Model Context Protocol moderate risk

Tfmcp

tfmcp is a CLI tool and MCP server enabling AI assistants to manage Terraform configurations, offering features from plan analysis to security controls.

Connections & Capabilities

Connects To

GitHubDocker

Capabilities

readwriteexecadmin

Quickstart

Install

cargo install tfmcp

Config

{
  "mcpServers": {
    "tfmcp": {
      "command": "/path/to/your/tfmcp",  // Replace with the actual path from step 2
      "args": ["mcp"],
      "env": {
        "HOME": "/Users/yourusername",  // Replace with your username
        "PATH": "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
        "TERRAFORM_DIR": "/path/to/your/terraform/project"  // Optional: specify your Terraform project
      }
    }
  }
}

Exposed MCP Tools (12)

safe

init_terraform

Initializes a Terraform working directory to prepare for operations.

Initializes the directory but does not modify infrastructure.

safe

get_terraform_plan

Generates an execution plan showing proposed changes to infrastructure.

Read-only operation; does not modify infrastructure.

critical

apply_terraform

Applies the Terraform configuration to create or modify infrastructure.

Modifies infrastructure and can cause irreversible changes.

critical

destroy_terraform

Destroys all Terraform-managed infrastructure.

Destroys infrastructure and can cause significant data loss.

moderate

terraform_workspace

Manages Terraform workspaces, allowing you to switch between different environments.

Can modify the active workspace, potentially affecting subsequent operations.

moderate

terraform_import

Imports existing resources into Terraform management.

Adds resources to the state, which can affect future plans.

high

terraform_taint

Taints or untaints resources, forcing them to be recreated on the next apply.

Forces resource recreation, potentially causing downtime.

safe

terraform_refresh

Refreshes the Terraform state to reflect the current state of the infrastructure.

Updates the state but does not modify infrastructure.

moderate

terraform_fmt

Formats Terraform code to adhere to a consistent style.

Modifies code formatting, which could introduce unintended changes if not reviewed.

safe

terraform_graph

Generates a dependency graph of Terraform resources.

Read-only operation; does not modify infrastructure.

safe

terraform_output

Retrieves output values from the Terraform state.

Read-only operation; does not modify infrastructure.

safe

terraform_providers

Gets information about the Terraform providers used in the configuration.

Read-only operation; does not modify infrastructure.

Safety Assessment

tfmcp offers robust security features, but its safety depends heavily on proper configuration. It is safe for read-only operations and analysis. Risky operations like applying changes should only be enabled with caution and thorough review of plans.

Dangerous operations like apply/destroy are disabled by default.
Includes audit logging for tracking all operations.
Offers configurable resource limits to prevent over-provisioning.
Provides built-in protection against accessing sensitive file patterns.
Supports directory validation to enforce security policies.

Enables write operations, potentially leading to infrastructure changes.
Requires careful configuration to prevent unintended resource modifications.
Relies on environment variables for security settings, which can be misconfigured.
Access to Terraform state allows for potential data exposure if not properly secured.
If `TFMCP_ALLOW_DANGEROUS_OPS` is enabled, destructive actions are possible.