/terraform

name: terraform
description: >-
  Terraform Cloud workspace management, run monitoring, and log retrieval. Use when
  listing workspaces, checking run status, fetching plan/apply logs, or looking up
  providers and modules in the Terraform Registry.
disable-model-invocation: true
allowed-tools:
  - mcp__terraform
  - Bash(curl:*)
  - Bash(jq:*)

Terraform

Tool Selection

• **MCP tools** (`mcp__terraform`): workspace listing, run management, provider/module registry lookups
• **curl**: plan and apply log retrieval — the MCP server does not expose these endpoints

Run Monitoring

Use MCP tools to find and inspect runs:

1. `list_workspaces` to find the workspace by name 2. `list_runs` with the workspace ID to see recent runs 3. `get_run_details` with the run ID for status, relationships, and timestamps

Run details include `relationships.plan.data.id` and `relationships.apply.data.id` — use these to fetch logs.

Fetching Plan/Apply Logs

The MCP server does not expose log retrieval; use the TFC API directly.

# Get the apply details (includes log-read-url)
curl -s \
  -H "Authorization: Bearer $TFE_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  https://app.terraform.io/api/v2/applies/{apply-id} | jq -r '.data.attributes."log-read-url"'

Then fetch the raw logs from the archivist URL (no auth needed — pre-signed):

curl -s "$(archivist_url)"

The same pattern works for plans via `/api/v2/plans/{plan-id}`.

See [references/api.md](references/api.md).

Authentication

`$TFE_TOKEN` is sourced from:

• `terraform login` (stored at `~/.terraform.d/credentials.tfrc.json`)
• Or set directly as an environment variable

The MCP server reads `TFE_TOKEN` from the environment. For curl calls, use it as a Bearer token.

Registry

Provider and module searches use MCP tools (`search_providers`, `search_modules`, `provider_details`, `module_details`). No curl needed.