nwiizo/tfmcp

What it solves

tfmcp allows AI assistants to manage and operate Terraform workflows locally and via HCP Terraform/TFE. It bridges the gap between an LLM's ability to write code and the actual execution of infrastructure-as-code (IaC) by providing a secure, gated interface for planning, applying, and analyzing infrastructure changes.

How it works

It operates as a Model Context Protocol (MCP) server that exposes a wide array of Terraform CLI tools and API integrations to an AI client (like Claude Desktop). The system implements a "plan-then-apply" workflow where the AI must first generate a saved plan, review it (using analysis tools), and then apply that specific plan ID to ensure the AI doesn't execute arbitrary or unexpected changes.

Who it’s for

DevOps engineers and platform engineers who want to use AI assistants to automate infrastructure management, perform drift detection, and manage Terraform configurations with a safety-first approach.

Highlights

• Gated Execution: Requires specific environment variables (e.g., TFMCP_ALLOW_DANGEROUS_OPS) to enable apply and destroy operations.
• Plan-Based Workflow: Forces a sequence of preparation, planning, and review before any infrastructure is modified.
• Comprehensive Toolset: Includes tools for local Terraform operations, repository intelligence, registry lookups, and HCP Terraform/TFE management.
• Security-First: Features sensitive output redaction, audit logging, and resource limits to prevent accidental over-provisioning.
• Flexible Deployment: Can be installed via Cargo, Docker, or as a standalone binary.