Does registry lookup need a token?

No. Provider, module, and policy lookups against the public Terraform Registry work with zero credentials — that is the default `docker run` mode.

How do I manage HCP Terraform workspaces?

Set `TFE_TOKEN` (and `TFE_ADDRESS` for Terraform Enterprise). That unlocks workspace create/update/delete, variables, tags, and run triggering.

Can it run `terraform apply`?

It drives HCP Terraform runs but is designed to keep destructive apply under human control. Treat it as plan-and-review, not unattended apply.

Terraform

Name: Top MCPs — curated MCP directory
Creator: Top MCPs
License: https://creativecommons.org/licenses/by/4.0/

Official

Look up Terraform Registry providers and modules, and manage HCP Terraform workspaces from an AI agent.

Score 86(?)HashiCorpMPL-2.0 1.5kVerified Oct 1, 2026Top MCPs for Cloud & Infrastructure →

Install View on GitHub

Quick answer

What it does

Exposes Terraform Registry APIs (providers, modules, policies) and, with a token, HCP Terraform / Enterprise workspace management (create, update, delete, variables, tags, runs) as MCP tools.

Best for

Grounding generated HCL in real provider schemas
Looking up module inputs and outputs
HCP Terraform workspace + run management
Discovering resources and data sources

Not for

Unattended `terraform apply`
Cloud-console operations (use AWS/Azure MCP)

Source: top-mcps.com/mcp/terraform — verified Oct 2026

Setup recipe

Pick your client, then follow the three steps.

Install

claude_desktop_config.jsonjson

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server"
      ]
    }
  }
}

Paste under mcpServers. Fully quit and reopen Claude after editing.

CLI or .mcp.jsonshell

claude mcp add terraform -- docker run -i --rm hashicorp/terraform-mcp-server

Run from your repo. Commit .mcp.json to share with your team.

.cursor/mcp.jsonjson

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server"
      ]
    }
  }
}

Global path: ~/.cursor/mcp.json. Reload window after editing.

.vscode/mcp.jsonjsonc

{
  "servers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server"
      ]
    }
  }
}

VS Code uses the "servers" key (not "mcpServers").

~/.codeium/windsurf/mcp_config.jsonjson

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server"
      ]
    }
  }
}

Open via Cascade → hammer icon → Configure.

cline_mcp_settings.jsonjson

{
  "mcpServers": {
    "terraform": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "hashicorp/terraform-mcp-server"
      ]
    }
  }
}

Open via the Cline sidebar → MCP Servers → Edit.

~/.continue/config.jsonjson

{
  "experimental": {
    "modelContextProtocolServers": [
      {
        "transport": {
          "type": "stdio",
          "command": "docker",
          "args": [
            "run",
            "-i",
            "--rm",
            "hashicorp/terraform-mcp-server"
          ]
        }
      }
    ]
  }
}

Continue uses modelContextProtocolServers with a transport block.

~/.codex/config.tomlshell

# ~/.codex/config.toml
[mcp_servers.terraform]
command = "docker"
args = [
  "run",
  "-i",
  "--rm",
  "hashicorp/terraform-mcp-server",
]

Codex uses TOML. Each server is a [mcp_servers.<name>] subtable.

~/.config/zed/settings.jsonjsonc

{
  "context_servers": {
    "terraform": {
      "command": {
        "path": "docker",
        "args": [
          "run",
          "-i",
          "--rm",
          "hashicorp/terraform-mcp-server"
        ]
      }
    }
  }
}

Zed calls them "context_servers". Settings live-reload on save.

ChatGPT → Apps directorynone

Terraform doesn't ship a hosted HTTPS endpoint today. ChatGPT supports remote MCP servers only — to use this server in ChatGPT you'll need to deploy it to a public HTTPS URL first (e.g. via Cloudflare Workers or Vercel) or wait for an official remote build.

2
Set required secrets
No credentials required — this MCP runs over stdio without authentication.
3
Try a minimum working prompt
Minimum working prompt pending verification. Try any prompt from the MCP’s README once installed.

Tools & permissions

Tool	Description	Args	Side effects
`search_providers`	Search the Terraform Registry for providers.	—	Read
`get_provider_details`	Return documentation for a provider, resource, or data source.	—	Read
`get_provider_capabilities`	Return the resources and data sources a provider offers.	—	Read
`get_latest_provider_version`	Return a provider's latest published version.	—	Read
`search_modules`	Search the Terraform Registry for modules.	—	Read
`get_module_details`	Return inputs, outputs, and usage for a registry module.	—	Read
`get_latest_module_version`	Return a module's latest published version.	—	Read
`search_policies`	Search the registry for Sentinel policies.	—	Read
`get_policy_details`	Return the details of a Sentinel policy.	—	Read
`whoami`	Return the identity the TFE token belongs to. Requires TFE_TOKEN.	—	Read
`list_terraform_orgs`	List HCP Terraform organizations. Requires TFE_TOKEN.	—	Read
`list_workspaces`	List workspaces in an organization. Requires TFE_TOKEN.	—	Read
`get_workspace_details`	Return one workspace's configuration. Requires TFE_TOKEN.	—	Read
`create_workspace`	Create a workspace. Requires TFE_TOKEN.	—	Write
`update_workspace`	Update a workspace. Requires TFE_TOKEN.	—	Write
`list_workspace_variables`	List a workspace's variables. Requires TFE_TOKEN.	—	Read
`create_workspace_variable`	Create a workspace variable. Requires TFE_TOKEN.	—	Write
`create_variable_set`	Create a variable set. Requires TFE_TOKEN.	—	Write
`attach_variable_set_to_workspaces`	Attach a variable set to workspaces. Requires TFE_TOKEN.	—	Write
`create_run`	Queue a run on a workspace. Requires TFE_TOKEN.	—	Write
`list_runs`	List runs on a workspace. Requires TFE_TOKEN.	—	Read
`get_run_details`	Return one run. Requires TFE_TOKEN.	—	Read
`get_plan_details`	Return a plan's details. Requires TFE_TOKEN.	—	Read
`get_plan_json_output`	Return the machine-readable plan output. Requires TFE_TOKEN.	—	Read
`get_apply_details`	Return an apply's details. Requires TFE_TOKEN.	—	Read
`get_state_version`	Return a workspace state version. Requires TFE_TOKEN.	—	Read
`search_private_modules`	Search an organization's private module registry. Requires TFE_TOKEN.	—	Read
`list_teams`	List teams in an organization. Requires TFE_TOKEN.	—	Read
`grant_team_access`	Grant a team access to a workspace. Requires TFE_TOKEN.	—	Write

Security & scope

Access scope: Read + write
Sandbox: Runs over stdio or streamable-http. Registry search needs no credentials; HCP Terraform and Enterprise operations authenticate with a Terraform token whose org and workspace permissions bound what the tools can touch. HashiCorp's own README warns the server may expose Terraform data to the MCP client and LLM, and says not to use it with untrusted clients or models.
Gotchas: create_run queues real plan/apply runs — on an auto-apply workspace that is a live infrastructure change, not a dry run.
Workspace variables are readable through the tools and frequently contain secrets; scope the token to workspaces you are willing to expose.

Agent prompt pack

— copy into Claude, Cursor, or ChatGPT.

Paste into Claude, Cursor, or ChatGPT. Edit the [brackets] before sending.

Recommend the best MCP servers for [task: e.g. cloud & infrastructure work] in [client: Claude].

Constraints:
- Prefer tools that are [official | open-source | read-only] — pick what matters for my use case.
- Exclude MCPs that require [e.g. a paid plan, OAuth-only flows, remote-only transport].
- Return at most 3 picks, ranked.

For each pick include:
1. One-sentence rationale.
2. The ready-to-paste install snippet for my client.
3. Any required secrets I need to create before installing.

Cross-check the top-mcps.com listing: https://top-mcps.com/top-mcps-for-cloud-infrastructure

Compare Terraform against a real alternative. Swap the second MCP in [brackets] if you want a different match.

Compare Terraform MCP vs [AWS MCP] for the following job: [describe the job, e.g. "let an agent create GitHub issues on bug triage"].

Judge them on:
- Setup time and complexity (what a new user hits first).
- Auth model (none / API key / OAuth 2.1) and credential risk.
- Transport (stdio / Streamable HTTP / SSE) and where the server runs.
- Required secrets and the blast radius if they leak.
- Operational risk in an unattended agent loop.
- Which one is "good enough" for a weekend prototype vs. production.

End with one sentence: which should I pick for my scenario, which is: [my scenario].

References:
- https://top-mcps.com/mcp/terraform
- top-mcps.com listing for AWS

Asks the agent to install and verify. Works inside Claude Code, Cursor Agent, Codex CLI.

Install the Terraform MCP server for my [client: Claude] at the default config path for that client.

Use the exact install snippet published at https://top-mcps.com/mcp/terraform (fetch https://top-mcps.com/mcp/terraform.json for the canonical server.json if you can read URLs).

Before finishing:
1. Create the required secrets (no secrets) and put them in the appropriate env block — do not hard-code them.
2. Restart or reload the client so it picks up the new server.
3. Verify the server is connected (green / running state) and at least one tool is listed.
4. If anything fails, read the client's MCP logs and report the exact error — do not silently retry.

Confirm when done and list the tools the server now exposes.

Frequently asked questions

What changed

— 3 updates tracked.

Aug 4, 2026
v1.2.0 released
Jul 14, 2026
v1.1.0 released
Jun 9, 2026
v1.0.0 released

At a glance

Maintainer: HashiCorp
Transport: stdioStreamable HTTP
Auth model: None
Required secrets: None
Supported clients: ChatGPT
Claude Desktop
Claude Code
Cursor
VS Code
Windsurf
Cline
Continue
Zed
Codex CLI
License: MPL-2.0
Language: Go
Latest version: latest
Last verified: Oct 1, 2026

GitHub repo

Rank badge

Maintainer of Terraform? Embed the live badge — it re-renders with the current rank and score on every catalog refresh.

[![Ranked #2 in Cloud & Infrastructure on Top-MCPs](https://top-mcps.com/badge/terraform.svg)](https://top-mcps.com/mcp/terraform)

Alternatives

AWS →
AWS's own managed MCP server — run AWS APIs, execute sandboxed scripts, and search AWS documentation under IAM.
Cloudflare →
Reach the whole Cloudflare API from an agent — DNS records, Workers, R2, and the Registrar beta — through one hosted Code Mode server.
DigitalOcean →
Manage Droplets, App Platform, Kubernetes, and Spaces from an AI agent.

Related guides

Best MCPs for DevOps in 2026 (Ranked) →
Ranked Guide
MCP Registry vs Curated Directory: Which Should You Use? →
Strategy

More Cloud & Infrastructure MCPs

Other tools in the same category worth evaluating.

Supabase

Full Supabase access: database, auth, storage, and edge functions.

supabasedatabasebackendpostgres

5 minLow

Stripe

Official

Manage payments, customers, and subscriptions through Stripe.

stripepaymentsbillinginvoicing

5 minMedium

Cloudflare

Official

Reach the whole Cloudflare API from an agent — DNS records, Workers, R2, and the Registrar beta — through one hosted Code Mode server.

cloudflareedgeworkersdns

5 minMedium

Compared with Terraform

Side-by-side breakdowns for the choices people most often weigh against this MCP.

TerraformvsAWS TerraformvsCloudflare TerraformvsDigitalOcean TerraformvsKubernetes

Exploring Top MCPs for Cloud & Infrastructure? See all Cloud & Infrastructure MCPs →

Quick answer

What it does

Best for

Not for

Setup recipe

Install

Set required secrets

Try a minimum working prompt

Tools & permissions

Security & scope

Agent prompt pack

Full details

Frequently asked questions

Does registry lookup need a token?

How do I manage HCP Terraform workspaces?

Can it run `terraform apply`?

What changed

More Cloud & Infrastructure MCPs

Supabase

Stripe

Cloudflare

Compared with Terraform