// SCAN REPORT

Terraform Best Practices

18 tools. 5 can modify or destroy data without limits.

5 write tools that can modify data. Rate limits recommended.

Last updated: 30 Jun 2026

5 can modify or destroy data

13 read-only

18 tools total

Community server · catalogue entry verified 30/06/2026

How to control Terraform Best Practices ↓

TOOL MAP

What Terraform Best Practices exposes to your agents

Read (13) Write / Execute (5) Destructive / Financial (0)

Running more than one server? Check your whole stack →

MOST DANGEROUS TOOLS

High Risk

The most dangerous Terraform Best Practices tools

Execute · Medium run_checkov This tool executes an external command/tool (Checkov, a popular infrastructure-as-code security scanner) over a specified directory. Execute · High run_infracost This tool executes an external command (Infracost analysis) on Terraform infrastructure code. Execute · High run_kics This tool runs KICS (Keeps Infrastructure as Code Secure), an external security scanning engine. Execute · High run_tflint This tool triggers execution of an external linter process on user-supplied Terraform code.

5 of Terraform Best Practices's 18 tools can modify, destroy, or commit something on every call — and an agent calls them with no built-in limits.

POLICY

How to control Terraform Best Practices

PolicyLayer is an MCP gateway — it sits between your AI agents and Terraform Best Practices, and nothing reaches the server without passing your rules. These are the rules we recommend:

Cap read operations

{
  "analyze_state_management": {
    "limits": [
      {
        "counter": "analyze_state_management_per_minute",
        "window": "minute",
        "max": 60,
        "scope": "grant"
      }
    ]
  }
}

Controls API costs and prevents retry loops from exhausting upstream rate limits.

Create a free account and register Terraform Best Practices — nothing to install.
Add these rules — paste them, or build them visually. Tune the limits to your setup.
Point your MCP client (Claude, Cursor, anything) at your gateway URL.

ENFORCE POLICY ON TERRAFORM BEST PRACTICES →

Instant setup, no code required.

FULL CATALOGUE

All 18 Terraform Best Practices tools

EXECUTE 5 tools

Execute run_checkov Run checkov over a Terraform directory. Execute run_infracost Run infracost breakdown for a Terraform directory. Execute run_kics Run kics IaC scanning against Terraform code. Execute run_tflint Run tflint against a Terraform project directory. Execute run_trivy Run trivy config scanning against Terraform code.

READ 13 tools

Read analyze_state_management Assess Terraform backend/state strategy and recommend safer state management patterns. Read analyze_terraform_code Analyze Terraform code structure, modularity, variables, and best practices. Read analyze_terraform_performance Analyze Terraform code for performance risks and optimization opportunities. Read fetch_provider_best_practices Fetch Terraform best-practice guidance for Azure, AWS, or GCP from curated checks and optional live provider d Read fetch_terraform_best_practices Fetch Terraform best-practice guidance from curated checks and optional live summaries from terraform-best-pra Read fetch_terraform_registry_guidance Fetch Terraform Registry best-practice guidance with optional provider/resource/module context. Read generate_compliance_summary Generate a compliance summary report from multiple security scan outputs. Read generate_cost_report Generate a comprehensive cost report from infracost output with optimization suggestions. Read generate_terraform_module_docs Generate markdown documentation for Terraform modules from source code. Read recommend_terraform_modules Recommend Terraform Registry modules based on code patterns and deployment intent. Read suggest_security_hardening Analyze security scan output and suggest hardening steps to improve infrastructure security. Read suggest_terraform_architecture Suggest Terraform architecture and repository patterns for multi-environment infrastructure. Read suggest_terraform_testing_strategy Recommend Terraform testing strategy and CI stages based on risk and change cadence.

EXPLORE

Related servers

Other MCP servers with similar tools — same risk classification, starter policies for each.

FAQ

Questions about Terraform Best Practices

Is the Terraform Best Practices MCP server safe to use without restrictions? +

The Terraform Best Practices server is primarily read-only with 13 read tools. While it cannot modify data, an agent in a retry loop can make thousands of API calls per minute, exhausting rate limits and running up costs. Rate limiting is still recommended.

How many tools does the Terraform Best Practices MCP server expose? +

18 tools across 3 categories: Execute, Read, Write. 13 are read-only. 5 can modify, create, or delete data.

How do I enforce a policy on Terraform Best Practices? +

Register the Terraform Best Practices MCP server in PolicyLayer, apply the suggested rules above (adjust the limits to your use case), and point your AI client at the PolicyLayer proxy URL instead of the server directly. Your agents keep the same tools; PolicyLayer evaluates every call against policy before it executes. Nothing to install, live in minutes.

Enforce policy on every Terraform Best Practices tool call.

Deterministic rules across all 18 Terraform Best Practices tools. Per-identity grants. Full audit log. Live in minutes. Nothing to install.

ENFORCE POLICY ON TERRAFORM BEST PRACTICES →

Instant setup, no code required.

18 Terraform Best Practices tools catalogued and risk-classified — across an index of 43,000+ MCP servers.