Terraform Cloud MCP server

Connect Terraform Cloud to Claude, ChatGPT, Cursor, Claude Code, Codex, Gemini, GitHub Copilot and any other MCP client, for your whole team. Metorial adds security, governance, and tracing, and gives everyone one Magic MCP URL to connect.

Deploy Terraform CloudBook a demo

What you can do with the Terraform Cloud MCP server

Ask your agent in plain language. Each of these maps to a real tool on the server.

  • Use the create variable set tool in Terraform Cloud
  • Use the create policy set tool in Terraform Cloud
  • Use the delete workspace tool in Terraform Cloud
  • Use the create run trigger tool in Terraform Cloud
  • Use the list variables tool in Terraform Cloud
  • Use the delete variable tool in Terraform Cloud

Supported Tools

create_variable_set

Create Variable Set

Call list_organizations to select an organization or use the optional configured default. Create a reusable variable set. Apply it globally to all workspaces or scope it to specific workspaces and projects.

create_policy_set

Create Policy Set

Call list_organizations to select an organization or use the optional configured default. Create a new policy set using Sentinel or OPA. Apply it globally or scope it to specific workspaces and projects. Optionally connect to a VCS repository containing policy code.

delete_workspace

Delete Workspace

Permanently delete a workspace and all of its content (state versions, runs, variables). This action cannot be undone.

create_run_trigger

Create Run Trigger

Create a run trigger that automatically queues a run in the target workspace whenever a run in the source workspace completes successfully. This enables workspace dependency chains.

list_variables

List Variables

List all Terraform and environment variables in a workspace. Returns the key, value, category, and whether each variable is sensitive or uses HCL syntax. Sensitive variable values are not returned.

delete_variable

Delete Variable

Permanently delete a variable from a workspace. This removes the variable from both the workspace and any future runs.

get_organization

Get Organization

Call list_organizations to select an organization or use the optional configured default. Get details about the configured Terraform Cloud organization, including basic plan flags, notification email and current permissions.

delete_variable_set

Delete Variable Set

Permanently delete a variable set. Variables in the set will no longer be available to any workspace.

list_variable_sets

List Variable Sets

Call list_organizations to select an organization or use the optional configured default. List all variable sets in the organization. Variable sets allow sharing common variables across multiple workspaces without duplicating them.

list_projects

List Projects

Call list_organizations to select an organization or use the optional configured default. List all projects in the organization. Projects are used to organize and group workspaces.

list_workspaces

List Workspaces

Call list_organizations to select an organization or use the optional configured default. List workspaces in the organization. Supports searching by name and filtering by project. Returns workspace configuration including execution mode, Terraform version, lock status, and VCS connection.

update_workspace

Update Workspace

Update an existing workspace's settings. Modify name, description, execution mode, Terraform version, auto-apply behavior, or working directory. Only provided fields will be updated.

delete_project

Delete Project

Permanently delete a project. The project must have no workspaces assigned to it.

create_workspace

Create Workspace

Call list_organizations to select an organization or use the optional configured default. Create a new Terraform workspace. Configure execution mode, Terraform version, auto-apply behavior, and optionally connect to a VCS repository for automatic run triggers.

list_policy_sets

List Policy Sets

Call list_organizations to select an organization or use the optional configured default. List policy sets configured in the organization. Policy sets contain Sentinel or OPA policies that are enforced on runs.

delete_policy_set

Delete Policy Set

Permanently delete a policy set. This stops enforcement of all policies in the set.

delete_team

Delete Team

Permanently delete a team. This revokes all workspace access granted to the team.

manage_run

Manage Run

Perform an action on an existing Terraform run. Apply a planned run, discard an unapplied plan, cancel a running operation, force-cancel a stuck run, or force-execute a run that is waiting in the queue.

list_runs

List Runs

List Terraform runs for a workspace. The provider excludes plan-only runs by default; use operation to include them. Filter by status to find pending, planning, applying, or completed runs. Returns run details including status, changes, and timing information.

update_project

Update Project

Update a project's name or description.

create_run

Create Run

Queue a Terraform run that may plan, apply, or destroy real infrastructure and incur costs in a workspace. Supports plan-only, refresh-only, destroy runs, targeted resources, and resource replacement. For VCS-connected workspaces, uses the latest configuration; for API-driven workspaces, optionally specify a configuration version.

create_variable

Create Variable

Create a Terraform variable or environment variable in a workspace. Supports HCL-formatted values and marking variables as sensitive to protect secrets.

get_current_state

Get Current State

Get the current (latest) state version for a workspace, including fully paginated public outputs. Sensitive values are always hidden. Returns state metadata and output values that can be used by other workspaces.

delete_run_trigger

Delete Run Trigger

Remove a run trigger (workspace dependency). Runs in the target workspace will no longer be queued when the source workspace completes.

lock_unlock_workspace

Lock/Unlock Workspace

Lock or unlock a workspace. Locking prevents new runs from being queued. Supports regular unlock and force-unlock (requires admin access). Provide a reason when locking to document why the workspace is locked.

update_variable

Update Variable

Update an existing variable's key, value, description, HCL setting, or sensitivity. Only provided fields will be updated.

get_workspace

Get Workspace

Call list_organizations to select an organization or use the optional configured default. Get detailed information about a specific workspace by its ID or name. Returns full workspace configuration including execution mode, Terraform version, VCS settings, lock status, and resource count.

manage_team_members

Manage Team Members

Call list_organizations to select an organization or use the optional configured default. Add or remove users from a team. Users are specified by their Terraform Cloud usernames.

list_notifications

List Notifications

List all notification configurations for a workspace. Shows webhook, Slack, Microsoft Teams, and email notification destinations and the events they listen for.

get_run

Get Run

Get detailed information about a specific Terraform run. Returns the run's current status, plan/apply details, timestamps, and whether it has changes.

delete_notification

Delete Notification

Delete a notification configuration from a workspace.

set_team_workspace_access

Set Team Workspace Access

Grant a team access to a workspace; discover grants with list_team_workspace_access and revoke them with delete_team_workspace_access. Grant access to a workspace with a specific permission level. Use "custom" access for granular control over runs, variables, state versions, and other workspace features.

list_teams

List Teams

Call list_organizations to select an organization or use the optional configured default. List all teams in the organization. Returns team details including member count, visibility, and organization-level access permissions.

list_state_versions

List State Versions

List historical state versions for a workspace. Each state version represents a snapshot of the infrastructure state at a point in time.

list_run_triggers

List Run Triggers

List run triggers (workspace dependencies) for a workspace. Run triggers automatically queue runs when dependent workspaces complete successfully.

create_project

Create Project

Call list_organizations to select an organization or use the optional configured default. Create a new project to organize workspaces. Workspaces can be assigned to a project during creation or moved later.

create_notification

Create Notification

Create a notification configuration for a workspace. Send run status updates to a webhook URL, Slack channel, Microsoft Teams channel, or email addresses. Choose which events trigger notifications.

create_team

Create Team

Call list_organizations to select an organization or use the optional configured default. Create a new team in the organization. Configure organization-level permissions for workspaces, policies, VCS, providers, modules and projects. Grant run permissions on individual workspaces.

delete_team_workspace_access

Delete Team Workspace Access

Revoke one workspace-specific team/group grant. Obtain its relationship ID from list_team_workspace_access or set_team_workspace_access. Other organization/project-level grants can still provide access.

list_team_workspace_access

List Team Workspace Access

List team/group grants on a workspace, including relationship IDs needed by delete_team_workspace_access. Actual visibility depends on the token permissions.

list_organizations

List Organizations

Discover authorized organization names for subsequent organization-scoped operations. Returns one provider page and current permissions; no configured organization is required.

get_current_user

Get Current User

Identify the authenticated HCP Terraform account. Team/group and organization tokens return a service account and the associated authenticated resource ID.

Connect Terraform Cloud to your AI client

Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.

  1. Enable Terraform Cloud in Metorial. In your Metorial portal, enable the Terraform Cloud MCP server and sign in with the account that owns the data. Access stays governed by your team policies.
  2. Add a custom connector. Open Customize, then Connectors. Select Add, then Custom, then Web.
  3. Paste your Metorial MCP URL. Name it Metorial, paste your Magic MCP URL (<your-magic-mcp-url>) and continue.
  4. Sign in. Select Add and sign in to load Terraform Cloud tools.

Run Terraform Cloud through the Metorial gateway

One governed layer for every app your agents reach, not a separate connector per tool.

  • Give Terraform Cloud and every other app to your whole team through one MCP gateway, behind your SSO.
  • Scope which teams and agents can use Terraform Cloud tools with role-based access control, and trace every call.
  • Prefer to run it yourself? Metorial is open source and self-hostable.

More integrations teams use with Terraform Cloud

GitHub

Manage repositories, issues, and pull requests. Create and configure branches, star repositories, review code, and merge changes. Automate CI/CD workflows with GitHub Actions, manage workflow runs, secrets, and artifacts. Track issues with labels, milestones, and assignees. Search across code, repositories, issues, and users. Manage organizations, teams, and memberships. Create and manage projects, gists, packages, deployments, and environments. Access security alerts including code scanning, secret scanning, and Dependabot alerts. Read and write file contents in repositories. Manage webhooks, notifications, and codespaces.

Salesforce

Manage CRM data including Accounts, Contacts, Leads, Opportunities, Cases, and custom objects. Create, read, update, and delete records. Query data using SOQL and search across objects using SOSL. Perform bulk data operations for large-scale imports, exports, and migrations. Execute composite requests to batch multiple operations in a single API call. Access analytics, reports, and dashboards. Manage files and attachments associated with records. Interact with Chatter feeds, posts, and groups for social collaboration. Manage org metadata including custom objects, fields, layouts, and workflows. Query data using GraphQL for precise data retrieval across related objects.

Sharepoint

Manage SharePoint sites, document libraries, lists, and files. Create, read, update, and delete lists and list items with custom columns. Resolve site users to numeric Person/Group LookupId values. Upload, download, move, copy, and version files in document libraries. Search across sites, files, folders, lists, and list items using Microsoft Search. Manage permissions at site, list, and item levels with granular access control. Define and manage content types and site columns. Retrieve site properties and search for sites across Microsoft 365.

Airtable

Create, read, update, and delete records in Airtable bases and tables. Manage base schemas including creating tables and fields. Filter records using formulas, sort by fields, and scope queries to specific views. Upsert records to find, create, or update in a single call. Upload attachments to records, read and write record comments, list accessible bases, and receive real-time base change events through webhooks.

Sentry

Track, manage, and resolve application errors and performance issues. List, query, and bulk-update issues and error events with filters like status, assignment, and tags. Create and manage releases, associate commits, and upload source maps. Configure issue alert rules and metric alert rules with notification actions. Set up cron monitors to detect missed or failed scheduled jobs. Build custom dashboards with configurable widgets. Run ad-hoc Discover queries across errors and transactions for performance analysis. Manage organizations, teams, projects, and members. Provision users via SCIM. Access session replay data.

Bitbucket

Manage Git repositories, pull requests, and CI/CD pipelines on Bitbucket Cloud. Create, fork, and configure repositories within workspaces and projects. Create, review, approve, merge, and decline pull requests with inline code comments. Browse source code, list commits, and manage branches and tags. Trigger, monitor, and manage Bitbucket Pipelines. List workspace members, configure repository default reviewers and branch restrictions, create and manage repository webhooks, and search code across repositories.

Technical notes for Terraform Cloud

Manage HCP Terraform workspaces, runs, variables, projects, teams, workspace grants, policy sets, variable sets, state metadata and public outputs. Discover the connected account and organizations, configure disabled or enabled workspace notifications, and manage workspace dependency run triggers. Sensitive values and destination credentials are hidden.

Frequently asked questions

Common questions about connecting Terraform Cloud to AI agents with Metorial.

  1. How many tools does the Terraform Cloud MCP server have?
    The Terraform Cloud MCP server exposes 42 tools, including Create Variable Set, Create Policy Set, Delete Workspace. Each one is governed and traced through Metorial.
  2. Terraform Cloud exposes tools your agents call on demand; it does not publish event triggers yet. Everything still runs through one governed MCP URL.
  3. Any MCP client, including VS Code, Windsurf, Zed, OpenCode and Grok. Each one reaches the Terraform Cloud MCP server through the same Metorial URL.
  4. Use role-based access control to decide which teams, users, and agents can use Terraform Cloud and which of its tools they can call.
  5. Yes. Metorial is open source, so you can run the Terraform Cloud MCP server yourself or use the hosted gateway.

Connect Terraform Cloud to production AI agents

See how Metorial gives your team governed access to Terraform Cloud, with tracing and security controls built in.

Book a demoDeploy Terraform Cloud