Security model for Terraform MCP server
The Terraform Model Context Protocol (MCP) server security model describes threats to AI agents that use Terraform tooling, such as prompt injection, tool poisoning, and tool shadowing, and how to mitigate them. It also explains how the remote Terraform MCP server that HashiCorp hosts handles your HCP Terraform API token. Following this model ensures the following outcomes, even in local environments:
- Tool execution is safe and controlled
- Sensitive operations are protected from accidental misuse or injection
- LLM behavior is constrained and auditable prior to application.
Refer to the Terraform MCP server overview for additional information.
Threat model
You should be aware of the following potential threats to the Terraform MCP server.
Hallucinations
AI hallucinations, or the generation of false information, stem from insufficient training data, flawed model assumptions, and biased datasets. They pose serious risks in critical applications where accuracy is vital for correct diagnoses and sound decisions. We recommend always validating the data prior to applying any changes to your infrastructure.
Prompt injection
Improperly validating or sanitizing inputs can allow attackers to inject malicious instructions for the MCP server to execute. This can lead to code execution, server side request forgery (SSRF), and other kinds of security breaches. To mitigate this risk, we've implemented input validation for all user-sourced data entering the MCP server.
Tool poisoning
Tool poisoning is when the MCP server inadvertently executes hidden instructions within comprehensive tool descriptions, which lets attackers instigate unwanted or damaging outcomes. To mitigate tool poisoning, the MCP server uses static tool descriptions that don't allow poisoning.
Rug pull attack
Deploying a remotely accessible MCP server changes its available tools and descriptions after deployment. This enables malicious behavior that isn't present when the tool was initially approved.
Tool shadowing
When multiple MCP servers are connected, a compromised server can override tools from trusted servers, leading to potential security breaches. You should take precautions when operating several MCP servers.
Threat model scope limitations
The following are not part of the threat model for the Terraform MCP Server:
- Foundational model: Concerns related to the underlying AI models, training data, and inherent vulnerabilities.
- Infrastructure deployment: Concerns related to the security of infrastructure, network and software environments configuration and deployment through the output of the model should always be reviewed prior to any change application.
Remote Terraform MCP server security
The remote Terraform MCP server is in beta. HashiCorp hosts the server at https://mcp.terraform.io/mcp and applies the following controls:
- Token pass-through: The server reads the HCP Terraform API token from the
Authorizationheader of each request and uses it only for the duration of that request. The server does not store or log the token. - Permission scope: The server calls HCP Terraform with your token, so it cannot perform actions that your token is not allowed to perform. Revoking the token in HCP Terraform stops further access.
- Request isolation: The server runs in stateless mode and handles each request in its own execution context, which prevents data from leaking between requests.
- Encryption in transit: Connections to the server use TLS. The server connects to HCP Terraform and the Terraform registry over verified TLS.
Refer to Connect to the remote Terraform MCP server for setup instructions.
Recommendations for secure use
- Always validate before doing any write changes.
- Follow the instructions for securely deploying the MCP server. Refer to Secure configuration.