Terraform MCP Server fails

[oxsmose]

Hi Community,

I have a terraform MCP running on Azure Container App.

I made some smoke test:

# 1) Initialize (only needed once per session)
curl -s "https://${FQDN}/mcp" \
  -H "content-type: application/json" \
  --data '{
    "jsonrpc":"2.0",
    "id":"1",
    "method":"initialize",
    "params":{
      "protocolVersion":"2024-11-05",
      "capabilities":{},
      "clientInfo":{"name":"curl","version":"0.0.1"}
    }
  }' | jq .

# 2) Call search_providers with arguments AS AN OBJECT
curl -s "https://${FQDN}/mcp" \
  -H "content-type: application/json" \
  --data '{
    "jsonrpc":"2.0",
    "id":"2",
    "method":"tools/call",
    "params":{
      "name":"search_providers",
      "arguments":{
        "provider_name":"azurerm",
        "provider_namespace":"hashicorp",
        "provider_version":"latest",
        "provider_data_type":"resources",
        "service_slug":"storage"
      }
    }
  }' | jq .

It works. I receive the following payload:

{
  "jsonrpc": "2.0",
  "id": "2",
  "result": {
    "content": [
      {
        "type": "text",
        "text": "Available Documentation (top matches) for resources in Terraform provider hashicorp/azurerm version: 4.41.0\n\nEach result includes:\n- providerDocID: tfprovider-compatible identifier\n- Title: Service or resource name\n- Category: Type of document\n- Description: Brief summary of the document\nFor best results, select libraries based on the service_slug match and category of information requested.\n\n---\n\n- providerDocID: 9701829\n- Title: backup_container_storage_account\n- Category: resources\n- Description: Manages a storage account container in an Azure Recovery Vault\n---\n- providerDocID: 9701894\n- Title: container_app_environment_storage\n- Category: resources\n- Description: Manages a Container App Environment Storage.\n---\n- providerDocID: 9701962\n- Title: data_factory_linked_service_azure_blob_storage\n- Category: resources\n- Description: Manages a Linked Service (connection) between an Azure Blob Storage Account and Azure Data Factory.\n---\n- providerDocID: 9701964\n- Title: data_factory_linked_service_azure_file_storage\n- Category: resources\n- Description: Manages a Linked Service (connection) between an Azure File Storage Account and Azure Data Factory.\n---\n- providerDocID: 9701968\n- Title: data_factory_linked_service_azure_table_storage\n- Category: resources\n- Description: Manages a Linked Service (connection) between an Azure Table Storage and Azure Data Factory.\n---\n- providerDocID: 9701971\n- Title: data_factory_linked_service_data_lake_storage_gen2\n- Category: resources\n- Description: Manages a Linked Service (connection) between Data Lake Storage Gen2 and Azure Data Factory.\n---\n- providerDocID: 9701989\n- Title: data_protection_backup_instance_blob_storage\n- Category: resources\n- Description: Manages a Backup Instance Blob Storage.\n---\n- providerDocID: 9701995\n- Title: data_protection_backup_policy_blob_storage\n- Category: resources\n- Description: Manages a Backup Policy Blob Storage.\n---\n- providerDocID: 9702006\n- Title: data_share_dataset_blob_storage\n- Category: resources\n- Description: Manages a Data Share Blob Storage Dataset.\n---\n- providerDocID: 9702152\n- Title: iothub_endpoint_storage_container\n- Category: resources\n- Description: Manages an IotHub Storage Container Endpoint\n---\n- providerDocID: 9702171\n- Title: key_vault_managed_storage_account\n- Category: resources\n- Description: Manages a Key Vault Managed Storage Account.\n---\n- providerDocID: 9702172\n- Title: key_vault_managed_storage_account_sas_token_definition\n- Category: resources\n- Description: Manages a Key Vault Managed Storage Account SAS Definition.\n---\n- providerDocID: 9702219\n- Title: log_analytics_linked_storage_account\n- Category: resources\n- Description: Manages a Log Analytics Linked Storage Account.\n---\n- providerDocID: 9702224\n- Title: log_analytics_storage_insights\n- Category: resources\n- Description: Manages a Log Analytics Storage Insights resource.\n---\n- providerDocID: 9702245\n- Title: machine_learning_datastore_blobstorage\n- Category: resources\n- Description: Manages a Machine Learning Blob Storage DataStore.\n---\n- providerDocID: 9702512\n- Title: security_center_storage_defender\n- Category: resources\n- Description: Manages the Defender for Storage.\n---\n- providerDocID: 9702614\n- Title: spring_cloud_storage\n- Category: resources\n- Description: Manages a Spring Cloud Storage.\n---\n- providerDocID: 9702622\n- Title: stack_hci_storage_path\n- Category: resources\n- Description: Manages an Azure Stack HCI Storage Path.\n---\n- providerDocID: 9702629\n- Title: storage_account\n- Category: resources\n- Description: Manages a Azure Storage Account.\n---\n- providerDocID: 9702630\n- Title: storage_account_customer_managed_key\n- Category: resources\n- Description: Manages a Customer Managed Key for a Storage Account.\n---\n- providerDocID: 9702631\n- Title: storage_account_local_user\n- Category: resources\n- Description: Manages a Storage Account Local User.\n---\n- providerDocID: 9702632\n- Title: storage_account_network_rules\n- Category: resources\n- Description: Manages network rules inside of a Azure Storage Account.\n---\n- providerDocID: 9702633\n- Title: storage_account_queue_properties\n- Category: resources\n- Description: Manages the Queue Properties of an Azure Storage Account.\n---\n- providerDocID: 9702634\n- Title: storage_account_static_website\n- Category: resources\n- Description: Manages the Static Website of an Azure Storage Account.\n---\n- providerDocID: 9702635\n- Title: storage_blob\n- Category: resources\n- Description: Manages a Blob within a Storage Container.\n---\n- providerDocID: 9702636\n- Title: storage_blob_inventory_policy\n- Category: resources\n- Description: Manages a Storage Blob Inventory Policy.\n---\n- providerDocID: 9702637\n- Title: storage_container\n- Category: resources\n- Description: Manages a Container within an Azure Storage Account.\n---\n- providerDocID: 9702638\n- Title: storage_container_immutability_policy\n- Category: resources\n- Description: Manages an Immutability Policy for a Container within an Azure Storage Account.\n---\n- providerDocID: 9702639\n- Title: storage_data_lake_gen2_filesystem\n- Category: resources\n- Description: Manages a Data Lake Gen2 File System within an Azure Storage Account.\n---\n- providerDocID: 9702640\n- Title: storage_data_lake_gen2_path\n- Category: resources\n- Description: Manages a Data Lake Gen2 Path in a File System within an Azure Storage Account.\n---\n- providerDocID: 9702641\n- Title: storage_encryption_scope\n- Category: resources\n- Description: Manages a Storage Encryption Scope.\n---\n- providerDocID: 9702642\n- Title: storage_management_policy\n- Category: resources\n- Description: Manages an Azure Storage Account Management Policy.\n---\n- providerDocID: 9702643\n- Title: storage_mover\n- Category: resources\n- Description: Manages a Storage Mover.\n---\n- providerDocID: 9702644\n- Title: storage_mover_agent\n- Category: resources\n- Description: Manages a Storage Mover Agent.\n---\n- providerDocID: 9702645\n- Title: storage_mover_job_definition\n- Category: resources\n- Description: Manages a Storage Mover Job Definition.\n---\n- providerDocID: 9702646\n- Title: storage_mover_project\n- Category: resources\n- Description: Manages a Storage Mover Project.\n---\n- providerDocID: 9702647\n- Title: storage_mover_source_endpoint\n- Category: resources\n- Description: Manages a Storage Mover Source Endpoint.\n---\n- providerDocID: 9702648\n- Title: storage_mover_target_endpoint\n- Category: resources\n- Description: Manages a Storage Mover Target Endpoint.\n---\n- providerDocID: 9702649\n- Title: storage_object_replication\n- Category: resources\n- Description: Copy Block Blobs between a source storage account and a destination account\n---\n- providerDocID: 9702650\n- Title: storage_queue\n- Category: resources\n- Description: Manages a Queue within an Azure Storage Account.\n---\n- providerDocID: 9702651\n- Title: storage_share\n- Category: resources\n- Description: Manages a File Share within Azure Storage.\n---\n- providerDocID: 9702652\n- Title: storage_share_directory\n- Category: resources\n- Description: Manages a Directory within an Azure Storage File Share.\n---\n- providerDocID: 9702653\n- Title: storage_share_file\n- Category: resources\n- Description: Manages a File within an Azure Storage File Share.\n---\n- providerDocID: 9702654\n- Title: storage_sync\n- Category: resources\n- Description: Manages a Storage Sync.\n---\n- providerDocID: 9702655\n- Title: storage_sync_cloud_endpoint\n- Category: resources\n- Description: Manages a Storage Sync Cloud Endpoint.\n---\n- providerDocID: 9702656\n- Title: storage_sync_group\n- Category: resources\n- Description: Manages a Storage Sync Group.\n---\n- providerDocID: 9702657\n- Title: storage_sync_server_endpoint\n- Category: resources\n- Description: Manages a Storage Sync Server Endpoint.\n---\n- providerDocID: 9702658\n- Title: storage_table\n- Category: resources\n- Description: Manages a Table within an Azure Storage Account.\n---\n- providerDocID: 9702659\n- Title: storage_table_entity\n- Category: resources\n- Description: Manages an Entity within a Table in an Azure Storage Account.\n---\n- providerDocID: 9702665\n- Title: stream_analytics_job_storage_account\n- Category: resources\n- Description: Manages a Stream Analytics Job Storage Account.\n---\n- providerDocID: 9702687\n- Title: subnet_service_endpoint_storage_policy\n- Category: resources\n- Description: Manages a Subnet Service Endpoint Storage Policy.\n---\n"
      }
    ]
  }
}

However, when I call it from Azure Foundry Agent Playground, i got the following error:

{
name: "mcp"
context: {
trace_id: "thread_v8psfgbIqJycVAJMo0Sl6srX"
span_id: "call_Z2riVcdsGCrm8xGiwx4tE6AU"
thread_id: "thread_v8psfgbIqJycVAJMo0Sl6srX"
}
kind: "Tool"
parent_id: "step_W5KnrExXSkWQHMrzzcyrOZc2"
start_time: "2025-08-28T21:47:00.000Z"
end_time: undefined
status: {
status_code: "Error"
description: "in_progress"
}
attributes: {
span_type: "Tool"
id: "call_Z2riVcdsGCrm8xGiwx4tE6AU"
type: "mcp"
arguments: " { "provider_name":"azurerm", "provider_namespace":"hashicorp", "provider_version":"latest", "provider_data_type":"resources", "service_slug":"storage" } "
name: "search_providers"
server_label: "terraform_mcp"
output: ""
}
}

It seems the arguments are passed in string rather than json object.

Agent prompt is very simple: You are a customer support chatbot. Use the tools provided and your knowledge base to best respond to customer queries.

I tried with more complex prompt:

When you use the MCP tool "terraform_mcp":

- Do NOT output JSON.
- Do NOT include keys like "type", "server_label", "name" in your text.
- Only specify the tool name and a plain list of arguments as key=value pairs.
- The connector will construct the JSON object; your text must not be wrapped in braces or quotes.

Correct examples:
- Call MCP tool: search_providers
  Arguments:
    provider_name=azurerm
    provider_namespace=hashicorp
    provider_version=latest
    provider_data_type=resources
    service_slug=ai

- Call MCP tool: get_provider_details
  Arguments:
    provider_doc_id=1234567

Incorrect examples (do NOT do these):
- Any JSON like {"arguments": {...}} or {"type":"mcp",...}
- Quoted JSON strings
- YAML/TOML or code blocks for arguments

After the tool returns, summarize briefly and, if requested, draft minimal Terraform.

But it does not work.

Any idea how we can solve this ? Bug in Azure Foundry ?

MCP in Foundry has been created with this command:

curl --request POST \
  --url "$AZURE_AI_FOUNDRY_PROJECT_ENDPOINT/assistants?api-version=$API_VERSION" \
  -H "Authorization: Bearer $AGENT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
      "instructions": "You are a customer support chatbot. Use the tools provided and your knowledge base to best respond to customer queries.",
      "tools": [
          {
              "type": "mcp",
              "server_label": "terraform_mcp",
              "server_url": "https://myurlofcontainerappxxxxxxxx.swedencentral.azurecontainerapps.io/mcp"
          }
      ],
      "name": "terraform-agent",
      "model": "gpt-4o"
  }'

contenairapp creation:

az containerapp create -g rg_test -n 122222_name --environment managedEnvironment-kkskskskskk-807d --image hashicorp/terraform-mcp-server:latest --ingress external --target-port 8080 --min-replicas 1 --max-replicas 1 --env-vars TRANSPORT_MODE=streamable-http TRANSPORT_HOST=0.0.0.0 TRANSPORT_PORT=8080 MCP_ENDPOINT=/mcp MCP_SESSION_MODE=stateless MCP_CORS_MODE=development

I follow hashicorp doc: https://developer.hashicorp.com/terraform/docs/tools/mcp-server/deploy

[lindazqli]

Foundry playground wont work with MCP right now, could you please try in SDK?

[oxsmose]

Indeed, in Python SDK it works well. I try with another MCP (azure storage account) and similar issue.