Cloud, hosting & identity · wired today
Drive Terraform Cloud with governed agents
Infrastructure state changes under you; agents need to read it live. The Terraform Cloud connector is one of 205 executable connectors and gives agents 4 read-only tools, with the credential held in the vault and every call receipted.
What agents can run against Terraform Cloud
| Tool | What it does |
|---|---|
get_account_details | Get the HCP Terraform account the API token belongs to (username, email, auth method, whether it is a service account) |
list_organizations | List the HCP Terraform organizations the token can see (name, external id, notification email, plan), optionally narrowed by a search string |
list_workspaces | List the workspaces in one HCP Terraform organization (name, execution mode, Terraform version, resource count, lock state), optionally narrowed by name or tag |
list_runs | List the runs in one HCP Terraform workspace, newest first (status, message, source, trigger reason, whether the plan has changes), optionally filtered by status or operation |
Every tool above is read-only. Write surfaces ship only after live testing, and always behind approval gates.
What the Terraform Cloud connector needs
You provide API token from your Terraform Cloud account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Where to get it: Terraform Cloud's own API documentation ↗ covers creating and scoping the credential.
How proven is this?
This connector was blind shape-proven against the real Terraform Cloud API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.
Terraform Cloud integration FAQ
What can Quox agents do with Terraform Cloud?
Agents can run 4 read-only tools against Terraform Cloud: get account details, list organizations, list workspaces, list runs. Every call is receipted in the evidence trail.
What does the Terraform Cloud integration need?
You provide API token from your Terraform Cloud account; Quox sends it as a bearer token. The credential is stored encrypted in the vault and resolved just-in-time, so agents use it without ever seeing it.
Do agents see my Terraform Cloud credentials?
No. Credentials live encrypted in the Quox vault and are resolved server-side at call time. Agents invoke tools; they never receive the underlying secret.
How proven is the Terraform Cloud connector?
This connector was blind shape-proven against the real Terraform Cloud API: every endpoint it declares answered measurably differently from a deliberately bogus control request, without any account or credential involved. It is Beta: proven against the live API surface, not yet run with a real credential.