Terraform integration for AI agents.
Terraform integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Terraform tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.
Real Terraform actions, managed and audited.
Your user connects Terraform once; your agent can then use Terraform Cloud to manage organizations, projects, workspaces, variables, locks, and state versions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.
- 1
Your user grants Terraform access once (OAuth) — the token lands in the vault.
- 2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
- 3
Every routed call appends a hash-chained audit record — nothing leaves your infra.
Supported Terraform tools.
26 tools are generated from the published Terraform catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.
Showing 26 tools. All published catalog entries are included in this page's server-rendered HTML.
- Create organization
- Create a Terraform organization.
- organizations
- Create project
- Create a project in an organization.
- organizations
- Create workspace
- Create a workspace in an organization.
- organizations
- Create workspace variable
- Create a variable for a workspace.
- workspaces
- Delete organization
- Delete a Terraform organization.
- organizations
- Delete project
- Delete a project by ID.
- projects
- Delete workspace
- Delete a workspace by organization and name.
- organizations
- Delete workspace variable
- Delete a workspace variable.
- workspaces
- Force unlock workspace
- Force unlock a workspace by ID.
- workspaces
- Get current state version
- Get the current state version for a workspace.
- workspaces
- Get organization
- Get a Terraform organization by name.
- organizations
- Get project
- Get a project by ID.
- projects
- Get state version
- Get a state version by ID.
- state-versions
- Get workspace
- Get a workspace by organization and name.
- organizations
- List organizations
- List organizations accessible to the token.
- organizations
- List projects
- List projects in an organization.
- organizations
- List state versions
- List state versions using filters such as organization and workspace.
- state-versions
- List workspace variables
- List variables for a workspace.
- workspaces
- List workspaces
- List workspaces in an organization.
- organizations
- Lock workspace
- Lock a workspace by ID.
- workspaces
- Rollback workspace state version
- Rollback a workspace to a previous state version.
- workspaces
- Unlock workspace
- Unlock a workspace by ID.
- workspaces
- Update organization
- Update a Terraform organization.
- organizations
- Update project
- Update a project by ID.
- projects
- Update workspace
- Update a workspace by organization and name.
- organizations
- Update workspace variable
- Update a workspace variable.
- workspaces
Terraform integration, answered
- How do AI agents use Terraform through Open Connector?
- Your user connects Terraform once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Terraform tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
- Is this a Terraform MCP server?
- Yes. Open Connector can serve Terraform as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Terraform actions with credentials injected server-side.
- Where do Terraform credentials live?
- In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.
Give your agents Terraform — keep the keys.
Open source, self-hostable, with Terraform credentials that never leave your infrastructure. Run it from source today.