Writes and reviews Terraform against the registry, brings existing resources under management, and audits the state file before it drifts.
Built for: The engineer who inherited a cloud account built by hand and has been asked to put it in Terraform without breaking it.
The button opens the checkout, where the 2 servers and 5 skills are listed one by one. Every member is free, so the checkout lists them and asks for no card.
The reason to buy a stack rather than five listings: each line below needs more than one member connected at the same time.
Look up the exact resource arguments for the provider version you pin in the Terraform Registry, instead of trusting a remembered example.
Find resources that exist in the account but not in code, and generate the import blocks and configuration for them.
Audit a state file for security misconfigurations and compare it with an earlier state to see what changed outside a plan.
Refactor a flat configuration into modules in HashiCorp's style, and lint and validate it before the first plan.
What each part contributes, and why it was picked over the obvious alternative. Prices and permissions are read from the listings, so nothing here can disagree with the catalogue.
HashiCorp's own server: providers, resources, modules and policies from the Terraform Registry, so generated code uses arguments that exist in the version you pin.
Reads a Terraform state file, summarises it, compares two states and audits the resources for security misconfigurations — without touching the cloud.
HashiCorp's style conventions for HCL — naming, file layout, variables — applied as the code is written rather than in review.
Terraform Search queries and bulk import, for bringing resources that were created by hand under management.
Reusable modules for AWS, Azure, GCP and OCI, so the second environment is an input to a module rather than a copy.
HashiCorp's guide for turning a monolithic configuration into modules without planning a destroy-and-recreate.
Runs terraform validate, tflint and checkov over .tf files and reads the findings back, before anyone runs a plan.
Every member is free, so the monthly figure is $0 whatever you do with the stack: nothing here is billed by the call, and only adding a paid member could change it.
| Part | What you are paying for | Monthly, as quoted |
|---|---|---|
| Terraform | Free | — |
| Tfstate Reader | Free | — |
| Skills | ||
| Terraform Style Guide | Free · context cost only | — |
| Terraform Search and Bulk Import | Free · context cost only | — |
| Terraform Module Library | Free · context cost only | — |
| Skill: Refactor Module | Free · context cost only | — |
| Terraform Validator | Free · context cost only | — |
| Everything above | $0 of servers plus $0 of skills, the same in a quiet month and a busy one | $0/mo |
Subscriptions at their monthly plan price; one-off licences spread over 12 months.
Install only these and the bill is nothing: 2 servers and 5 skills, and all 5 tools.
Nothing in this stack carries a call allowance, so nothing here can run out before the month does. The bill is decided when you install it, not when you use it.
The spend cap is one figure for the whole account, set in your dashboard and checked when an order is placed. On the call path what stops a retry loop is the plan's call allowance and its rate limit, and a refused call is never billed.
The steps below come before the install lines: what to decide and scope before connecting anything, in the order it matters. The lines themselves follow, part by part, for the client you pick.
npx mcprush@latest stack add iac-desk writes all 2 servers into Claude Code’s config in one go — or run the lines below one by one. The 5 skills are not included — add them with lines 03–07.
# 01 · Terraform
claude mcp add --scope user hashicorp-terraform-mcp '--' docker run -i --rm docker.io/hashicorp/terraform-mcp-server:1.0.0
# 02 · Tfstate Reader
claude mcp add --scope user tfstate-reader-mcp '--' uvx --with 'mcp<2' mcp-tfstate-reader
# 03 · Terraform Style Guide
npx mcprush@latest skill add hashicorp/terraform-style-guide
# 04 · Terraform Search and Bulk Import
npx mcprush@latest skill add hashicorp/terraform-search-and-bulk-import
# 05 · Terraform Module Library
npx mcprush@latest skill add wshobson/terraform-module-library
# 06 · Skill: Refactor Module
npx mcprush@latest skill add hashicorp/skill-refactor-module
# 07 · Terraform Validator
npx mcprush@latest skill add akin-ozer/terraform-validatornpx).uvx, docs.astral.sh/uv).Set-ExecutionPolicy -Scope CurrentUser RemoteSigned once, or type npx.cmd instead of npx (codex.cmd, gemini.cmd, grok.cmd likewise). PowerShell 7 needs neither.Nothing is connected until you approve it in Claude Code. mcprush is not in the path and meters nothing here.
Installed together, these tool surfaces add up. It is the first thing a security reviewer asks for, so what has been counted — and what nobody has counted yet — is on the page rather than in a PDF.
| Member | Tool surface | Write tools |
|---|---|---|
| Terraform | not imported | not recorded |
A stack's blast radius is the union of its members, not the worst of them. That union cannot be taken here, because 1 member of 2 has no imported tool surface — so the figure a review asks for is missing rather than low, and a member marked not imported is one nobody has counted rather than one that cannot write.
A stack is a default, not a verdict. These are the substitutions the maintainer would make, and what each one costs or saves.
A team that moved to OpenTofu reads providers and modules from the OpenTofu Registry through the project's own server — and it runs from npm, without Docker.
Written by the maintainer, kept on the page rather than in a support thread.
It does not run terraform apply. The desk writes code and reads state; applying stays with your pipeline and the person who approves the plan.
The state reader works on the file you give it. State kept in a remote backend has to be pulled first, and it can contain secrets, so read it on the machine that already holds them.
The HashiCorp member is a container image: it needs Docker, and the registry lookups it makes go to HashiCorp over the network.
A stack has an owner: whoever keeps it re-checks the combination when a member changes, and the members themselves are published by the people named on each row.
Tools to inspect code changes, run checks and prepare a pull request review.
Tools to investigate a bug report and work toward a reproducible test case.
Tools to investigate alerts, check recent changes and follow the runbook.