Demo Creating a Resource in Terraform

This guide shows how to run Terraform operations through an MCP (Message Control Plane) server using the Terraform MCP bridge (tfmcp). You will learn to initialize a Terraform workspace, plan and apply a simple configuration that creates a local file — all triggered by MCP-style JSON-RPC calls (stdio). This workflow is useful when you want programmatic, message-driven control of Terraform from agents, automation pipelines, or AI assistants that already speak MCP/JSON-RPC.

Prerequisites (Ubuntu)

Install the required system packages, Rust toolchain, and the Terraform MCP bridge. The following table summarizes the key prerequisites and where to find them.

Requirement	Purpose	Install / Reference
build tools	Compile native dependencies	See the command below
Rust (rustup)	Build the `tfmcp` crate	See the command below
Terraform MCP bridge	Runs the MCP server and handles Terraform calls	`cargo install tf-mcp` or `cargo install terraform-mcp`

Install the build tools:

sudo apt-get update
sudo apt-get install -y build-essential

Install Rust via rustup:

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
# follow the prompts and add Rust to your PATH (typically by sourcing ~/.cargo/env)
source "$HOME/.cargo/env"

Install the Terraform MCP bridge (the binary is commonly named tfmcp):

# Either of these may be available depending on the crate name/version
cargo install tf-mcp
# or
cargo install terraform-mcp

Cargo will download and compile crates during installation; when complete the tfmcp binary should be on your PATH.

Start the MCP bridge / server

Start the MCP server so it can accept MCP-style requests over stdio in this demo:

tfmcp mcp

The server will run in the foreground and listen for JSON-RPC messages on stdin/stdout.

Create a sample Terraform project

Create a working directory and a minimal Terraform configuration that writes a local file. Create the directory and enter it:

mkdir terraform-demo
cd terraform-demo

Create main.tf with the following content:

terraform {
  required_providers {
    local = {
      source  = "hashicorp/local"
      version = "~> 2.0"
    }
  }
}

provider "local" {}

resource "local_file" "example" {
  filename = "${path.module}/example.txt"
  content  = "Hello from tfmcp!"
}

Initialize and validate the workspace, then create a plan:

terraform init
terraform validate
terraform plan

Sample (cleaned) plan output:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # local_file.example will be created
  + resource "local_file" "example" {
      + content               = "Hello from tfmcp!"
      + filename              = "./example.txt"
      + directory_permission  = "0777"
      + file_permission       = "0777"
      + id                    = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Interact with the Terraform MCP server via JSON-RPC (stdio)

While tfmcp mcp is running in one terminal, send JSON-RPC messages from another terminal using a heredoc. The example sequence below performs:

An initialize request to the MCP server.
A tools/call request for get_terraform_plan.
A tools/call request for apply_terraform with auto_approve=true.

Send these requests via stdio:

tfmcp mcp <<EOF
{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}}
{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "get_terraform_plan", "arguments": {}}}
{"jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": {"name": "apply_terraform", "arguments": {"auto_approve": true}}}
EOF

For quick reference, common MCP tool calls used in this demo:

Method	Purpose	Example
`initialize`	Prepare the MCP tool session	`{"jsonrpc":"2.0","id":1,"method":"initialize","params":{}}`
`tools/call` with `get_terraform_plan`	Request a Terraform plan	`{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_terraform_plan","arguments":{}}}`
`tools/call` with `apply_terraform`	Apply the Terraform plan	`{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"apply_terraform","arguments":{"auto_approve":true}}}`

Wrap any JSON examples containing curly braces in code blocks to avoid parsing issues (as done above).

Security policy and auto-approve

By default the MCP bridge may block automated apply operations for safety. If auto-approve is blocked, you will see an error such as:

{
  "jsonrpc":"2.0",
  "id":3,
  "error":{
    "code":-32603,
    "message":"Failed to apply Terraform configuration: Auto-approve for apply operation blocked by security policy. Set TFMCP_ALLOW_AUTO_APPROVE=true to enable."
  }
}

Setting TFMCP_ALLOW_AUTO_APPROVE=true allows automated apply operations. Only enable this when you trust the Terraform configuration and understand the security implications.

If you decide to allow auto-approve, export the environment variable and re-run the JSON-RPC sequence:

export TFMCP_ALLOW_AUTO_APPROVE=true

# Re-send the JSON-RPC sequence (initialize, plan, apply)
tfmcp mcp <<EOF
{"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}}
{"jsonrpc": "2.0", "id": 2, "method": "tools/call", "params": {"name": "get_terraform_plan", "arguments": {}}}
{"jsonrpc": "2.0", "id": 3, "method": "tools/call", "params": {"name": "apply_terraform", "arguments": {"auto_approve": true}}}
EOF

Successful apply and verification

When the apply completes, the MCP server will return the standard Terraform apply summary, for example:

local_file.example: Creation complete after 0s [id=<resource-id>]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Verify the created file:

cat example.txt
# Output:
# Hello from tfmcp!

Why use Terraform with MCP?

Consistent control channel: If your orchestration or automation stack already uses MCP/JSON-RPC, adding Terraform as an MCP tool keeps infrastructure control within the same messaging paradigm.
Programmatic integration: Enables other agents, CI/CD pipelines, or AI assistants to request Terraform operations programmatically without shelling out or managing separate APIs.
Auditability & policy: An MCP gateway can centralize security checks, logging, and policy enforcement around Terraform operations.

Troubleshooting tips

Ensure tfmcp is on your PATH after cargo install (check ~/.cargo/bin).
If terraform init fails, review provider version constraints and network access to provider registries.
If JSON-RPC messages are not being processed, confirm tfmcp mcp is running in the terminal where you expect it and that your heredoc is directed at the same tfmcp instance.

Summary

Installed the Terraform MCP bridge (tfmcp) and required toolchain.
Created a simple Terraform configuration that writes a local file.
Executed Terraform init/plan/apply through MCP JSON-RPC calls (stdio).
Addressed auto-approve security via the TFMCP_ALLOW_AUTO_APPROVE environment variable.
Verified the resulting resource and discussed reasons to use Terraform via MCP in automated systems.

Links and references

Terraform
JSON-RPC specification
Rustup (install Rust)
Terraform local provider: https://registry.terraform.io/providers/hashicorp/local

If you need an example for integrating this into a CI pipeline or automating the JSON-RPC calls programmatically (Python, Node, etc.), I can provide sample clients that interact with tfmcp via stdio.

Introduction

Pre-requisites

Core Concepts

Leveraging MCP for Daily Work

Demo Creating a Resource in Terraform

Prerequisites (Ubuntu)

Start the MCP bridge / server

Create a sample Terraform project

Interact with the Terraform MCP server via JSON-RPC (stdio)

Security policy and auto-approve

Successful apply and verification

Why use Terraform with MCP?

Troubleshooting tips

Summary

Links and references

Watch Video

​Prerequisites (Ubuntu)

​Start the MCP bridge / server

​Create a sample Terraform project

​Interact with the Terraform MCP server via JSON-RPC (stdio)

​Security policy and auto-approve

​Successful apply and verification

​Why use Terraform with MCP?

​Troubleshooting tips

​Summary

​Links and references

Watch Video

Prerequisites (Ubuntu)

Start the MCP bridge / server

Create a sample Terraform project

Interact with the Terraform MCP server via JSON-RPC (stdio)

Security policy and auto-approve

Successful apply and verification

Why use Terraform with MCP?

Troubleshooting tips

Summary

Links and references