MCP Server

The Terraform security layer
for coding agents

audytx exposes a free, unauthenticated MCP server. Call it from your agent to scan AWS Terraform for IAM attack paths, misconfigurations, and cost risks — before the PR exists.

claude mcp add --transport http audytx https://audytx.com/mcp
Or add manually: transport = "http" · url = "https://audytx.com/mcp"
No API key · No install · 250 calls/month free
Claude Code Cursor Windsurf Continue Any MCP client

Tools

5 available
scan_terraform Core

Scan AWS Terraform files for security misconfigurations, IAM privilege-escalation paths, cross-resource attack paths, and cost risks. Returns findings with file/line evidence and fix snippets — plus the findings audytx suppressed as false positives, each with its rationale explaining why.

Inputs

  • files required Array of {path, content} — all .tf and .tfvars files. Cross-resource reasoning needs the full set.
  • plan optional Output of terraform show -json. Resolves final values and module-internal resources.

Returns

  • findings[] Active findings with severity, file, line, message, fix snippet
  • suppressed[] Context-suppressed findings with rationale
  • summary Counts by severity
autofix_terraform Fix

Apply audytx's sound one-click fixes and re-scan, looping until no auto-applicable findings remain (max 3 passes). Only precisely line-anchored fixes are applied — never a corrupting edit. Returns the fixed file contents, what was fixed, and what remains for you to address.

Inputs

  • files required Array of {path, content}

Returns

  • files[] Fixed file contents
  • applied[] Which findings were auto-fixed
  • remaining[] Findings needing manual action
dry_run_autofix Preview

Preview what autofix_terraform would do — returns a unified diff per file showing the exact line changes, without modifying any content. Use this before applying fixes to review and confirm the changes.

Inputs

  • files required Array of {path, content}

Returns

  • diffs[] Unified diff per file
  • would_fix[] Which findings would be addressed
explain_finding Info

Return structured explanation and remediation guidance for a rule ID. Useful when scan_terraform returns a finding ID and you want the full context: what the rule checks, why it matters, MITRE ATT&CK mapping, and how to fix it.

Inputs

  • rule_id required e.g. "AWS_IAM_020"

Returns

  • title Rule title and severity
  • description Full explanation
  • remediation Step-by-step fix guidance
get_context_graph Graph

Return the cross-resource relationship graph audytx computed for the given Terraform files — resources, edges (invocation, runs_as, dlq, network), and the findings the context layer suppressed with their rationale. Use this to understand WHY audytx suppressed a finding before deciding whether to accept the suppression.

Inputs

  • files required Array of {path, content}

Returns

  • resources[] All parsed resources and their relationships
  • edges[] Graph edges with relationship type
  • suppressed[] Context-suppressed findings with rationale

Typical agent workflow

Step 1
Write Terraform
Agent generates or modifies .tf files — provisioning IAM roles, Lambda functions, S3 buckets, API Gateway stages.
Step 2
Scan for issues
Pass all .tf files. Get findings with file/line evidence, severity, fix snippets — and suppressed false positives with rationale so the agent knows what was checked.
scan_terraform
Step 3
Apply sound fixes
Auto-apply precisely anchored fixes in up to 3 re-scan passes. Review remaining findings — those need architectural decisions, not one-liners.
dry_run_autofix → autofix_terraform

Example agent prompts

Before committing Terraform
"Before creating a PR, call audytx scan_terraform on all .tf files in this directory. Show me any High or Critical findings and apply the auto-fixable ones."
Understanding a suppressed finding
"Call audytx get_context_graph on these files. I want to understand why the DLQ finding was suppressed — is it because this Lambda is only invoked synchronously?"
Safe preview before applying
"Run audytx dry_run_autofix first and show me the diffs. If the changes look right, then run autofix_terraform to apply them."
Deep-dive on a finding
"The scan returned AWS_IAM_020. Call audytx explain_finding with that rule ID so I understand the exact privilege-escalation path before I change the IAM policy."
📊

What AI-generated Terraform gets wrong

We prompted frontier models with 50 realistic infra scenarios and catalogued their failure modes — overbroad IAM, hallucinated module arguments, missing companion resources. audytx catches all of them. Read the study →

Rate limits & pricing

250
MCP tool calls per IP
per calendar month
$0
No API key · No account
No credit card
5 MB
Max payload per call
(up to 500 files)

Limits reset on the first of each month (UTC). Enterprise limits available — get in touch. Full details at /pricing.