Terraform MCP Server for Automated IaC Workflows

Overview

The Terraform MCP (Model Context Protocol) Server is a companion service designed to integrate with Terraform-based workflows to enable advanced orchestration and automation. It implements the MCP pattern used to host long‑running operations, contextual execution logic, and external integrations that are cumbersome to implement directly in Terraform configurations or CI pipelines. By running an MCP server alongside your Terraform stacks, you can centralize orchestration logic, provide consistent APIs for automation, and attach governance or hooks that respond to Terraform actions.

This server is useful in environments that require automated plan/apply pipelines, environment promotion, approval gates, or integrations with chat/issue systems and secrets stores. It acts as a bridge between Terraform and external systems, making it easier to schedule operations, collect metadata, and audit or replay actions across teams and environments.

Features

• Integrates with Terraform workflows using the MCP approach for offloaded orchestration
• Exposes an API for triggering, monitoring, and managing Terraform runs and related operations
• Pluggable authentication and authorization for secure access control
• Configurable hooks for approvals, notifications, and external system integrations
• Audit logging and operation metadata to support compliance and traceability
• CLI and container-friendly deployment options for CI/CD and cloud platforms
• Extensible configuration to support multi-environment and multi-account orchestration

Installation / Configuration

The MCP server can be run from source, as a compiled binary, or inside a container. Below are example steps for common workflows. Adapt paths and flags to match releases from the project repository: https://github.com/hashicorp/terraform-mcp-server

1. Clone and build from source (Go required)

git clone https://github.com/hashicorp/terraform-mcp-server.git
cd terraform-mcp-server
# build binary (example; repo may provide a Makefile)
go build -o terraform-mcp-server ./cmd/server

2. Run the server with a minimal YAML configuration (example)

# config.yml
server:
  address: "0.0.0.0:8080"
auth:
  type: "token"
  tokens:
    - "example-token-abc123"
storage:
  backend: "local"
  path: "/var/lib/terraform-mcp"
hooks:
  notifications:
    enabled: true
    webhook_url: "https://hooks.example.com/notify"

Start the server:

./terraform-mcp-server --config config.yml

3. Container (example Dockerfile) — build locally if an image isn’t published:

FROM golang:1.20 AS build
WORKDIR /src
COPY . .
RUN go build -o /bin/terraform-mcp-server ./cmd/server

FROM debian:bookworm-slim
COPY --from=build /bin/terraform-mcp-server /usr/local/bin/terraform-mcp-server
CMD ["/usr/local/bin/terraform-mcp-server", "--config", "/etc/mcp/config.yml"]

Run container:

docker build -t terraform-mcp-server:local .
docker run -v /host/config.yml:/etc/mcp/config.yml -p 8080:8080 terraform-mcp-server:local

4. Example Terraform provider configuration (how Terraform might point at the MCP server)

provider "mcp" {
  endpoint = "http://mcp.example.internal:8080"
  token    = "example-token-abc123"
}

Note: The exact provider block and attributes depend on the Terraform integration you use; consult the repository’s examples for the canonical provider schema.

Configuration reference (quick table)

Available Resources

• Project repository: https://github.com/hashicorp/terraform-mcp-server
• Issues & discussions: use the repo’s Issues/Discussions for troubleshooting and Q&A
• Examples folder: look for examples/ in the repo for sample Terraform and server configs
• API docs: check the docs/ directory or generated OpenAPI/gRPC protos in the repo for request/response schemas
• CI templates: reference the repository for sample pipeline integrations (GitHub Actions, GitLab CI)

Use Cases

1. Automated PR-driven apply pipeline

   • When a pull request merges into main, CI triggers a run that calls the MCP server to queue a workspace apply. The server sequences runs, applies approval policies, and records audit metadata for compliance.

2. Multi-account orchestration

   • Use the MCP server to fan-out a single deployment change to multiple cloud accounts. The server maintains per-account state, retries failed runs, and consolidates results for a single dashboard.

3. Approval and governance hooks

   • Integrate an approval service (Slack, PagerDuty, web UI) via configured hooks. Terraform runs can pause for manual approval, and the MCP server resumes operations after approval while retaining a full activity trail.

4. Long-running and scheduled operations

   • Schedule periodic remediation or drift-detection operations. The server triggers Terraform plans/applies off-hours, aggregates diffs, and notifies teams only when intervention is required.

5. External system integration

   • Attach secrets management, ticketing, or inventory systems to enrich Terraform runs with dynamic context (e.g., injecting tenancy metadata, updating tickets on success/failure).

Getting Help and Contributing

Start with the repository README and examples, open