Neither Terraform loadout lets the agent apply. The first is about plans: a hook that blocks apply, destroy and state changes, a plan summary that lists every delete and replace, pinned providers and moved blocks for renames. The second is about modules: fmt, a read-only lock file, validate, tofu test against a mocked provider so no credentials are needed, and Checkov with inline, reasoned skips only.
Every one installs for Claude Code, Codex CLI, Cursor, Gemini CLI, Antigravity CLI and GitHub Copilot unless its card says otherwise.
Agents write OpenTofu modules that pass a local gate: fmt, a read-only lock file, tofu test with a mocked AWS provider, and Checkov with reasoned skips only.
Let agents write Terraform and produce plans but never apply: a guard hook for apply, destroy and state changes, a plan summary that flags deletes, pinned providers.
Looking for something narrower? Search within Terraform or filter everything.