# Terraform (oci · docker.io/hashicorp/terraform-mcp-server)

Generate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise

- Trust score: 37/100 (low)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- oci · `docker.io/hashicorp/terraform-mcp-server`: 37/100 (this document), [markdown](https://verifymcp.io/servers/hashicorp-terraform-mcp-server/docker-io-hashicorp-terraform-mcp-server.md), [page](https://verifymcp.io/servers/hashicorp-terraform-mcp-server/docker-io-hashicorp-terraform-mcp-server)

## Channel facts

- Registry: `oci`
- Package: `docker.io/hashicorp/terraform-mcp-server`
- Version: `1.4.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 0/100
  - No malware scan is available for this kind of package: the supply-chain vendors we use do not cover it. This is a permanent gap in our coverage, not a finding about the package.
  - Known CVEs could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.
  - Install-script risk not yet assessed.
  - Dependency health could not be checked: this artifact ships no SBOM or dependency manifest, so there is no dependency list to read.
- **Provenance & Transparency**: 32/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - License check failed: no license is declared.
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 37/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2477 tokens (~225/item across 11 items; 9 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 43/100
  - Stability observed for 13 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 11 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### How do I install the Terraform MCP server?

Terraform runs locally as a container image, launched with docker run --rm -i docker.io/hashicorp/terraform-mcp-server:1.4.1. Ready-made configuration for Claude, Cursor, VS Code, Codex and 3 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add hashicorp-terraform-mcp-server -- docker run --rm -i docker.io/hashicorp/terraform-mcp-server:1.4.1
```

### Cursor

```json
{
  "mcpServers": {
    "hashicorp-terraform-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "hashicorp-terraform-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add hashicorp-terraform-mcp-server -- docker run --rm -i docker.io/hashicorp/terraform-mcp-server:1.4.1
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "hashicorp-terraform-mcp-server": {
      "type": "local",
      "command": [
        "docker",
        "run",
        "--rm",
        "-i",
        "docker.io/hashicorp/terraform-mcp-server:1.4.1"
      ],
      "enabled": true
    }
  }
}
```

### Hermes

```yaml
mcp_servers:
  hashicorp-terraform-mcp-server:
    command: "docker"
    args: ["run", "--rm", "-i", "docker.io/hashicorp/terraform-mcp-server:1.4.1"]
```

### Netclaw

```json
{
  "McpServers": {
    "hashicorp-terraform-mcp-server": {
      "Transport": "stdio",
      "Command": "docker",
      "Arguments": [
        "run",
        "--rm",
        "-i",
        "docker.io/hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

### Other

```json
{
  "mcpServers": {
    "hashicorp-terraform-mcp-server": {
      "command": "docker",
      "args": [
        "run",
        "--rm",
        "-i",
        "docker.io/hashicorp/terraform-mcp-server:1.4.1"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 37, 0)

- [security regression] Provenance: unverified → fail

### 2026-11-04 (score 37, +1)

- [security regression] Provenance: fail → unverified

### 2026-11-02 (score 36, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-31 (score 35, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-29 (score 34, +1)

No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-27 (score 33, +1)

No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-25 (score 32, +1)

No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-10-23 (score 31)

First indexed and scored.

## MCP tools (9)

### `get_latest_module_version` (~134 tokens)

Fetches the latest version of a Terraform module from the public registry

Input parameters:

- `module_name` (string, required): The name of the module, this is usually the service or group of service the user is deploying e.g., 'security-group', 'secrets-manager' etc.
- `module_provider` (string, required): The name of the Terraform provider for the module, e.g., 'aws', 'google', 'azurerm' etc.
- `module_publisher` (string, required): The publisher of the module, e.g., 'hashicorp', 'aws-ia', 'terraform-google-modules', 'Azure' etc.

### `get_latest_provider_version` (~123 tokens)

Fetches the latest version of a Terraform provider from the public registry

Input parameters:

- `name` (string, required): The name of the Terraform provider, e.g., 'aws', 'azurerm', 'google', etc.
- `namespace` (string, required): The namespace of the Terraform provider, typically the name of the company, or their GitHub organization name that created the provider e.g., 'hashicorp'. If you are not certain of the namespace, do…

### `get_module_details` (~100 tokens)

Fetches up-to-date documentation on how to use a Terraform module. You must call 'search_modules' first to obtain the exact valid and compatible module_id required to use this tool.

Input parameters:

- `module_id` (string, required): Exact valid and compatible module_id retrieved from search_modules (e.g., 'squareops/terraform-kubernetes-mongodb/mongodb/2.1.1', 'GoogleCloudPlatform/vertex-ai/google/0.2.0')

### `get_policy_details` (~95 tokens)

Fetches up-to-date documentation for a specific policy from the Terraform registry. You must call 'search_policies' first to obtain the exact terraform_policy_id required to use this tool.

Input parameters:

- `terraform_policy_id` (string, required): Matching terraform_policy_id retrieved from the 'search_policies' tool (e.g., 'policies/hashicorp/CIS-Policy-Set-for-AWS-Terraform/1.0.1')

### `get_provider_capabilities` (~266 tokens)

Get the capabilities of a Terraform provider including the types of resources, data sources, functions, guides, and other features it supports.
This tool analyzes the provider documentation to determine what types of capabilities are available:
\- resources: Infrastructure resources that can be created/managed
\- data-sources: Read-only data sources for querying existing infrastructure  
\- functions: Provider-specific functions for data transformation
\- guides: Documentation guides and tutorials for using the provider
\- actions: Available provider actions (if any)
\- ephemeral resources: Temporary resources for credentials and tokens
\- list-resources: List resources for querying existing cloud resources (Terraform Search)

Returns a summary with counts and examples for each capability type.

Input parameters:

- `name` (string, required): The name of the Terraform provider, e.g., 'aws', 'azurerm', 'google', etc.
- `namespace` (string, required): The namespace of the Terraform provider, typically the name of the company, or their GitHub organization name that created the provider e.g., 'hashicorp'. If you are not certain of the namespace, do…
- `version` (string): The version of the provider to analyze (defaults to 'latest')

### `get_provider_details` (~88 tokens)

Fetches up-to-date documentation for a specific service from a Terraform provider. 
You must call 'search_provider_docs' tool first to obtain the exact tfprovider-compatible provider_doc_id required to use this tool.

Input parameters:

- `provider_doc_id` (string, required): Exact tfprovider-compatible provider_doc_id, (e.g., '8894603', '8906901') retrieved from 'search_provider_docs'

### `search_modules` (~164 tokens)

Resolves a Terraform module name to obtain a compatible module_id for the get_module_details tool and returns a list of matching Terraform modules.
You MUST call this function before 'get_module_details' to obtain a valid and compatible module_id.
When selecting the best match, consider the following:
\- Name similarity to the query
\- Description relevance
\- Verification status (verified)
\- Download counts (popularity)
Return the selected module_id and explain your choice. If there are multiple good matches, mention this but proceed with the most relevant one.
If no modules were found, reattempt the search with a new moduleName query.

Input parameters:

- `current_offset` (number): Current offset for pagination
- `module_query` (string, required): The query to search for Terraform modules.

### `search_policies` (~161 tokens)

Searches for Terraform policies based on a query string.
This tool returns a list of matching policies, which can be used to retrieve detailed policy information using the 'get_policy_details' tool.
You MUST call this function before 'get_policy_details' to obtain a valid terraform_policy_id.
When selecting the best match, consider the following:
\- Name similarity to the query
\- Title relevance
\- Verification status (verified)
\- Download counts (popularity)
Return the selected policyID and explain your choice. If there are multiple good matches, mention this but proceed with the most relevant one.
If no policies were found, reattempt the search with a new policy_query.

Input parameters:

- `policy_query` (string, required): The query to search for Terraform modules.

### `search_provider_docs` (~395 tokens)

This tool retrieves a list of potential documents based on the 'service_slug' and 'provider_document_type' provided.
You MUST call this function before 'get_provider_details' to obtain a valid tfprovider-compatible 'provider_doc_id'.
Use the most relevant single word as the search query for 'service_slug', if unsure about the 'service_slug', use the 'provider_name' for its value.
When selecting the best match, consider the following:
\- Title similarity to the query
\- Category relevance
Return the selected 'provider_doc_id' and explain your choice.
If there are multiple good matches, mention this but proceed with the most relevant one.

Input parameters:

- `provider_document_type` (string, required): The type of the document to retrieve, for general overview of the provider use 'overview', for guidance on upgrading a provider or custom configuration information use 'guides', for deploying resourc…
- `provider_name` (string, required): The name of the Terraform provider to perform the read or deployment operation
- `provider_namespace` (string, required): The publisher of the Terraform provider, typically the name of the company, or their GitHub organization name that created the provider. If you are not certain of the namespace, do not guess, ask the…
- `provider_version` (string): The version of the Terraform provider to retrieve in the format 'x.y.z', or 'latest' to get the latest version
- `service_slug` (string, required): The slug of the service you want to deploy or read using the Terraform provider, prefer using a single word, use underscores for multiple words and if unsure about the service_slug, use the provider_…

## Diagnostics

Captured diagnostic sections: Provenance. The full working is on the page: https://verifymcp.io/servers/hashicorp-terraform-mcp-server/docker-io-hashicorp-terraform-mcp-server#diagnostics

## Score history

- 2026-11-05: 37
- 2026-11-04: 37
- 2026-11-03: 36
- 2026-11-02: 36
- 2026-11-01: 35
- 2026-10-31: 35
- 2026-10-30: 34
- 2026-10-29: 34
- 2026-10-28: 33
- 2026-10-27: 33
- 2026-10-26: 32
- 2026-10-25: 32
- 2026-10-24: 31
- 2026-10-23: 31

## Common questions

### What is the Terraform MCP server?

Terraform is an MCP server listed in the public MCP registry as io.github.hashicorp/terraform-mcp-server. Generate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise. This page covers its container image (docker.io/hashicorp/terraform-mcp-server).

### Is the Terraform MCP server safe to use?

Terraform scores 37 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Terraform MCP server expose?

Terraform exposes 9 tools: get_latest_module_version, get_latest_provider_version, get_module_details, get_policy_details, get_provider_capabilities, and 4 more. Their descriptions and schemas cost roughly 1,526 tokens of context every time the server is loaded.

### Is the Terraform MCP server still maintained?

Terraform is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

## Links

- Docker Hub: https://hub.docker.com/r/hashicorp/terraform-mcp-server
- Repository: https://github.com/hashicorp/terraform-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/hashicorp-terraform-mcp-server/docker-io-hashicorp-terraform-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/hashicorp-terraform-mcp-server/docker-io-hashicorp-terraform-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/hashicorp-terraform-mcp-server/docker-io-hashicorp-terraform-mcp-server