Terraform MCP Server for AI Agents
The self-hosted deterministic codification engine for AI agents.
How it works
An AI agent orchestrates the workflow; Terraback does the deterministic work of scanning, codifying, and verifying. Nothing in the codify path is generated by an LLM.
Connect the MCP server
The agent registers Terraback as an MCP server (claude mcp add terraback -- terraback mcp) and gains access to the six tools below.
Scan, read-only
The agent calls scan_infrastructure for a live inventory, and optionally detect_unmanaged to diff it against your local Terraform state files.
Codify, deterministically
The agent calls codify_resource or codify_batch. Terraback's Jinja-template engine - the same one behind the CLI - writes the HCL and the Terraform 1.5+ import blocks. The agent never writes Terraform syntax itself.
Verify and self-correct
The agent calls verify_plan, which runs Terraform and returns a parsed drift summary. If the plan is not clean, the agent adjusts the generated resources and verifies again.
The six MCP tools
Every tool does one job. The agent decides what to call and when; Terraback never improvises the Terraform code.
scan_infrastructure
Read-only inventory of live resources across AWS, Azure, or GCP - the agent's starting picture of what actually exists.
detect_unmanaged
Diffs the live inventory against your local Terraform state files to find exactly which resources are unmanaged.
codify_resource
Generates the HCL and the Terraform 1.5+ import block for one specific resource, deterministically.
codify_batch
Dependency-aware HCL and import blocks for a filtered set of resources in one call - 25 resources per run on Community, uncapped on Professional.
verify_plan
Runs terraform init and terraform plan on the generated code and returns a parsed drift summary so the agent can self-correct.
list_supported_resources
Enumerates the 240+ resource types Terraback can codify across AWS, Azure, and GCP.
Quickstart
Install Terraback, then register the MCP server with your client of choice. Requires Python 3.10+, and Terraform 1.5 or newer if you want to use verify_plan.
1. Install Terraback:
pip install terraback2. Or run it with zero install via uv:
uvx terraback mcpRegister the MCP server:
claude mcp add terraback -- terraback mcpClaude Desktop, Cursor, Windsurf, or any MCP client that reads a config file:
{
"mcpServers": {
"terraback": {
"command": "terraback",
"args": ["mcp"]
}
}
}The verify_plan self-correction loop
This is what separates Terraback's MCP server from a tool that just prints Terraform code and hopes it applies cleanly. After codifying a resource, the agent calls verify_plan, which runs terraform init and terraform plan and parses the result into adds, changes, and destroys.
codify_resource / codify_batch verify_planverify_plan again.The loop means the agent - not a human reviewing raw terraform plan output - is responsible for landing on a clean plan. That is what lets Terraback claim its generated code has been verified to apply as imports-only on AWS, Azure, and GCP with zero hand edits.
Security posture
Built for regulated environments where infrastructure data cannot leave the network, and where credential handling is audited.
How Terraback compares
Terraform 1.14 shipped a native terraform query command that lists resources for providers implementing list support, but it is CLI-only with no agent interface. Microsoft ships an Azure MCP Server built on aztfexport, but it only covers Azure. Firefly's codification is MCP-accessible but requires their SaaS inventory account, from $2,499/month on its cheapest paid tier. Google's Terraformer was archived and made read-only on 2026-03-16.
| Feature | Terraback | Terraformer | Firefly | terraform query | aztfexport |
|---|---|---|---|---|---|
| Multi-cloud | AWS, Azure, GCP | Many providers (frozen at archive) | Multi-cloud | Partial - providers with list support only | Azure only |
| Self-hosted | Yes, runs locally | Yes, local CLI (unmaintained) | No, SaaS account required | Yes, built into the Terraform CLI | Yes, local CLI |
| Import blocks | Native Terraform 1.5+ import blocks | No - legacy state-file import only | Import workflow (platform-managed) | CLI list/query; config generation varies by provider | Yes, generates import blocks (Azure only) |
| MCP interface | Yes - 6 tools over stdio | No | Yes, requires their SaaS inventory account | No - CLI-only | Yes, via Microsoft's Azure MCP Server (Azure only) |
| Plan verification loop | Yes - verify_plan closes the loop until 0 changes | No | Drift dashboards, not an agent self-correction loop | No | Not documented |
| Price | $499 once (Community free) | Free (archived, unmaintained) | From $2,499/month | Free (built into Terraform 1.14+) | Free (open source) |
Frequently asked questions
Related
Give your AI agent a deterministic path to Terraform
Community includes the full MCP server, with codify_batch capped at 25 resources per run. Professional lifts the cap - $499 once, no subscription.