spacelift-intent

⭐ If spacelift-intent saves you from writing HCL, a star helps others find it.

Provision real cloud infrastructure from natural language — no HCL required.

Spacelift Intent is a Model Context Protocol (MCP) server that translates natural-language requests into cloud resource operations by calling Terraform/OpenTofu provider APIs directly. No HCL is generated. No intermediate files are written.

"Create an EC2 t3.micro in us-east-1 with a Name tag of my-dev-box"
→ resolves hashicorp/aws provider → calls AWS API → records state in SQLite

⚠️ Designed for ephemeral infrastructure. Dev environments, prototypes, demos. Not for production IaC.

Demo

📹 Demo GIF coming soon. Screen-record a Claude Code session: type a natural language infrastructure request and show the provision output with no .tf file ever written to disk.

Quick Start

# 1. Pull the image
docker pull ghcr.io/spacelift-intent/spacelift-intent:latest

# 2. Add to ~/.claude/mcp.json (Claude Code) or claude_desktop_config.json
# See MCP Client Setup section below for full config

# 3. Ask your AI assistant in natural language:
#    "Create an S3 bucket named my-prototype in us-east-1 with versioning enabled"
#    "Spin up an EC2 t3.micro tagged env=dev"
#    "Tear down all resources in this project"

Features

• Natural language → cloud resources: describe what you want; Intent figures out the provider, resource type, and arguments
• No HCL generation: calls Terraform provider APIs directly via the plugin protocol
• 1,800+ providers: reuses any unmodified provider from the Terraform registry
• Local SQLite state: one state file per project directory, 0600 permissions
• Credential isolation: cloud credentials are read from host environment only, never sent to the LLM
• Drift-aware teardown: idempotent; reconciles already-deleted resources rather than failing
• Partial-failure recovery: records each resource immediately on creation; no orphaned untracked resources
• Docker + native binary: identical behavior across both distribution methods

Prerequisites

• An MCP-compatible client: Claude Desktop, Claude Code CLI, Cursor, or VS Code with the MCP extension
• Cloud credentials configured in your environment (e.g. AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS, ARM_CLIENT_ID)
• An Anthropic API key (ANTHROPIC_API_KEY) for intent resolution
• Docker (for the Docker install) or a supported OS (for the binary install)

Installation

Option A — Docker (recommended)

docker pull ghcr.io/spacelift-intent/spacelift-intent:latest

Option B — Native binary

Download the latest release from the Releases page or build from source:

go install github.com/spacelift-intent/spacelift-intent/cmd/spacelift-intent@latest

Option C — Build from source

git clone https://github.com/spacelift-intent/spacelift-intent.git
cd spacelift-intent
make build
# Binary at: dist/spacelift-intent

MCP Client Setup

Claude Code CLI

Add to your Claude Code MCP config (~/.claude/mcp.json or per-project .claude/mcp.json):

Using Docker:

{
  "mcpServers": {
    "spacelift-intent": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "ANTHROPIC_API_KEY",
        "-e", "AWS_ACCESS_KEY_ID",
        "-e", "AWS_SECRET_ACCESS_KEY",
        "-e", "AWS_DEFAULT_REGION",
        "-v", "${PWD}:/workspace",
        "ghcr.io/spacelift-intent/spacelift-intent:latest"
      ]
    }
  }
}

Using native binary:

{
  "mcpServers": {
    "spacelift-intent": {
      "command": "/usr/local/bin/spacelift-intent",
      "env": {
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "AWS_ACCESS_KEY_ID": "${AWS_ACCESS_KEY_ID}",
        "AWS_SECRET_ACCESS_KEY": "${AWS_SECRET_ACCESS_KEY}",
        "AWS_DEFAULT_REGION": "us-east-1"
      }
    }
  }
}

Claude Desktop

Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):

{
  "mcpServers": {
    "spacelift-intent": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-e", "ANTHROPIC_API_KEY",
        "-e", "AWS_ACCESS_KEY_ID",
        "-e", "AWS_SECRET_ACCESS_KEY",
        "-e", "AWS_DEFAULT_REGION",
        "-v", "/path/to/your/project:/workspace",
        "ghcr.io/spacelift-intent/spacelift-intent:latest"
      ]
    }
  }
}

Cursor / VS Code

Add to your MCP settings (see your editor's MCP documentation). Use the same Docker or binary config as above.

Usage

Once the MCP server is connected, use natural language in your assistant:

Provision resources

Create an S3 bucket named my-prototype-data in us-west-2 with versioning enabled

Spin up an EC2 t3.micro in us-east-1 running Amazon Linux 2023, tagged env=dev

Create a GCS bucket called my-ml-dataset in us-central1

Inspect state

What infrastructure is currently running?

Tear down

Tear down all resources in this project

Dry run

Show me what would be created if I asked for a VPC with two public subnets — but don't create anything yet

Available MCP Tools

Tool	Description
provision	Provision cloud resources from a natural-language prompt
list_resources	List all resources tracked in the current project state
teardown	Destroy all tracked resources (requires confirmed: true)
destroy_resource	Destroy a specific resource by ID (requires confirmed: true)
update_resource	Update attributes of a specific resource
drift_check	Check for drift between recorded state and cloud reality
get_operation	Get status of a provisioning operation by ID

Configuration

Environment Variable	Required	Description
ANTHROPIC_API_KEY	Yes (for provision)	Anthropic API key for intent resolution
AWS_ACCESS_KEY_ID	For AWS	Standard AWS credential env vars
AWS_SECRET_ACCESS_KEY	For AWS	Standard AWS credential env var
AWS_DEFAULT_REGION	For AWS	AWS region
GOOGLE_APPLICATION_CREDENTIALS	For GCP	Path to GCP service account JSON
ARM_CLIENT_ID	For Azure	Azure service principal client ID

CLI Flags

spacelift-intent [flags]

Flags:
  --state-dir string    Directory for state database (default: {cwd}/.spacelift-intent)
  --cache-dir string    Directory for cached provider binaries (default: ~/.cache/spacelift-intent/providers)
  --log-level string    Log level: debug, info, warn, error (default: info)
  --log-file string     Log file path (default: stderr)
  --version             Print version and exit

Security

• Credential isolation: credentials are read from host environment variables and passed directly to provider processes. They are never included in LLM prompts, tool arguments, tool results, or log lines.
• State file permissions: SQLite state files are created with 0600 (owner read/write only).
• No HCL on disk: Intent never writes .tf or .hcl files.
• Destructive operations require confirmation: teardown and destroy_resource require confirmed: true.

Do not commit .spacelift-intent/ directories to version control — they may contain sensitive resource attributes.

Supported Providers

Any provider in the Terraform public registry is supported. Providers are downloaded and cached on first use. Verified to work with:

• AWS (hashicorp/aws) — EC2, S3, VPC, RDS, IAM, and more
• Google Cloud (hashicorp/google) — GCS, GCE, GKE, Cloud SQL
• Azure (hashicorp/azurerm) — VM, Storage, AKS, SQL
• Null (hashicorp/null) — for testing
• Random (hashicorp/random) — random values

Ecosystem

Repo	What it does
codescope	Rust code-intelligence engine for AI agents — no cloud, no DB
Sentinel	Deny-by-default agentic sysadmin: Investigate → Plan → Approve → Act
secret-scan	Rust secret scanner — 51k files/sec, 99% accuracy
turbo-flow	Agentic dev environment — 600+ AI subagents, SPARC methodology

Development

# Run tests
make test

# Run benchmarks
make bench

# Build for all platforms
make build-all

# Build Docker image
make docker

# Run linter (requires golangci-lint)
make lint

Project Structure

cmd/spacelift-intent/   # Main binary entry point
internal/
  domain/               # Core domain types
  intent/               # LLM-based intent resolver (Claude API)
  logger/               # Structured JSON logger (log/slog)
  mcp/                  # MCP JSON-RPC 2.0 server
  provider/             # Terraform plugin protocol runtime + executor
  registry/             # Terraform provider registry client
  security/             # Credential isolation utilities
  state/                # SQLite state store
plans/
  adrs/                 # Architecture Decision Records
  ddd/                  # Domain-Driven Design documents
benchmarks/             # Benchmark baseline results

License

MIT — see LICENSE.