ToolRepute
← Back to MCP database
MCPv1.0.0Registry: active

Terraform

Generate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise

io.github.hashicorp/terraform-mcp-server

Publication

Published

Publisher

hashicorp

Publisher identity: Not verified

Primary source

Official MCP Registry record

https://github.com/hashicorp/terraform-mcp-server

Static analysis · human review · publication

Security evidence

Scanner signals, coverage and review decisions describe different parts of this report.

How ToolRepute evaluates MCP integrations
Scan status
completed
Coverage
Sufficient source coverage
Static risk signals
0/100 · none
Finding count
3
Highest finding severity
low
Human review
Approved review
Review freshness
Stale review
Publication
Published

Scan coverage and reliability

The scan completed with enough source coverage for ToolRepute's current review workflow. This does not verify runtime behavior.

Reliability: Meets current requirements

Scanner version
V6
Scan run
339
Last scan date
2026-09-26
Files scanned
217
Bytes scanned
949,422
Manifest
Found
Source commit
Pinned
Truncation
No

Analyzed source

https://github.com/hashicorp/terraform-mcp-server

Analyzed commit: 4d3b9eff58854c7489c37c086d8ec85acf88c653

Human review and publication

This historical decision does not establish current approval for the current review workflow. It may concern an older run, changed evidence or an older scanner.

Review decision
Approved review
Review date
2026-09-26
Reviewed scan run
339
Reviewed commit
4d3b9eff58854c7489c37c086d8ec85acf88c653

Publication is a decision to display evidence under ToolRepute's current rules, not a security certification, endorsement or guarantee.

Internal reviewer identity, review notes and private metadata are not displayed.

Published findings

LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/compare-versions.shFinding details and evidence

Executable file permission tracked

Category: code execution

What was found

The repository tracks a file with executable permission.

Why it matters

Executable files identify code or tooling that may be run directly.

Evidence snippet

No public snippet is available. It was not recorded or is withheld to protect sensitive content.

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.

Limitations and legitimate-use context

Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.

LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/crt-build.shFinding details and evidence

Executable file permission tracked

Category: code execution

What was found

The repository tracks a file with executable permission.

Why it matters

Executable files identify code or tooling that may be run directly.

Evidence snippet

No public snippet is available. It was not recorded or is withheld to protect sensitive content.

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.

Limitations and legitimate-use context

Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.

LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/update-json-version.shFinding details and evidence

Executable file permission tracked

Category: code execution

What was found

The repository tracks a file with executable permission.

Why it matters

Executable files identify code or tooling that may be run directly.

Evidence snippet

No public snippet is available. It was not recorded or is withheld to protect sensitive content.

Scanner interpretation

A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.

Recommended check

Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.

Limitations and legitimate-use context

Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.

Reputation evidence

Insufficient evidence · low confidence · model v1

Evidence support score: 5/100. This is separate from risk, review and publication.

Assessment as of 2026-10-22. Live repository HEAD is not checked when this page loads.

Security evidence · 0/25LIMITED · low confidence

Reliable mapped v6 scope is not established; evidence age: recent.

Static support is capped at 18/25 before a risk deduction of ceil(riskScore/4); zero findings does not establish safety.

Last observed: 2026-09-26

  • scan record 339: Scanner v6; completed; manifest found; sufficient scope true; 217 files / 949422 bytes; 3 findings; not truncated; scanner risk score 0.Commit 4d3b9eff58854c7489c37c086d8ec85acf88c653Source evidence

Static analysis covers a bounded source scope, not runtime, dependencies in full, or hosted behavior.

Source transparency · 5/25STALE · low confidence

Completed matching public GitHub acquisition: not established (+0).

Unique primary mapping: observed (+5).

Completed matching pinned commit: not established (+0).

Completed matching source mapping: not established (+0).

Matching manifest and sufficient untruncated scope: not established (+0).

Last observed: 2026-10-04

  • source record 15938: Primary mapping is incomplete or changed. Live repository HEAD is not checked by page requests.Source evidence
  • scan record 339: Scanner v6; completed; manifest found; sufficient scope true; 217 files / 949422 bytes; not truncated.Commit 4d3b9eff58854c7489c37c086d8ec85acf88c653Source evidence

A source mapping does not prove ownership. Repository availability and live HEAD are not rechecked here.

Review freshness · 0/25STALE · low confidence

Current artifact-bound approval earns 25; matching approval with unchecked live HEAD earns 8; stale, missing or rejected evidence earns 0.

Last observed: 2026-09-26

  • review record 62: Decision: approved; reviewed run 339; NEXT-11 freshness: stale.

Page requests make no upstream probe. An old approval is not approval of changed evidence.

Registry consistency · 0/10UNKNOWN · low confidence

Unique primary, normalized active/latest official registry observation earns 10 within 30 days, 5 within 90, otherwise 0.

Last observed: 2026-10-04

  • registry record 15938: Normalized official record: false; active: true; latest: true; observation age: recent.

Registry consistency is a source-record observation, not identity verification or a security endorsement.

Publisher identity confidence · 0/15UNKNOWN · low confidence

No verified legal, domain or repository-ownership binding is available; free text and the registry verification flag earn no credit.

Last observed: Not available

    Publisher name and registry namespace cannot establish legal identity or ownership.

    Recorded assessment history (1)

    History starts with explicit captures in model v1. Past source and review state cannot be fully reconstructed. Page reads do not save snapshots; changes in the live assessment appear in history only after an explicit capture.

    1. 2026-10-11 · model v1 · 5/100 · low confidence · scan 3394d3b9eff58854c7489c37c086d8ec85acf88c653
      Recorded signal breakdown
      • Security evidence: 0/25 · LIMITED
      • Source transparency: 5/25 · STALE
      • Review freshness: 0/25 · STALE
      • Registry consistency: 0/10 · UNKNOWN
      • Publisher identity confidence: 0/15 · UNKNOWN

    Reputation reflects ToolRepute-observed evidence only; it is not a guarantee of security.

    Signals may be incomplete or stale. Runtime and hosted behavior may differ from scanned source.

    Publisher identity has no verified binding. Repository ownership and legal identity are not established.

    This score measures support in the available evidence, not the probability that a tool is safe.

    Registry data

    Version

    1.0.0

    Packages

    1

    Remote endpoints

    0

    Enrichment

    complete

    Last fetched

    2026-10-04

    Registry inclusion identifies the source record. It is not a ToolRepute security endorsement.

    Normalized sources

    Structured from the Official MCP Registry record.

    Enriched 2026-10-04

    github

    https://github.com/hashicorp/terraform-mcp-server

    Packages

    oci· stdio

    docker.io/hashicorp/terraform-mcp-server:1.0.0

    More reviewed MCP servers

    Continue exploring integrations with published ToolRepute reviews.

    adtest-mcp

    AI-only ad scoring for Claude: score image, video or text ads on 13 dimensions before you spend.

    bolthub

    The bolthub API marketplace, L402 gateways, and your other MCP servers, on one Lightning budget.

    brave-search-mcp-server

    Brave Search MCP Server: web results, images, videos, rich results, AI summaries, and more.