tfmcp MCP server for AI agents

tfmcp is a command-line tool that enables AI assistants to manage and operate Terraform environments through the Model Context Protocol (MCP). It allows for reading, analyzing, applying, and modifying Terraform configurations, making infrastructure management more accessible through AI interfaces.

Installation

Using Cargo

The easiest way to install tfmcp is from Crates.io:

cargo install tfmcp

From Source

# Clone the repository
git clone https://github.com/nwiizo/tfmcp
cd tfmcp

# Build and install
cargo install --path .

Using Docker

# Clone the repository
git clone https://github.com/nwiizo/tfmcp
cd tfmcp

# Build the Docker image
docker build -t tfmcp .

# Run the container
docker run -it tfmcp

System Requirements

Rust (edition 2021)
Terraform CLI installed and available in PATH
Claude Desktop (for AI assistant integration)
Docker (optional, for containerized deployment)

Basic Usage

$ tfmcp --help
✨ A CLI tool to manage Terraform configurations and operate Terraform through the Model Context Protocol (MCP).

Usage: tfmcp [OPTIONS] [COMMAND]

Commands:
  mcp       Launch tfmcp as an MCP server
  analyze   Analyze Terraform configurations
  help      Print this message or the help of the given subcommand(s)

Options:
  -c, --config <PATH>    Path to the configuration file
  -d, --dir <PATH>       Terraform project directory
  -V, --version          Print version
  -h, --help             Print help

Docker Usage

# Run as MCP server (default)
docker run -it tfmcp

# Run with specific command and options
docker run -it tfmcp analyze --dir /app/example

# Mount your Terraform project directory
docker run -it -v /path/to/your/terraform:/app/terraform tfmcp --dir /app/terraform

# Set environment variables
docker run -it -e TFMCP_LOG_LEVEL=debug tfmcp

Integrating with Claude Desktop

Step 1: Install tfmcp

If you haven't already installed tfmcp, do so with one of the methods above.

Step 2: Find the executable path

which tfmcp

Step 3: Configure Claude Desktop

Add the following configuration to ~/Library/Application\ Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "tfmcp": {
      "command": "/path/to/your/tfmcp",  // Replace with the actual path
      "args": ["mcp"],
      "env": {
        "HOME": "/Users/yourusername",  // Replace with your username
        "PATH": "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
        "TERRAFORM_DIR": "/path/to/your/terraform/project"  // Optional
      }
    }
  }
}

With Docker:

{
  "mcpServers": {
    "tfmcp": {
      "command": "docker",
      "args": ["run", "--rm", "-v", "/path/to/your/terraform:/app/terraform", "tfmcp", "mcp"],
      "env": {
        "TERRAFORM_DIR": "/app/terraform"
      }
    }
  }
}

Step 4: Restart Claude and Enable the Tool

After restarting Claude Desktop, enable the tfmcp tool in the interface.

Environment Variables

Core Configuration

TERRAFORM_DIR: Custom Terraform project directory
TFMCP_LOG_LEVEL: Set to debug, info, warn, or error
TFMCP_DEMO_MODE: Set to true to enable demo mode

Security Configuration

TFMCP_ALLOW_DANGEROUS_OPS: Enable apply/destroy operations (default: false)
TFMCP_ALLOW_AUTO_APPROVE: Enable auto-approve for dangerous operations (default: false)
TFMCP_MAX_RESOURCES: Maximum number of manageable resources (default: 50)
TFMCP_AUDIT_ENABLED: Enable audit logging (default: true)
TFMCP_AUDIT_LOG_FILE: Custom path for audit log file (default: ~/.tfmcp/audit.log)
TFMCP_AUDIT_LOG_SENSITIVE: Include sensitive information in audit logs (default: false)

Troubleshooting

The tfmcp server logs are available at:

~/Library/Logs/Claude/mcp-server-tfmcp.log

Common issues and solutions:

Connection issues: Verify the path to the tfmcp executable in your configuration
Terraform project problems: tfmcp creates a sample project if none is found
Method not found errors: Check MCP protocol support
Docker issues: Ensure proper volume mounts and permissions

Security Recommendations

tfmcp includes comprehensive security features designed for production use:

Recommended Production Settings

export TFMCP_ALLOW_DANGEROUS_OPS=false    # Keep disabled for safety
export TFMCP_ALLOW_AUTO_APPROVE=false     # Require manual approval
export TFMCP_MAX_RESOURCES=10             # Limit resource scope
export TFMCP_AUDIT_ENABLED=true           # Enable audit logging
export TFMCP_AUDIT_LOG_SENSITIVE=false    # Don't log sensitive data

How to install this MCP server

For Claude Code

To add this MCP server to Claude Code, run this command in your terminal:

claude mcp add-json "tfmcp" '{"command":"tfmcp","args":["mcp"],"env":{"HOME":"/Users/yourusername","PATH":"/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin","TERRAFORM_DIR":"/path/to/your/terraform/project"}}'

See the official Claude Code MCP documentation for more details.

For Cursor

There are two ways to add an MCP server to Cursor. The most common way is to add the server globally in the ~/.cursor/mcp.json file so that it is available in all of your projects.

If you only need the server in a single project, you can add it to the project instead by creating or adding it to the .cursor/mcp.json file.

Adding an MCP server to Cursor globally

To add a global MCP server go to Cursor Settings > Tools & Integrations and click "New MCP Server".

When you click that button the ~/.cursor/mcp.json file will be opened and you can add your server like this:

{
    "mcpServers": {
        "tfmcp": {
            "command": "tfmcp",
            "args": [
                "mcp"
            ],
            "env": {
                "HOME": "/Users/yourusername",
                "PATH": "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
                "TERRAFORM_DIR": "/path/to/your/terraform/project"
            }
        }
    }
}

Adding an MCP server to a project

To add an MCP server to a project you can create a new .cursor/mcp.json file or add it to the existing one. This will look exactly the same as the global MCP server example above.

How to use the MCP server

Once the server is installed, you might need to head back to Settings > MCP and click the refresh button.

The Cursor agent will then be able to see the available tools the added MCP server has available and will call them when it needs to.

You can also explicitly ask the agent to use the tool by mentioning the tool name and describing what the function does.

For Claude Desktop

To add this MCP server to Claude Desktop:

1. Find your configuration file:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
Linux: ~/.config/Claude/claude_desktop_config.json

2. Add this to your configuration file:

{
    "mcpServers": {
        "tfmcp": {
            "command": "tfmcp",
            "args": [
                "mcp"
            ],
            "env": {
                "HOME": "/Users/yourusername",
                "PATH": "/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
                "TERRAFORM_DIR": "/path/to/your/terraform/project"
            }
        }
    }
}

3. Restart Claude Desktop for the changes to take effect