LukasNiessen/terrashark

What it solves

TerraShark addresses the tendency of Large Language Models (LLMs) to hallucinate when generating Terraform and OpenTofu code. It prevents common infrastructure-as-code (IaC) errors such as unstable identity, leaked secrets, excessive blast radius, CI drift, and weak compliance gates by providing a structured diagnostic workflow and optimized reference material.

How it works

Instead of dumping massive amounts of documentation into the AI's context, TerraShark implements a "failure-mode workflow" that guides the agent through seven steps:

1. Context Capture: Identifies runtime, providers, and risk levels.
2. Diagnosis: Identifies likely failure modes before generating code.
3. Targeted Loading: Pulls only the specific reference files needed for the diagnosed risk.
4. Proposal: Suggests a fix path with explicit risk controls.
5. Generation: Creates the HCL changes or migration blocks.
6. Validation: Runs a command sequence to check the implementation.
7. Structured Output: Delivers the final result with assumptions, tradeoffs, and rollback notes.

It also utilizes "Trusted Module Awareness," preferring mature vendor and community modules (AWS, Azure, GCP, OCI, IBM) over hand-rolled resource blocks to further reduce hallucination surfaces.

Who it’s for

DevOps engineers and developers using AI agents like Claude Code, Codex, Antigravity, or Gemini CLI to manage infrastructure via Terraform or OpenTofu.

Highlights

• Token Efficiency: Uses a lean activation path (~600 tokens) and granular reference files to minimize token burn.
• Failure-Mode First: Forces the AI to diagnose risks before writing code.
• Compliance Mapping: Includes explicit mappings for ISO 27001, SOC 2, FedRAMP, GDPR, PCI DSS, and HIPAA.
• Output Contract: Ensures every response includes assumptions, remediation choices, and rollback instructions.
• Multi-Agent Support: Compatible with Claude Code, Codex, Antigravity, and Gemini CLI.