Connect Claude to HCP Terraform

List the organizations this token can see, with each one's name and settings. Call it first when you do not know which organization to act on, and to find out whether the connection reaches anything at all - an empty list means the token is valid but is a member of nothing. The `name` returned here is what every organization argument below takes.

List an organization's workspaces with each one's name, Terraform version, execution mode, current run status and id. Call it to get the workspace id (ws-…) that get_workspace, list_runs, list_variables and get_current_state_outputs all take.

Fetch one workspace by id, including its execution mode, Terraform version, auto-apply setting, VCS repository, working directory, lock state, and the id of its current run. Read auto-apply before trusting anything about how a run in this workspace behaves - a workspace with auto-apply on applies a successful plan without a person approving it.

List a workspace's runs, newest first, with each run's status, message, source, and the ids of its plan and apply. This is the operation that answers "what happened in this workspace lately" and "why is it stuck".

Fetch one run by id - its status, the timestamps of every status it passed through, who queued it, and its permissions block. Pass include to pull the related plan, apply or configuration version back in the same response instead of making a second call.

Fetch one plan by id - its status, whether it has changes, and the counts of resources it would add, change and destroy. This is the cheap summary; get_plan_json_output is the full machine-readable plan. HashiCorp documents no endpoint that lists plans, so the id comes from a run: call get_run with include ["plan"], or read the run's relationships.

Fetch the full machine-readable JSON execution plan - every resource change with its before and after attribute values. Use it to answer exactly what a run would do before a person approves it. Three things to expect. The endpoint answers 307 and the real content comes from a short-lived download URL, so the payload is the plan itself rather than a JSON:API envelope. It answers 204 when the plan has not finished yet, and 422 when the workspace runs a Terraform older than 0.12. And HashiCorp documents that an organization token cannot call it at all - use a user or team token with admin access to the workspace. The response is not written to the audit log: a plan carries the resolved values of the resources it touches.

List a workspace's state versions, newest first, with each one's serial number, creation time, and the run that produced it. Use it to see how often state has changed and which run last wrote it. Both the workspace name and the organization name are required by the API - this endpoint is filtered rather than nested.

Read the outputs of a workspace's current state - each output's name, type and value. This is the workspace-scoped outputs endpoint on purpose: HashiCorp documents that it returns null for any output marked sensitive, while the state-version-output endpoints return the real value. This connector exposes only the redacting one, and does not expose the raw state download at all. Treat what does come back as sensitive anyway: an output is only masked if whoever wrote the Terraform remembered to mark it, and outputs routinely carry endpoints, ARNs and connection strings. The response is not written to the audit log for that reason.

List a workspace's own variables - key, category ("terraform" or "env"), whether the value is HCL, and whether it is marked sensitive. A variable marked sensitive is write-only in HCP Terraform, so its value does not come back; every other variable's value does, which is why this response is not written to the audit log. Variable sets shared across workspaces are a separate resource and are not covered here.

List an organization's projects with their names and ids. A project groups workspaces; pass the prj- id returned here to list_workspaces to see only that group.