variable.

delete_workspace_variable

Delete a workspace variable. Requires ENABLE_DELETE_TOOLS=true.

list_variable_sets

List variable sets in an organization.

get_variable_set

Get details for a specific variable set.

create_variable_set

Create a new variable set.

update_variable_set

Update an existing variable set.

delete_variable_set

Delete a variable set and all its variables. Requires ENABLE_DELETE_TOOLS=true.

assign_variable_set_to_workspaces

Assign a variable set to workspaces.

unassign_variable_set_from_workspaces

Remove a variable set from workspaces.

assign_variable_set_to_projects

Assign a variable set to projects.

unassign_variable_set_from_projects

Remove a variable set from projects.

list_variables_in_variable_set

List all variables in a variable set.

create_variable_in_variable_set

Create a variable in a variable set.

update_variable_in_variable_set

Update a variable in a variable set.

delete_variable_from_variable_set

Delete a variable from a variable set. Requires ENABLE_DELETE_TOOLS=true.