Terragrunt experimental `mcp` command exposes operations to coding agents

Introduced 2026-10-21 · score 0.98

HOW TO USE IT

When an agent needs to inspect Terragrunt units, dependencies, validation, run order, or applied outputs, connect an MCP client to `terragrunt mcp` with the `mcp-command` experiment enabled. Grant only needed capabilities; use `--allow=exec --dangerously-allow-apply` to expose apply and destroy tools.

WHY THIS HELPS

Connect an MCP client to a Terragrunt repository to inspect units, dependencies, validation, run order, or applied outputs.

REQUIREMENTS AND LIMITATIONS

• Version: v1.2.0
• Availability: The `mcp-command` experiment; the tool set, flag names, and result shapes are subject to change until v1.3.
• TG_EXPERIMENT=mcp-command (required): Enables the experimental `mcp` command; alternatively enable with `--experiment=mcp-command`.
• --working-dir <directory>: Sets the server root; defaults to its launch directory. Tool paths resolving outside the root are refused.
• --allow=exec: Allows Terragrunt-started `tofu`, `terraform`, and `git`; required for `plan`, and for enabling `apply` or `destroy`.
• --allow-cmd <pattern>: Allows a configuration-named command matching the pattern; repeatable and requires `--allow=exec`.
• --allow=http: Allows Terragrunt's own HTTP requests, including remote sources and cloud API calls.
• --allow=sops: Allows decryption of SOPS-encrypted files.
• --allow=env: Passes server environment variables to configurations and commands; otherwise tool calls start with an empty environment.
• --dangerously-allow-apply: Registers `apply` and `destroy`; requires `--allow=exec`, and calls wait for client elicitation acceptance.
• working_dir: MCP tool parameter: directory relative to the server root; defaults to root, but is required by `render_config` and `get_outputs`.
• filter: MCP tool parameter that narrows the units acted on for tools that support it.
• parallelism: For `plan`, `apply`, and `destroy`, caps the number of units run concurrently; no limit by default.
• discover: Lists units and stacks; can include dependency edges and hidden-directory units.
• render_config: Evaluates one unit's configuration; requires `working_dir`.
• validate: Reports syntax and evaluation errors for configurations under a directory.
• run_order: Reports unit run order and blockers.
• get_outputs: Reads one unit's applied outputs; requires `working_dir`.
• Prerequisite: Terragrunt with the `mcp-command` experiment enabled; the command is experimental.
• Prerequisite: An MCP client configured to launch the Terragrunt binary; set `TG_EXPERIMENT` in the client configuration environment.
• Prerequisite: By default, capabilities are denied. `get_outputs` needs `exec`, or `http` for direct reads from s3, gcs, and azurerm state; `plan` needs `exec`.
• By default the server refuses to start subprocesses; refused subprocesses can lead to stand-in outputs listed in a `degraded` field.
• Program names supplied by configuration through `run_cmd()`, `before_hook`, or `--auth-provider-cmd` remain refused unless allowed with `--allow-cmd`; read-only tools can request elicitation to retry after acceptance, but `plan`, `apply`, and `destroy` do not ask.
• Capabilities must be granted individually. `--allow=exec` permits Terragrunt-started `tofu`, `terraform`, and `git`; `--allow=http` permits Terragrunt's own HTTP requests; `--allow=sops` permits SOPS decryption; `--allow=env` passes server environment variables to configurations and commands.
• Without `--allow=env`, tool calls start with an empty environment, `get_env()` returns its default, and the server clears its own environment and points `HOME` at an empty directory, so cloud SDKs, SOPS decryption, and Terragrunt-run `git` commands find no credentials in environment variables or the home directory.
• Allowing Terragrunt a capability does not restrict subprocesses it starts; for example, `tofu init` can make network requests without `--allow=http`.
• The server root is its launch directory. Tool calls targeting outside it are refused, and graph traversal is bounded there; HCL `file()` can still read the real disk wherever it points.
• `--dangerously-allow-apply` requires `--allow=exec`; `apply` and `destroy` tools are not registered without it. With it, tool calls require client elicitation accepting the units to run; clients unable to ask are refused. Approval names units, not changes, and call starts only after acceptance.
• The engine tools use the binary named by `--tf-path` and ignore a unit's `terraform_binary` and `engine` block.
• The `mcp-command` experiment documentation lists criteria that must be met before stabilization.

FIRST-PARTY EVIDENCE

• https://github.com/gruntwork-io/terragrunt/releases/tag/v1.2.0
• https://docs.terragrunt.com/reference/cli/commands/mcp/

Check the installed version and the source before using it. Entry JSON

Report a problem with this card