Terraform MCP server
The Terraform MCP Server is a Model Context Protocol server for Infrastructure as Code automation. It combines sandboxed Terraform CLI execution (init, validate, plan, apply, destroy) with Neo4j-backed vector similarity search across Terraform provider documentation so AI agents generate valid HCL resources without hallucinating deprecated provider arguments.
Execute terraform_execute with command whitelisting, search provider schemas via terraform_doc_search, and index docs with ingest_terraform_docs.
Configure Terraform binary paths, execution timeouts, Neo4j vector index connections, and embedding providers.
Walk through semantic resource lookup, module validation, dry-run planning, and documentation ingestion.
See how the TalkOps Framework and OpsCode agent pair with the Terraform MCP Server for end-to-end cloud provisioning.
Core capabilities
| Capability | Description |
|---|---|
| Sandboxed Terraform Execution | Whitelisted execution of init, validate, plan, apply, destroy, output, state, and fmt with directory traversal protection and 100+ dangerous pattern checks. |
| Semantic Provider Search | HNSW vector similarity search (1536-dimensional embeddings in Neo4j) over Terraform provider resources, data sources, and architecture best practices with 10–100ms query latency. |
| Intelligent Doc Ingestion | Multi-format ingestion pipeline (Markdown, HTML, PDF) with LLM-assisted schema extraction and semantic chunking. |
| Multi-Provider Embeddings | Supports OpenAI, Anthropic, Azure OpenAI, HuggingFace, Cohere, and local Ollama models. |
Architecture
Quickstart
Ensure you have Python 3.12+, the Terraform CLI (v1.x), a running Neo4j 5.x+ instance (for vector search), and an embedding provider API key (such as OPENAI_API_KEY).
Clone the repository, install dependencies with uv, and start the server:
git clone https://github.com/talkops-ai/talkops-mcp.git
cd talkops-mcp/src/terraform-mcp-server
uv venv --python=3.12
source .venv/bin/activate
uv pip install -e .
uv run terraform_mcp_server
Register the SSE endpoint in your MCP client configuration:
{
"mcpServers": {
"terraform-mcp-server": {
"transport": "sse",
"url": "http://localhost:8000/sse",
"description": "Terraform MCP Server for IaC operations"
}
}
}
Tool summary
| Tool | Purpose |
|---|---|
terraform_execute | Run whitelisted Terraform commands (init, validate, plan, apply, destroy) inside a validated working directory with timeout and variable scanning. |
terraform_doc_search | Query the Neo4j vector index for provider resource arguments, nested block schemas, data sources, and module best practices. |
ingest_terraform_docs | Parse, chunk, embed, and store Terraform provider documentation into Neo4j with incremental deduplication. |
Security guardrails
| Guardrail | Enforcement |
|---|---|
| Command Whitelisting | Rejects arbitrary shell binaries; only explicitly allowed Terraform subcommands can run. |
| Directory Traversal Protection | Resolves and validates working directories to block .. path escapes and system directory access. |
| Variable & Flag Scanning | Scans input variables (up to 100 keys) and command arguments against 100+ shell injection and remote execution patterns. |
| Execution Timeouts | Enforces configurable per-command timeouts (1 to 1800 seconds) and truncates oversized stdout/stderr payloads. |
Project structure
terraform-mcp-server/
├── terraform_mcp_server/ # Main package
│ ├── tools/ # MCP tool implementations
│ │ ├── tf_execution/ # Sandboxed Terraform command runner
│ │ ├── tf_search/ # Semantic provider doc search
│ │ └── tf_ingestion/ # Documentation ingestion pipeline
│ ├── services/ # Core services
│ │ ├── embedding/ # Multi-provider vector embeddings
│ │ ├── llm/ # LLM content extraction
│ │ └── neo4j/ # Neo4j vector & graph storage
│ ├── server/ # FastMCP server setup
│ └── config.py # Pydantic settings management
├── tests/ # Test suite
└── pyproject.toml # Project configuration