HashiCorp Ships tfctl, the CLI HCP Terraform Always Needed

HashiCorp finally gave HCP Terraform the first-party CLI it should have had from day one. tfctl, now on GitHub, wraps the entire HCP Terraform and Terraform Enterprise API into a single, discoverable command-line tool. No more custom scripts bolted onto the REST API for routine platform operations.

What tfctl Actually Does

The Terraform CLI has always handled infrastructure workflows - plan, apply, destroy. But platform operations like canceling runs, creating workspaces, managing variables, or administering organizations required either the web UI or hand-rolled API clients. tfctl fills that gap with a dedicated binary that speaks directly to the HCP Terraform platform API.

Every command supports three output modes: JSON, markdown, and human-readable tables. Pipe JSON into jq for automation, drop markdown into a GitHub PR summary, or read tables in the terminal. The tool is built on top of HCP Terraform's OpenAPI spec, meaning it covers 100% of the documented API today. Older versions of tfctl can still access new endpoints as the spec evolves, without requiring a new release.

Safety by Design, Especially for Agents

tfctl comes with safety guardrails that matter. Every write command supports --dry-run to preview changes before they take effect. Delete commands require interactive confirmation, making them effectively inoperable by autonomous agents by design. This is a deliberate architectural choice: as AI agents increasingly drive infrastructure, HashiCorp ensures destructive operations always need a human at the keyboard.

A standout feature is schema discovery via tfctl api schema search. Type a keyword, get the exact API operation and its schema. This works for both human engineers navigating the API and agents operating autonomously, reducing the friction of hunting through documentation.

Real Workflows, Starting Today

The announcement lists three concrete use cases that will resonate with any platform team. Troubleshooting and incident response: diagnose a failed run, identify whether the issue is in code or the platform, get a proposed fix. Change impact analysis: before merging a PR, identify affected workspaces, read latest plans, summarize destroys, replacements, and policy failures. Lifecycle management: audit workspaces at scale, rotate variables across environments, upgrade Terraform versions, or scaffold new workspaces.

Each of these workflows previously required stitching together API calls, jq, and a lot of context switching. tfctl collapses them into a single tool.

This is the foundation HashiCorp is building on, with more investment coming in how platform engineers and AI agents interact with HCP Terraform and Terraform Enterprise.

Source: Introducing tfctl: The CLI for HCP Terraform and TFE
Domain: hashicorp.com