HashiCorp Launches tfctl: A Dedicated CLI for HCP Terraform and Terraform Enterprise

HashiCorp has released tfctl, the first purpose-built command-line interface for HCP Terraform and Terraform Enterprise. It’s distinct from the terraform binary and purpose-built for the operations layer — managing workspaces, runs, variables, and API interactions — rather than plan/apply execution.

What Happened

tfctl is a standalone CLI that provides 100% API coverage of HCP Terraform and Terraform Enterprise. Where the existing Terraform CLI focuses on plan, apply, and state operations within a working directory, tfctl is oriented toward the management plane: creating and configuring workspaces, triggering runs, managing variable sets, querying run status, and scripting operational workflows that span multiple workspaces.

Three features stand out in the initial release:

Dry-run mode — any tfctl command can be prefixed with --dry-run to preview what API calls would be made without executing them. For platform teams managing hundreds of workspaces, this is essential scaffolding for safe automation scripts.

Schema discovery — tfctl api schema search <term> surfaces the API schema for any HCP Terraform resource without leaving the terminal. Platform engineers scripting against the API no longer need to context-switch to browser-based API docs mid-session.

Destructive operation guardrails — delete operations require explicit human confirmation by default, with an override flag for scripted contexts. This is a practical safety layer for teams where junior engineers have access to workspace management commands.

tfctl is available on GitHub at hashicorp/tfctl-cli under the Mozilla Public License 2.0.

Why It Matters

The absence of a dedicated management CLI for HCP Terraform has been a persistent friction point. Teams that needed to automate workspace operations had two options: wrap curl calls against the TFE API in shell scripts, or use the tfe provider inside a separate Terraform configuration that manages Terraform itself. Neither approach ages well as the footprint grows.

tfctl gives platform engineering teams a first-class scripting surface for the control plane — and critically, one that can be invoked from CI/CD pipelines, AI coding agents, and runbook automation without requiring a full Terraform working directory. The 100% API coverage claim means teams can stop maintaining custom REST wrappers for edge-case operations like bulk variable updates or cross-workspace run orchestration.

For organizations running Terraform Enterprise, this also simplifies audit workflows. Querying run history, workspace configurations, and variable set assignments becomes a one-liner instead of a multi-step API call chain.

Implications

The timing matters: HashiCorp’s HCP Terraform platform has been expanding its automation surface with tools like InfraGraph and policy-as-code integrations. tfctl fits into that trajectory as the operational scripting layer that ties these capabilities together from external systems.

For teams adopting AI coding agents or agentic CI/CD pipelines, tfctl is notable because it gives AI agents a clean, well-bounded interface for infrastructure management operations — the dry-run mode and destructive-operation guardrails make it safer to delegate workspace management tasks to automated systems than raw API calls would be.

The schema discovery feature also has indirect value for AI-assisted platform work: an agent that can query tfctl api schema search can reason about available operations without needing those schemas baked into its training data.

Content created with AI assistance and reviewed for accuracy.