Secure AI-agent integrations

Local MCP infrastructure reviewer.

Give your AI coding agent deterministic Terraform, CloudFormation, Azure, Kubernetes, Pulumi, Ansible, Jenkins, Chef, Puppet, and repository-wide infrastructure review that runs locally and never uploads raw inputs. The preview exposes readtheplan analysis to MCP clients over stdio, so change artifacts stay on your workstation or inside CI.

Local-first No raw plan upload No hosted MCP service No accounts or billing

Use it when an agent opens a Terraform PR and needs a second set of deterministic checks: risky replacements, identity or network changes, control-review context, and an auditor-friendly summary before humans approve.

Get free setup help

Optional email help is free. Never attach a raw Terraform plan.

Install

Run the MCP server locally.

The MCP extra installs the optional runtime. Start the server from the repository or workspace where your MCP client should resolve local plan paths. 

pip install "readtheplan[mcp]"
MCP_ROOT=/absolute/path/to/repository readtheplan mcp

Tool surface today

Analyze and gate.

The preview exposes agent_gate_project for automatic mixed-repository discovery, Terraform analyze_plan and agent_gate, plus agent_gate_cloudformation, agent_gate_azure, agent_gate_bicep, agent_gate_cdk, agent_gate_kubernetes, agent_gate_helm, agent_gate_helmfile, agent_gate_terramate, agent_gate_spacelift, agent_gate_carvel, agent_gate_kustomize, agent_gate_crossplane, agent_gate_serverless, agent_gate_sam, agent_gate_skaffold, agent_gate_devspace, agent_gate_tilt, agent_gate_cue, agent_gate_jsonnet, agent_gate_nix, agent_gate_dsc, agent_gate_cfengine, agent_gate_opa, agent_gate_sentinel, agent_gate_sops, agent_gate_docker_bake, agent_gate_terraform_lock, agent_gate_terraform_state, agent_gate_terraform_stack, agent_gate_configuration_management, and agent_gate_pulumi and agent_gate_pulumi_project. Every tool accepts a local input path. analyze_plan returns the same JSON summary as readtheplan analyze --format json plan.json, while agent_gate returns the rtp-agent-gate-v1 contract from readtheplan agent-gate plan.json.

agent_gate_project opens candidates through the descriptor-verified MCP_ROOT boundary, rejects traversal and symlink-swap races, and copies accepted bytes into an isolated temporary snapshot before invoking analyzers. It supports exclusion globs, compliance frameworks, supported-file limits, per-file byte limits, and a hard candidate cap. No analyzer reopens an untrusted repository path.

The agent_gate contract includes decision (proceed/warn/block), allowed_next_actions, prohibited_next_actions, and pr_comment — a pre-formatted Markdown summary that avoids raw plan JSON. Review it before posting to public PRs because resource addresses can still reveal environment details.

Evidence generation, signature verification, signing, framework selection, customer rule overlays, and --no-rules stay in the CLI for now.

Client config examples

Use the same local command from your MCP client.

These blocks show common MCP stdio shape. They are configuration examples, not verified compatibility claims for every client version.

Client Example block Notes
Claude Desktop {"mcpServers":{"readtheplan":{"command":"readtheplan","args":["mcp"],"env":{"MCP_ROOT":"/absolute/repo"}}}} Add under the client's MCP server configuration file and use an absolute root.
Cursor {"readtheplan":{"command":"readtheplan","args":["mcp"],"env":{"MCP_ROOT":"/absolute/repo"}}} Use the client's stdio MCP server settings.
Windsurf {"readtheplan":{"command":"readtheplan","args":["mcp"],"env":{"MCP_ROOT":"/absolute/repo"}}} Adapt to the current local MCP configuration shape.
Generic MCP client command: readtheplan; args: ["mcp"]; env: {MCP_ROOT: /absolute/repo} Start a confined stdio server process for the repository.

Demo workflow

Review a mixed infrastructure PR without moving its inputs.

  1. Set MCP_ROOT to the absolute repository path in the MCP client configuration.
  2. Start readtheplan mcp as the local stdio server.
  3. Ask the agent to call agent_gate_project for that repository, optionally with framework: soc2 and exclusion globs.
  4. Use proceed, warn, or block before approving, requesting changes, merging, or applying.

Agent gate result

Proceed, warn, or block.

The agent can stop on dangerous or irreversible changes, require reviewer evidence for warning-tier changes, and produce an auditor-friendly PR comment. The raw Terraform JSON remains local; the MCP preview does not add a backend, storage layer, cloud relay, or hosted plan analysis.

Demo prompts

Prompts for Terraform and SOC 2 review.

Prompt Use Copy
Mixed repository reviewer Repository-wide infrastructure review Call agent_gate_project on the repository root with framework: soc2. Summarize every file gate and follow the aggregate allowed and prohibited actions.
PR reviewer Terraform pull request review Call agent_gate on plan.json. Follow the allowed and prohibited next actions, then draft the PR comment for the Terraform author.
SOC 2 evidence prep Control-owner handoff Use the readtheplan MCP result to prepare SOC 2 change-review evidence notes. Group findings by access control, change management, monitoring, confidentiality, and availability themes.
Dangerous change triage Release risk escalation Find replacements, deletes, public exposure changes, key or identity changes, and retention decreases. Explain why each item needs human approval before apply.
Auditor-friendly summary Plain-language evidence narrative Turn the MCP analysis into an auditor-friendly summary with changed resources, risk tiers, control themes, reviewer decision points, and follow-up evidence needed.

Free setup help

Local integrations stay local-first.

Free community setup help can connect an infra or compliance team to a local MCP client to one Terraform repository, tune review prompts, and decide which workflows belong in CLI evidence rather than the preview MCP tool. agent_gate_project can discover and snapshot the repository automatically. Current MCP gates normalize Terraform/OpenTofu plans, configuration, and provider locks, Terragrunt, Terramate, CloudFormation, AWS CDK Cloud Assemblies/assets, Bicep source, Azure What-If, Kubernetes (including Tekton), Pulumi, GitHub Actions, GitLab CI, CircleCI, Concourse, Bamboo Specs, TeamCity Kotlin DSL, AWS CodeBuild, Google Cloud Build, AWS CodePipeline, Ansible playbooks/project configuration, inventory, Builder execution environments, and Navigator settings (ansible-project), Jenkins pipelines/JCasC/plugin catalogs (jenkins-jcasc, jenkins-project), Chef recipes/projects/Berkshelf dependencies/client, Workstation, Solo, and Server runtime configuration (chef-project), Puppet manifests/projects/runtime and Bolt projects/inventory (puppet-project), Salt states/project configuration (salt-project), Nix flakes/locks and NixOS modules, DSC v3/PowerShell DSC configuration, CFEngine policy/Augments, Docker Compose, Nomad jobspecs/plans, Packer, Vagrant, cloud-init, systemd, SOPS policy and encrypted documents, NGINX, HAProxy, Envoy, Traefik, Caddy, Grafana, Loki, Vault, Consul, Prometheus, Alertmanager, OpenTelemetry Collector, Buildkite, Atlantis, Docker Buildx Bake definitions, Dockerfiles, Azure Pipelines, and Bitbucket Pipelines into the same contract. Additional GCP/Oracle inputs can follow the same local-first boundary.

Get free setup help

No raw Terraform plan is attached or submitted.

  • Community guidance can cover auth design, least privilege, audit logs, and local deployment.
  • The OSS preview does not include those production controls by default.
  • No hosted MCP service. No hosted plan analysis. No raw Terraform plan upload, no accounts, and no billing.