MCP server and API
A hosted Terraform MCP server for AI agents.
StackShip is a managed OpenTofu platform with a hosted MCP server. AI agents work on your infrastructure with the same roles, policies, and approvals as people.
AI agents
Give agents access without giving up control.
- 01
Hosted MCP server
Add one URL to your client and sign in with OAuth.
- 02
Read-only by default
Agents get read access unless they request mcp:write.
- 03
Your roles apply
Every tool call is checked against the user's role.
- 04
Audited actions
Agent actions are logged with the client that made them.
- 05
Guardrails built in
Sensitive operations stay in the dashboard.
- 06
REST API
The same v1 API powers the dashboard and your scripts.
Scopes
Read by default. Writes on request.
Scopes cap what an agent may try. Your role decides what it's allowed to do.
- mcp:tools
- Read projects, workspaces, runs, plans, policy results, and logs.
- mcp:write
- Also start, approve, and cancel runs, and manage variables.
# Claude Codeclaude mcp add --transport http stackship \ https://mcp.stackship.run/mcp # Cursor: .cursor/mcp.json{ "mcpServers": { "stackship": { "url": "https://mcp.stackship.run/mcp" } }}Guardrails
Kept out of agents' reach.
These actions are only available to people in the dashboard.
- Deleting anything
- Creating or revoking tokens
- Changing cloud credentials
- Downloading raw state
- Uploading policy source
- Installing the GitHub App
FAQ
Terraform MCP server questions
Is there a StackShip MCP server?
Yes. The StackShip MCP server is hosted at https://mcp.stackship.run/mcp. It uses the Streamable HTTP transport and OAuth, so there is no token to create or paste.
Which AI agents and MCP clients work?
Any client that supports remote MCP servers over HTTP, including Claude Code, Cursor, and VS Code.
Can an AI agent apply infrastructure changes?
Only with the mcp:write scope and a role that allows it. Members can start runs but not approve them. An approved apply still runs exactly the reviewed plan, and every agent action is in the audit log.
Is there a REST API?
Yes. The v1 REST API, described by an OpenAPI document, manages projects, workspaces, variables, runs, state, and policy. Every write takes an Idempotency-Key, so retries are safe.
Is there a StackShip CLI?
No separate CLI is needed. StackShip works as OpenTofu's cloud backend, so the tofu CLI is the command line.
Get started
Run your first plan today.
Free for every organization. Sign up with email or Google.