Guides7 min read

Best MCP Servers for Terraform Developers and DevOps Engineers in 2026

Writing Terraform, OpenTofu, or Pulumi infrastructure as code? These MCP servers give your AI assistant access to your modules, state files, cloud provider APIs, and documentation — for accurate IaC generation and debugging.

By MyMCPTools Team·

Terraform and infrastructure as code (IaC) development is one of the highest-stakes contexts for AI assistance — a misplaced resource definition or wrong attribute value can provision unintended infrastructure or, worse, destroy what's already running. AI suggestions that lack context about your actual module structure, provider versions, and state are actively dangerous. MCP servers solve this by giving your AI direct access to your IaC codebase and cloud environment.

This guide covers the MCP servers that deliver the most value for Terraform and OpenTofu developers.

Why Terraform Needs MCP Context

Terraform configurations are highly context-dependent. The same resource block means different things depending on your provider version, your module structure, your variable definitions, and your existing state. An AI generating a new resource block without seeing your existing modules and variable definitions will produce code that compiles but breaks your dependency graph. MCP context prevents this.

1. Filesystem MCP Server — Module Structure and Configuration Access

Terraform projects are organized around modules — root modules, reusable child modules, and environment-specific configurations. The Filesystem MCP server gives your AI the ability to read your full module tree, understand variable definitions and outputs, and see how modules compose together. This is essential for accurate resource block generation and refactoring.

Key capabilities:

  • Read .tf files across your entire module tree
  • Navigate environment configurations (dev, staging, prod workspaces)
  • Access variables.tf, outputs.tf, and locals.tf definitions
  • Read provider configuration and version constraints in versions.tf

Best for: All Terraform developers. Module composition and variable passing are the most common sources of Terraform errors — your AI needs to see the full module tree to give accurate advice about resource dependencies and variable definitions.

2. AWS MCP Server — Live Resource Context

The AWS MCP server gives your AI direct access to your AWS environment — existing resources, IAM policies, VPC configurations, and service quotas. When writing Terraform code to provision or modify AWS resources, having access to the live state prevents common errors like referencing VPCs that don't exist in your account, using IAM role ARNs that haven't been created yet, or configuring security groups inconsistently with existing network rules.

Key capabilities:

  • List existing VPCs, subnets, security groups, and networking resources
  • Read IAM role and policy definitions for accurate ARN references
  • Check service quotas before provisioning new resources
  • Inspect existing resource tags and naming conventions

Best for: AWS Terraform developers. The gap between what Terraform plans to create and what already exists in your AWS account is where most configuration errors originate. AWS MCP closes that gap.

3. GitHub MCP Server — Module Registry and Team Code

Terraform module development is inherently collaborative — teams share modules via GitHub, reference public registry modules, and review infrastructure changes through PRs. The GitHub MCP server gives your AI access to your module repositories, open PRs with infrastructure changes, and the Terraform Registry source code for modules you're consuming.

Key capabilities:

  • Read your organization's shared Terraform module repositories
  • Review open PRs with proposed infrastructure changes before approving
  • Access Terraform Registry module source code for advanced customization
  • Check GitHub Actions CI/CD workflow configurations for plan/apply pipelines

Best for: Infrastructure teams using GitHub for Terraform code review. Terraform changes are high-risk — having your AI read the full PR diff alongside your existing module structure enables more accurate review and safer change assessment.

4. Brave Search MCP Server — Provider Documentation and Version Notes

Terraform provider documentation changes with every provider version — resource attributes get deprecated, new arguments appear, and provider-specific behaviors shift between releases. Brave Search MCP keeps your AI's recommendations current with the actual provider documentation for the versions you're running, rather than suggesting patterns from providers two major versions back.

Key capabilities:

  • Look up current AWS, GCP, Azure, and Cloudflare provider resource documentation
  • Find provider upgrade guides and breaking changes between major versions
  • Research Terraform and OpenTofu feature differences for migration planning
  • Search for community solutions to specific provider behavior issues

Best for: All Terraform developers, especially teams managing provider version upgrades. Provider documentation drift is a constant problem — Brave Search ensures your AI gives advice for the provider version you're actually using.

5. PostgreSQL MCP Server — Terraform State Backend Context

Many teams use a PostgreSQL backend for Terraform state (via the pg backend) or store infrastructure metadata in PostgreSQL databases that their Terraform resources create. The PostgreSQL MCP server gives your AI access to your state backend schema and application database structure — enabling accurate data source definitions and resource lifecycle management.

Key capabilities:

  • Inspect Terraform state backend database structure
  • Read application database schema for accurate data source definitions
  • Understand database resource dependencies for correct provisioning order
  • Verify database resource configurations match existing infrastructure

Best for: Teams using PostgreSQL as a Terraform state backend or provisioning PostgreSQL databases with Terraform. State backend context helps your AI understand workspace isolation and state locking patterns specific to your setup.

6. Cloudflare MCP Server — DNS and Edge Infrastructure

Cloudflare's Terraform provider covers DNS records, WAF rules, Workers, Pages, and zero-trust configuration — and many infrastructure teams manage their Cloudflare resources alongside their cloud provider resources in the same Terraform codebase. The Cloudflare MCP server gives your AI access to your live Cloudflare zone configuration, preventing DNS record conflicts and WAF rule duplication.

Key capabilities:

  • Read existing DNS records to prevent conflicting record creation
  • Inspect WAF rules and firewall configuration for accurate provider code
  • Understand Workers and Pages resource structure for IaC generation
  • Review zero-trust access policy configuration

Best for: Teams managing Cloudflare resources with Terraform. DNS misconfigurations propagate globally and are hard to debug — the Cloudflare MCP server ensures your Terraform-generated DNS records don't conflict with existing zone configuration.

Terraform Developer MCP Configuration

For a complete Terraform development environment, configure these servers together:

  • IaC files: Filesystem MCP (modules, variables, provider config)
  • Cloud context: AWS MCP (live resource state, IAM, networking)
  • Team code: GitHub MCP (shared modules, PR review, CI/CD workflows)
  • Documentation: Brave Search MCP (current provider docs, version guides)
  • State backend: PostgreSQL MCP (if using pg backend)
  • DNS/edge: Cloudflare MCP (if managing Cloudflare with Terraform)

Infrastructure as code is one of the highest-value contexts for AI assistance — a well-configured AI can generate complex multi-resource configurations accurately. But it's also one of the highest-risk contexts for AI errors — incorrect IaC can destroy production infrastructure. MCP servers give your AI the context it needs to be a helpful, safe infrastructure partner rather than a confident generator of plausible-looking but broken configurations.

Related guides:

Recommended Tools

Better Stack

Free Plan

Get alerted when your APIs, browser tests, payment pipelines, or MCP server dependencies go down. Used by 100K+ developers.

Start monitoring free →

1Password

14-day Free Trial

Store and inject API keys, payment credentials, tokens, and file access secrets into your MCP server configs. Trusted by 150K+ developers.

Try 1Password free →

🔧 MCP Servers Mentioned in This Article

📁

Filesystem MCP Server

sandboxed read, write, edit, move and search access to an explicit whitelist of local directories, and it is the reference implementation most other filesystem MCP servers are modelled on. Shipped by Anthropic in the official modelcontextprotocol/servers monorepo (89,000+ stars, actively maintained), it is a Node.js server published to npm as @modelcontextprotocol/server-filesystem. The part worth understanding before you install is the access-control model, because there are now two ways to grant directories and they do not compose. Method one is command-line arguments: `npx -y @modelcontextprotocol/server-filesystem /path/one /path/two`. Method two, and the one the maintainers recommend, is MCP Roots — a client that supports the roots protocol sends its roots at initialization, and those roots COMPLETELY REPLACE any directories passed on the command line, then get replaced again on every `notifications/roots/list_changed`. That means allowed directories can change at runtime without restarting the server, but it also means a roots-capable client silently overrides your CLI arguments. If the server starts with no arguments and the client either does not support roots or sends an empty list, initialization throws an error. The tool surface is broad: `read_text_file` (with mutually exclusive `head`/`tail` line windows), `read_media_file` returning base64 image/audio content blocks, `read_multiple_files` which keeps going when individual reads fail, `write_file`, `edit_file`, `create_directory`, `list_directory`, `list_directory_with_sizes`, `move_file`, `search_files`, `directory_tree`, `get_file_info` and `list_allowed_directories`. `edit_file` is the one to learn — it does line-based and multi-line pattern matching with indentation detection and preservation, returns a git-style diff with context, and supports `dryRun: true` so you can preview a change before applying it; the maintainers recommend always running a dry run first. Every operation is refused outside the allowed set, and `list_allowed_directories` is the fastest way to confirm what the server actually believes it can touch.

Local
💻

GitHub MCP Server

authenticated access to the whole GitHub platform — repositories, files, branches, issues, pull requests, Actions runs, security alerts, discussions and notifications — from Claude, Cursor, VS Code, Copilot CLI and any other MCP host. There is no npm package for this server, and that trips up most people who try to install it: `@github/mcp-server` is not published to the npm registry, so any `npx` line you find for it will fail. GitHub ships it three other ways. The easiest is the hosted remote server at https://api.githubcopilot.com/mcp/, which needs no install at all — point an HTTP-transport MCP client at that URL and log in with OAuth (VS Code 1.101+, Claude Desktop, Claude Code, Cursor and Windsurf all support this). The second is the official Docker image ghcr.io/github/github-mcp-server, which is what the copy-paste command on this page runs; on github.com it now performs a browser-based OAuth login on first use and keeps the token in memory only, which is why the published Docker configs map a fixed loopback callback port (-p 127.0.0.1:8085:8085 with GITHUB_OAUTH_CALLBACK_PORT=8085) so the container can receive the callback. Prefer a token? Set GITHUB_PERSONAL_ACCESS_TOKEN instead — it takes precedence over OAuth, and the minimum useful scopes are repo, read:org and read:packages. The third is the native Go binary from the repository's releases, which needs no fixed port for the OAuth flow. GitHub Enterprise Server has no hosted option: use the local server with --gh-host or GITHUB_HOST set to your instance (include the https:// scheme — it defaults to http://, which GHES rejects). Toolsets can be narrowed with GITHUB_TOOLSETS, and an insiders channel is available at /mcp/insiders or via the X-MCP-Insiders header.

Auth required📘
☁️

AWS MCP Servers

AWS Labs maintains a monorepo of specialized, open-source MCP servers that bring AWS best practices directly into AI-assisted development workflows, spanning infrastructure, data, AI/ML, cost management, and healthcare/life-sciences domains. Rather than one monolithic server, the project ships dozens of focused servers you install individually depending on the task: the AWS Documentation MCP Server for real-time official docs and API references, dedicated servers for Terraform/CDK/CloudFormation infrastructure-as-code, container and serverless platforms (ECS, EKS, Lambda), SQL/NoSQL databases (DynamoDB, RDS, Aurora), search and analytics (OpenSearch), messaging (SQS/SNS), and cost/billing analysis. Most servers install via uvx with a package name like awslabs.aws-documentation-mcp-server, run locally over stdio, and use standard AWS credential chains (IAM roles, profiles, or access keys) rather than exposing raw account credentials to the model. AWS also now offers a managed, remote "AWS MCP Server" (in preview) that combines full API coverage with pre-built agent SOPs, syntactically validated API calls, and complete CloudTrail audit logging for teams that want centralized governance instead of running servers locally. The Getting Started with Kiro/Cursor/VS Code/Claude Code sections in the repo provide one-click install configs for each server, making it straightforward to wire up only the AWS services a given project actually touches.

Local
☁️

Cloudflare MCP Server

Cloudflare ships two different things under this name. The mcp-server-cloudflare repo provides 16 remote, domain-specific MCP servers rather than one monolith — Documentation, Workers Bindings (storage/AI/compute primitives), Workers Builds, Observability (logs/analytics), Container sandboxes, Browser Rendering (fetch pages, convert to markdown, screenshots), Logpush health, AI Gateway (prompt/response search), AI Search, Audit Logs, DNS Analytics, Digital Experience Monitoring, Cloudflare One CASB, Radar, GraphQL analytics and the Agents SDK docs server, each on its own `*.mcp.cloudflare.com/mcp` hostname. Separately, the Cloudflare API MCP server at mcp.cloudflare.com/mcp (repo: cloudflare/mcp) exposes the whole 2,500+ endpoint Cloudflare API through just two tools, `search` and `execute`, using the Code Mode pattern — model-written JavaScript runs in an isolated Dynamic Worker, costing ~1,000 tokens of context against the ~1.17M an equivalent native-tool server would need. Pick a domain server when you want a readable, curated tool list for one product area; pick the API server for breadth or for endpoints nobody wrote a tool for. All endpoints are Streamable HTTP on `/mcp` and support the MCP 2026-07-28 spec; the historical `/sse` URLs remain as aliases for the same Streamable HTTP handler but no longer serve the deprecated HTTP+SSE transport, so clients pinned to SSE must switch. Auth is OAuth on connect, or a scoped Cloudflare API token as a bearer header for CI. Clients without native remote-MCP support bridge via `npx mcp-remote https://<subdomain>.mcp.cloudflare.com/mcp`.

Live📘
🔍

Brave Search MCP Server

The Brave Search MCP Server is the official server from Brave that gives AI assistants privacy-first web search through the independent Brave Search API — no tracking, no profiling, and results drawn from Brave's own web index rather than Google or Bing. It exposes five distinct tools that map directly to the Brave Search API endpoints: brave_web_search for general queries with pagination, freshness filters, and safe-search controls; brave_local_search for businesses, restaurants, and points of interest with automatic location filtering; brave_news_search for recent articles and current events; brave_image_search for image discovery; and brave_video_search for finding videos across the web. Authentication uses a single BRAVE_API_KEY (free tier available at brave.com/search/api) or a mounted BRAVE_API_KEY_FILE for Docker-secret setups. Install in Claude Desktop, Cursor, Windsurf, or VS Code with one npx command and choose stdio or streamable-HTTP transport. Because Brave operates its own crawler and index, the Brave Search MCP server is a strong choice for developers who want an alternative to Google-dependent search tools, need reproducible non-personalized results, or care about data privacy in agent workflows — Claude can pull fresh web context, verify facts, and research topics without leaking queries to ad-tech pipelines.

Local
🗄️

PostgreSQL MCP Server

The PostgreSQL MCP server was the Model Context Protocol reference server for Postgres, and it is retired: the source now sits in modelcontextprotocol/servers-archived — a repository GitHub reports as archived, described as "Reference MCP servers that are no longer maintained" — and the npm package @modelcontextprotocol/server-postgres carries a deprecation notice reading "Package no longer supported." It still installs and still runs, which is why most third-party setup articles have not caught up. What it provides is deliberately small: a single tool, query, which executes read-only SQL inside a READ ONLY transaction, plus per-table schema information exposed as MCP resources at postgres://<host>/<table>/schema, with column names and data types discovered from database metadata. There is no index advice, no health check, no separate schema-listing tool, and no write mode. Install is npx @modelcontextprotocol/server-postgres with a postgres:// connection string as the argument. For active work against Postgres, the maintained alternative is Postgres MCP Pro (crystaldba/postgres-mcp), which exposes nine tools including index tuning against hypothetical indexes and a database health check, and has an explicit restricted access mode; if your database is hosted on Supabase or Neon, their platform servers add branching and logs that a raw Postgres connection cannot see. Reach for this archived server only when you want the smallest possible surface — one process, one read-only query tool, nothing else.

Local📘

📚 More from the Blog