Ecosystem & Marketplaces›Open-Source MCP Servers (10)›Terraform MCP Server›Configuration

Configuration

Configure the Terraform MCP Server using environment variables to connect to your Neo4j vector database, select your embedding and LLM providers, and enforce directory and command whitelisting on Terraform CLI executions.

Prerequisites

Requirement	Description
Python 3.12+	Runtime environment for the FastMCP server
Terraform CLI (v1.x)	Required on PATH (or via TERRAFORM_BINARY_PATH) for command execution
Neo4j 5.x+	Graph and vector index backend with the apoc plugin enabled
AI Provider API Key	OpenAI, Anthropic, Azure OpenAI, Cohere, or local Ollama endpoint

Neo4j vector database setup

Start a local Neo4j instance with APOC procedures enabled using Docker:

docker run -d \
  --name terraform-neo4j \
  --publish=7474:7474 \
  --publish=7687:7687 \
  --volume=$HOME/neo4j_data:/data \
  --env NEO4J_AUTH=neo4j/your-secure-password \
  --env NEO4J_PLUGINS='["apoc"]' \
  --env "NEO4J_dbms_security_procedures_unrestricted=apoc.*,apoc.meta.data" \
  --env "NEO4J_dbms_security_procedures_allowlist=apoc.*,apoc.meta.data" \
  neo4j:5

• Port 7474: Neo4j Browser UI (http://localhost:7474)
• Port 7687: Bolt protocol endpoint (bolt://localhost:7687)

Installation and startup

git clone https://github.com/talkops-ai/talkops-mcp.git
cd talkops-mcp/src/terraform-mcp-server

uv venv --python=3.12
source .venv/bin/activate
uv pip install -e .

# Start the server (default: SSE on port 8000)
uv run terraform_mcp_server

To customize the bind address or run over stdio:

uv run terraform_mcp_server --host 0.0.0.0 --port 9000 --transport stdio

Environment variables

Create a .env file in the server root directory:

.env

# Neo4j connection
NEO4J_URI=bolt://localhost:7687
NEO4J_USERNAME=neo4j
NEO4J_PASSWORD=your-secure-password

# Embedding & LLM provider (choose one)
OPENAI_API_KEY=sk-...
# ANTHROPIC_API_KEY=sk-ant-...
# OLLAMA_BASE_URL=http://localhost:11434

# Server transport
HOST=0.0.0.0
PORT=8000
LOG_LEVEL=INFO

Server and database settings

Variable	Default	Description
HOST	0.0.0.0	Server bind address
PORT	8000	Server bind port
LOG_LEVEL	INFO	Logging verbosity (DEBUG, INFO, WARNING, ERROR)
NEO4J_URI	bolt://localhost:7687	Neo4j Bolt URI
NEO4J_USERNAME	neo4j	Neo4j username
NEO4J_PASSWORD	(Required)	Neo4j password

AI and embedding settings

Variable	Default	Description
LLM_PROVIDER	openai	LLM provider for documentation extraction (openai, anthropic, azure, ollama)
LLM_MODEL	gpt-4o	Model identifier used during documentation ingestion
EMBEDDING_PROVIDER	openai	Vector embedding provider (openai, cohere, huggingface, ollama)
EMBEDDING_MODEL	text-embedding-ada-002	Embedding model identifier
EMBEDDING_DIMENSIONS	1536	Vector index dimensionality

Terraform execution security settings

Variable	Default	Description
TERRAFORM_SECURITY_ENABLED	true	Enforce command whitelisting, path validation, and variable scanning
TERRAFORM_ALLOWED_COMMANDS	["init", "plan", "validate", "apply", "destroy"]	Permitted Terraform subcommands
TERRAFORM_ALLOWED_WORKING_DIRECTORIES	["/tmp", "/var/tmp"]	Allowed root directories for Terraform execution
TERRAFORM_BLOCKED_WORKING_DIRECTORIES	/etc, /usr, /bin, /sbin, /boot, /dev, /proc, /sys	Explicitly forbidden system directories
TERRAFORM_MAX_WORKING_DIRECTORY_DEPTH	10	Maximum directory nesting depth
TERRAFORM_DEFAULT_TIMEOUT	300	Default per-command execution timeout (5 minutes)
TERRAFORM_MAX_TIMEOUT	1800	Maximum configurable timeout (30 minutes)
TERRAFORM_MAX_VARIABLES	100	Maximum number of -var entries per execution
TERRAFORM_MAX_OUTPUT_LENGTH	10000	Maximum stdout/stderr character length returned to the agent

Dangerous pattern detection

When TERRAFORM_DANGEROUS_PATTERNS_ENABLED=true (default), all variable keys, values, and paths are scanned against 100+ injection signatures before invoking the Terraform binary:

• Shell metacharacters: |, ;, &, &&, ||, >, >>, <, backticks, and $(...) subshells.
• Privilege & network binaries: sudo, chmod, chown, bash, sh, curl, wget, ssh, eval, exec.
• Path traversal sequences: ../ or symlink escapes outside TERRAFORM_ALLOWED_WORKING_DIRECTORIES.

MCP client configuration

mcp.json

{
  "mcpServers": {
    "terraform-mcp-server": {
      "transport": "sse",
      "url": "http://localhost:8000/sse",
      "description": "Terraform MCP Server for IaC operations",
      "disabled": false
    }
  }
}

Troubleshooting

Error	Cause	Resolution
Failed to connect to Neo4j database	Neo4j container stopped or wrong NEO4J_URI / NEO4J_PASSWORD	Verify container health (docker ps) and ensure Bolt port 7687 is reachable.
terraform: command not found	Terraform CLI binary missing from system PATH	Install Terraform (v1.x) or set TERRAFORM_BINARY_PATH to the full binary path.
Security violation: dangerous pattern detected	Variable value contains shell expansion characters or working directory is outside allowed roots	Add your workspace root to TERRAFORM_ALLOWED_WORKING_DIRECTORIES and remove shell metacharacters from variable values.