Deploy the Terraform MCP server

The Terraform MCP server gives AI models up-to-date information from the Terraform registry and, when connected, from your HCP Terraform or Terraform Enterprise organizations.

You can run the Terraform Model Context Protocol (MCP) server on your local machine, host it in an environment that you manage, or connect to the remote Terraform MCP server that HashiCorp hosts for HCP Terraform.

Hands-on: Try the Integrate your private module registry with the Terraform MCP server tutorial. Learn how to use the Terraform MCP server to explore your HCP Terraform private registry and generate Terraform configuration.

Deployment options

You can run the Terraform MCP server on your local machine, host it in a remote environment that you manage, or connect to the remote Terraform MCP server that HashiCorp hosts.

• Local deployments are best for helping you get started or for one-off projects. Refer to Deploy Terraform MCP server locally for instructions.
• Self-hosted deployments are best for centrally managing the server, which helps you implement good governance policies across your organizations. Self-hosted deployments also support Terraform Enterprise. Refer to Deploy a self-hosted Terraform MCP server for instructions.
• The remote Terraform MCP server is best for connecting to HCP Terraform without installing or operating a server. The remote Terraform MCP server is in beta. Refer to Connect to the remote Terraform MCP server for instructions.

The following table compares deployment options.

Secure configuration

Implement the following recommendations to securely deploy a local or self-hosted MCP server:

• Hosting

  We recommend running your MCP server locally at 127.0.0.1 through the STDIO or HTTP Streamable transport protocol to limit publicly exposing your Terraform environment. The default transport is set to STDIO. If you host your server remotely, we recommend implementing additional security controls at the application and network layers. For example, you can add an API gateway with authentication, TLS encryption, and IP whitelisting between the client and server.

• CORS

  By default, Terraform MCP server runs in strict CORS (cross-origin request) mode and the allowed origins are empty. As a result, all cross-origin requests are blocked unless the server is explicitly configured to allow them. Exercise caution when changing the allowed origins list.

• Terraform authentication

  The TFE_SKIP_TLS_VERIFY option is set to false by default so that the MCP server verifies that the HCP Terraform or Terraform Enterprise TLS certificate is valid. If you temporarily set this option to true for testing or other use cases, we strongly recommend resetting to false to ensure that encryption is enabled. We also recommend limiting the permissions of the TFE_TOKEN used to authenticate as described in the Terraform documentation. Refer to API tokens for more information.

• Rate limiting

  We recommend setting up global and per-session rate limits to prevent the server or dependent resources from becoming overloaded through excessive requests.

• TLS

  When making your MCP server accessible remotely, we recommend adding TLS certificates to the host infrastructure to protect in-transit communication. To serve HTTPS from the server itself, set the MCP_TLS_CERT_FILE and MCP_TLS_KEY_FILE environment variables. Refer to Configure TLS for more information.

• Organization allowlist

  When you host your server remotely, we recommend restricting access to the organizations that you expect to use the server. Refer to Restrict access by organization for more information.

HashiCorp manages the configuration of the remote Terraform MCP server. Refer to remote Terraform MCP server security for more information.

Authentication

You must use Terraform MCP server v0.3.0 or newer to authenticate with the Terraform registry. Authentication requires an authentication token from HCP Terraform or your Terraform Enterprise deployment so that the MCP server can access your private registry. Refer to API tokens for instructions.

We recommend authenticating the server with HCP Terraform or Terraform Enterprise so that you can interact with your organization and private registry. Refer to Connect to HCP Terraform or Terraform Enterprise for more information.

The remote Terraform MCP server requires an HCP Terraform user or team API token for every request. Refer to Create an API token for more information.