Skip to content
StackShip

Terraform Cloud alternative

Terraform automation, built for OpenTofu.

StackShip is the Terraform Cloud alternative for OpenTofu: plans, policy checks, approvals, applies, and remote state in one place.

Start freeRead the quickstart
Illustrative example. Not customer data.
  • Works with your cloud block
  • Approval before every apply
  • Policy as code with OPA
  • Hosted MCP server for agents

How it works

GitOps for OpenTofu, from pull request to apply.

Every change follows the same path. Every step stays on the run.

How runs and approvals work
  1. 01

    Open a pull request

    Pull requests get plan previews as GitHub checks.

  2. 02

    Plan in isolation

    Each plan runs in a fresh, isolated environment.

  3. 03

    Check policy

    Rego policies check the plan before anyone approves.

  4. 04

    Approve and apply

    Apply runs exactly the plan your reviewer approved.

Platform

Runs, state, policy, and modules in one platform.

Explore the platform

  • Projects and workspaces

    Group workspaces by project. Each one owns its state, variables, and runs.

    Workspaces and remote state

  • Native cloud block

    Point your cloud block at StackShip and keep using tofu.

    The OpenTofu platform

  • Policy as code

    Versioned Rego policies check every plan before apply.

    Policy as code with OPA

  • Short-lived cloud credentials

    Short-lived credentials for every run. No cloud keys stored.

    How cloud credentials work

  • Private module registry

    Push a semver tag on GitHub to publish a module version.

    The private module registry

  • Enterprise identity included

    Email, Google, SAML or OIDC SSO, and SCIM for every organization.

    SSO and SCIM

  • One record per run

    Source, plan, policy, approval, logs, and outcome on one record.

    Runs and approvals

MCP server

Let AI agents run OpenTofu safely.

Connect Claude, Cursor, or VS Code. Agents work through your roles, policies, and approvals.

  • Read-only by default. Writes need the mcp:write scope.
  • Every action is checked against the user's role.
  • Applies still run only the approved plan.
  • Every change lands in the audit log.
Explore the MCP server
mcp.stackship.run
# Claude Codeclaude mcp add --transport http stackship \  https://mcp.stackship.run/mcp # Read (mcp:tools)stackship_list_runsstackship_get_run_review # Write (mcp:write)stackship_create_runstackship_approve_run

Migrate from Terraform Cloud

Switch from Terraform Cloud by changing one hostname.

StackShip speaks the same cloud protocol. Move one workspace at a time with standard tofu commands.

  1. 01

    Point the cloud block

    Set the hostname to stackship.run.

  2. 02

    Push your state

    Run tofu state push in a clean directory.

  3. 03

    Plan before you apply

    Confirm a no-change plan, then cut over.

Compare StackShip with Terraform CloudRead the migration guide
main.tf
# main.tfterraform {  cloud {    hostname     = "stackship.run"    organization = "acme"    workspaces { name = "network-production" }  }} # In a clean directorytofu login stackship.runtofu init -input=falsetofu state push source-state.json

FAQ

Questions about StackShip

More answers in the StackShip documentation.

What is StackShip?

StackShip is a managed OpenTofu platform and Terraform Cloud alternative: it runs plans and applies with policy checks, approvals, remote state, and short-lived cloud credentials.

What is a Terraform Cloud alternative for OpenTofu?

A Terraform Cloud alternative is a service that runs plans and applies remotely, stores state, and gates changes with policy and approvals. StackShip does this for OpenTofu and speaks the same cloud protocol as Terraform Cloud (now HCP Terraform), so existing cloud blocks need only a new hostname.

Does StackShip support the OpenTofu cloud block?

Yes. Set hostname = "stackship.run" in your cloud block, run tofu login stackship.run, and keep using tofu plan, tofu apply, and tofu state commands.

Does StackShip run Terraform or OpenTofu?

StackShip runs OpenTofu 1.6.0 and newer, pinned per workspace. It doesn't run Terraform binaries, but most Terraform configurations run unchanged on OpenTofu.

How do approvals work?

Every plan with changes waits for an owner or admin to approve it. The apply then runs exactly the approved plan, with the same providers and modules. There is no auto-apply.

Is there an MCP server for AI agents?

Yes. AI agents connect to https://mcp.stackship.run/mcp over OAuth. They get read access by default and need the mcp:write scope, plus a matching role, to start or approve runs.

Which clouds and Git providers are supported?

GitHub for source, through the StackShip GitHub App. AWS, Google Cloud, and Microsoft Azure through short-lived federated credentials, so no cloud keys are stored.

How much does StackShip cost?

StackShip is free for every organization, with no credit card required. SSO, SCIM, policy, and the MCP server are all included.

Get started

Run your first OpenTofu plan today.

Free for every organization. Sign up with email or Google.

Start freeRead the quickstart