Which Terraform Platform Has the Best MCP Server?

HashiCorp, Scalr, Spacelift, and env0 all ship an MCP server as of July 2026, so the question is what the agent can change through it, and whose identity it uses when it does. Short answer: if you want agents executing changes end to end, Spacelift and env0 expose the most authority (runs, approvals, and in Spacelift's case direct provisioning). If you want agents investigating while humans hold the apply, Scalr's read-mostly server with per-user OAuth enforces that by design. HashiCorp's is the best registry-docs source if you're staying on HCP Terraform.

Scalr is our product, and this comparison reflects a view we hold about agent access. We've tried to keep every factual claim dated and checkable, and where a competitor's design is the better fit for a use case, we say so.

What is a Terraform MCP server?

A Terraform MCP server is a Model Context Protocol endpoint that exposes a Terraform platform's data and operations as tools an AI coding agent can call directly, instead of the agent shelling out to the CLI or scraping a web UI. In practice that means an assistant can ask for a workspace, read a plan, look up provider documentation, or open a run, using the platform's own authentication and permissions rather than a copied credential.

What Should You Compare MCP Servers On?

Not tool counts. Four properties determine what a server means for your risk posture, drawn from the access-class taxonomy in our primer on IaC with AI coding agents:

1. Read scope. Registry documentation only, or control-plane data: workspaces, runs, logs, variables, drift, state-derived inventory.
2. Write scope. Can it mutate configuration objects? Trigger runs? Approve applies? Provision resources directly? Each step widens what a compromised or confused session can do.
3. Identity model. A hosted endpoint with per-user OAuth inherits your existing RBAC per person. A local server with a static token is exactly as safe as that token's scope and storage.
4. Blast-radius controls. Toolset flags, read/write scope separation, and whether destructive operations need explicit enablement.

How Do the Platforms Compare?

The snapshot below was verified against vendor documentation and repositories on July 21, 2026. These servers change monthly; treat it as a starting point, not a purchase decision.

The detail behind the cells: HashiCorp's write operations are gated behind ENABLE_TF_OPERATIONS=true. Scalr's read scope covers environments, workspaces, runs, logs, policy results, drift, IAM, and billing and usage reports, and its OAuth inherits Scalr RBAC. Spacelift's mutations sit under mcp:read and mcp:write scopes. env0 authenticates with an API key pair.

Two entries deserve their own line. Terrakube has an official MCP server with workspace and module CRUD, but no run execution and no published releases yet, so it's early-stage rather than production tooling. Atlantis has no MCP or AI capability at all; as of July 2026 an MCP server exists only as an unassigned feature request, which is consistent with Atlantis's position as a lean pull-request automation tool.

Which Design Philosophy Fits Agent Work?

The table shows two philosophies, and naming them matters more than ranking them.

Maximum agent authority. Spacelift and env0 built their servers so an agent can complete a change: trigger the run, approve the deployment, in Spacelift's case create resources directly through Intent. If your goal is closed-loop automation where agents execute routine changes with humans supervising by exception, that's genuine capability and those platforms deliver more of it. HashiCorp's server lands nearby once operations are enabled, with run creation and apply actions available against HCP Terraform and TFE.

Agent as investigator, human as executor. Scalr's server exposes broad read access, including areas the others mostly don't cover, like billing, IAM, and fleet-wide usage reports, but its write surface stops at creating workspaces and variables. An agent connected to Scalr's MCP can triage a failed run, classify drift, audit policy coverage, or answer "which workspaces still run Terraform 1.5" across the fleet. It cannot start a run or approve an apply, because those tools don't exist in the server, regardless of what the authenticated user could do in the UI.

We hold the second view. The reviewed plan is the safety boundary, and a tool that can't cross the apply line is one less layer you have to configure correctly. Prompt injection through tool results is still an unsolved risk; HashiCorp's own MCP security guidance says as much. A server whose worst case is a stray workspace beats one whose worst case is an approved apply.

You might not want that limit, though. If you trust your guardrails, sandboxing, and review pipeline, env0's deploy actions are a feature and human-by-default is friction. That tradeoff is the real decision, not a tool count.

What About the Vendors' Own AI Features?

The MCP server is what your agents use; most vendors also sell AI of their own, and the gating differs sharply as of July 2026.

Our post on the Scalr MCP server walks through what that looks like in practice.

If AI-assisted run debugging matters to you and you're not on (or budgeting for) an enterprise tier, check the gating column as carefully as the feature list.

None of the four vendors gates the MCP server itself behind a plan tier, so cost enters through the meter your agent traffic runs against rather than through an MCP line item. Scalr's per-run pricing is the relevant number on our side.

So Which One Is Best?

Best for what the agent is allowed to do. If you want agents executing changes end to end, env0 and Spacelift expose the most execution authority through MCP, and they've built real controls around it. If you want agents investigating broadly and humans holding the apply, Scalr's read-mostly server with per-user OAuth is the design that enforces that posture instead of asking you to configure it. HashiCorp's server is the strongest pure registry-documentation source and the natural choice if you're staying on HCP Terraform.

Whichever you pick, connect it read-only first, watch what your agents actually use for a month, and widen scope from evidence rather than from the feature list. Our least-privilege Claude Code setup shows what that looks like on the client side.