An MCP server for OpenTofu and Terraform: letting AI agents run infrastructure safely
AI agents are good at reading plans, explaining failures, and drafting changes. Letting them touch infrastructure needs guardrails. Here is how to connect an agent through the Model Context Protocol without handing it the keys.
What MCP is
The Model Context Protocol (MCP) is an open standard for connecting AI agents to tools and data. An MCP server describes the actions it offers, and clients such as Claude, Cursor, and VS Code let the agent call them. A remote MCP server with OAuth means the agent signs in as you, with no token to paste.
What an agent is useful for
- Explaining a failed run. Read the logs and point at the resource and error that matter.
- Reviewing a plan. Summarize what will be created, changed, and destroyed, and flag anything surprising.
- Answering questions such as "which workspaces have runs waiting for approval?" or "who changed this variable?"
- Doing routine work: creating a workspace, setting a variable, starting a plan.
The risks
An agent with broad cloud credentials can do anything those credentials allow, at machine speed, and can be steered by text it reads in logs, pull requests, or web pages. The safe design gives an agent access to the platform that runs your changes, never to the cloud directly, and keeps the same review steps a human goes through.
Guardrails that matter
- Read by default. Write access should be an explicit, separate grant.
- Never more than the human. The agent acts as a user and is limited by that user's role.
- Plan-bound approvals. If an agent can approve, it can only approve the exact plan it read.
- No secrets. Sensitive values, raw state, and credential setup stay out of reach.
- No deletes. Destructive platform actions stay human-only.
- Audit. Every change records which agent made it and for whom.
- Short sessions. Access that expires, and stops the moment the person leaves the organization.
The StackShip MCP server
StackShip hosts an MCP server at https://mcp.stackship.run/mcp using Streamable HTTP and OAuth. To connect Claude Code:
claude mcp add --transport http stackship https://mcp.stackship.run/mcpCursor and VS Code take the same URL in their MCP configuration.
| Scope | What the agent can do |
|---|---|
mcp:tools (default) | Read workspaces, runs, plan summaries, policy results, logs, state history, variables without sensitive values, the audit log, and the module registry. |
mcp:write | Also create workspaces, set variables, start, approve, reject, and cancel runs, attach policy versions, and manage registry modules, each only if your role allows it. |
Deleting anything, creating tokens, managing cloud credentials, downloading raw state, and apply recovery are dashboard-only. Agent actions appear in the audit log under your name with the agent's client ID. Standard access lasts an hour.
Start read-only
Connect with the default read scope first and use the agent to review plans and explain failures for a few weeks. Add mcp:write when you trust the workflow. Read the MCP server docs for client setup, or see the MCP server and API overview.