Terraform MCP Server

HashiCorp's Terraform MCP server connects AI agents to Terraform module registries, provider documentation, and workspace state configurations. It empowers agents to inspect infrastructure-as-code definitions, look up provider details, review plan outputs, and diagnose cloud provisioning issues across multi-cloud environments.

Start for free

Benefits with Ory + Terraform MCP Server

HashiCorp's Terraform MCP server lets your agents look up providers, modules, and policies in the Terraform Registry and, when connected to HCP Terraform or Terraform Enterprise, work with your workspaces and runs. Registry lookups are harmless, while workspace operations can lead to real infrastructure changes. Ory Agent Security lets agents research freely while workspace and run operations stay with the platform agents you approve.

View documentation

Use Cases

— 01 use case

Agent IAM

Plan reviewers at Read, workspace builders at Write, run starters at Admin, and Block for agents that should never touch your Terraform estate.

Explore Agent IAM

Core Functionality

— 04 capabilities

Read, write, admin, or no access
Ory Agent Security classifies every tool on the Terraform MCP server as read, write, or admin, so you can give each user, team, or agent type only the level it needs: read for agents researching providers and modules, write for platform agents that set up workspaces, admin for your platform team's most trusted agents, and no access for agents outside infrastructure work.
Enforced before execution
Ory Agent Security checks each tool call against the user, the agent acting for them, and any sub-agent inside the agent harness, so a denied apply stops before it reaches Terraform, with nothing to roll back and no gateway to deploy.
Observe, then enforce
Observe mode shows which agents touch workspaces and runs and for whom without blocking anything, so you can apply Ory's pre-built policy for the Terraform MCP server and enforce it on your own schedule.
Complete audit trail
Every allow and deny decision on the Terraform MCP server streams to your SIEM through OpenTelemetry with the user, agent, and action attached, so you can show which agent started a run and on whose behalf.