Netlify API + MCP vs Terraform MCP Server

Netlify API + MCP 67

Read with the hosted lines. Statuspage at netlifystatus.com with component history and an Atom feed (20). From 5 August to 3 November 2026 the feed lists 19 incidents and no maintenance. None names the API or the MCP server. Errors reaching hosted sites and the Netlify application for about 85 minutes on 21 September read as one major outage; errors on the edge network for 55 minutes on 5 October, CDN DNS errors for 34 minutes on 24 September, 6 minutes of 500s on 18 August, and build, Agent Runner, AI Gateway and log-delay incidents read as minor (10 of 30). Limits are published with numbers, about 500 requests a minute, 3 deploys a minute and 100 a day, with X-RateLimit headers (15). The docs say retrying a timed-out upload is safe and give the reset header, but no backoff guidance, no idempotency key for deploys or site creation, and 429 appears in the spec only on agent runner endpoints (7 of 15). A 99.99 per cent SLA is named for Enterprise on the pricing page, with its terms in order forms (5 of 10). The API is generally available (10). 20 + 10 + 15 + 7 + 5 + 10 = 67.

Terraform MCP Server 83

Scored as a local package, since it runs as a Docker image, a Go binary or a self-hosted Streamable HTTP service. Official image hashicorp/terraform-mcp-server, binaries on releases.hashicorp.com (1.1.0 to 1.4.1 listed on 1 November) and go install, with the Go version pinned in go.mod (20). Unit, end-to-end, HCP Terraform, Helm lint, load-test and security-scan workflows run on push to main. We couldn't see whether the default branch passes, so 20 of 25. Open crash and regression issues per the 1 October check (15 open, two bug reports open since January 2026), not re-read on 1 November because GitHub's pages answered 403 (18 of 25). CHANGELOG.md calls out breaking changes in plain words, but 1.1.0 (14 July) and 1.4.0 (23 October) both shipped breaking changes in a minor version (10 of 15). Version 1.4.1 (15).

Netlify API + MCP 59

Personal access tokens get a name and an expiry date at creation and can be deleted, but no scopes are documented and the spec's OAuth2 implicit flow declares none, so a token reaches every team its owner belongs to. The hosted MCP uses OAuth 2.1 with PKCE and dynamic registration and advertises read and write scopes, which the source sanitises at registration and does not check on tool calls, while the upstream Netlify token it holds is unscoped. Secrets travel in headers; v1.21.0 keeps the upstream token out of URLs (18 of 30). Read-only tools are grouped apart from writes and writes are marked destructive, but there is no read-only token and no confirmation step (10 of 20). Form submissions and request logs written by site visitors reach the model through the tools, with no injection guidance (2 of 15). Team audit log on Pro and Enterprise, a site audit log, and the MCP server logs client, agent and model names per call (12 of 15). Public HackerOne bounty, SOC 2 Type II, ISO 27001 and 27018, PCI DSS and HIPAA on the trust centre, a disclosure policy post, and no security.txt (17 of 20). 18 + 10 + 2 + 12 + 17 = 59.

Terraform MCP Server 65

Registry tools need no credentials. HCP Terraform tools take a user, team or organisation API token, which HCP Terraform can revoke, from TFE_TOKEN or a per-request Authorization: Bearer header in HTTP mode, and the server refuses a token sent as a query parameter. 1.4.0 adds MCP_REQUIRE_TOKEN to reject tokenless HTTP requests. No OAuth (22 of 30). Delete, force-unlock, action_run and apply-capable runs stay off until ENABLE_TF_OPERATIONS=true, the default toolset is read-only, HTTP deployments can pin an organisation allowlist, and HashiCorp's hosted beta server leaves the destructive tools out. Creating and updating workspaces, setting variables, adding team members and granting team access still run without that flag once the terraform toolset is on (15 of 20). Module READMEs and provider docs from the public registry and run logs reach the model as they are. The README says not to use the server with untrusted clients or models, and HashiCorp's MCP security page names prompt injection and tool poisoning, without concrete mitigations (6 of 15). Tool-call logging middleware (since 1.4.1 it logs argument keys, not values), opt-in OpenTelemetry metrics and a custom User-Agent so calls are attributable in HCP Terraform (10 of 15). SECURITY.md and a vulnerability policy with security@hashicorp.com, HashiCorp is a CVE Numbering Authority, security.txt valid per the 26 September check (not re-read on 1 November, hashicorp.com answered a bot check), no bug bounty, and the July and October 2026 security fixes went into the changelog with no advisory (12 of 20).

Netlify API + MCP 69

Lists are sized with per_page up to 100 and there is no field selection. The hosted MCP server registers about 11 tools by default, a reader and an updater selector per domain plus coding context and design import, and lists all 25 operations one by one only for OpenAI clients, so the context cost is low either way (18 of 25). page and per_page with a Link header, few filters, and MCP pagination bounds enforced since v1.19.0 (15 of 20). Errors return a code and message; the MCP server answers a bad selector with text telling the agent to pick an operation again (12 of 20). No idempotency key for deploys or sites, though timed-out uploads are safe to retry; every MCP tool declares readOnly, destructive, idempotent and openWorld hints since v1.18.0, with project renames marked destructive (12 of 20). Few required parameters, a Go client, a JS client and the CLI (12 of 15). 18 + 15 + 12 + 12 + 12 = 69.

Terraform MCP Server 74

61 tools in three toolsets (registry 9, registry-private 4, terraform 48), and only the nine registry tools load by default. --toolsets and --tools narrow the rest (22 of 25). List tools take page and pageSize (default 30) and search filters, and 1.4.0 made the status filter on list_runs work, but provider and module docs come back whole, with no section fetch (15 of 20). Errors are specific and some name the next step, for example a locked workspace points at force_unlock_workspace (15 of 20). readOnlyHint and destructiveHint are set on most tools, but in the default server the nine variable and variable-set tools still carry no annotations, including delete_variable_in_variable_set. The official-SDK server behind TF_X_OFFICIAL_SDK_ENABLED annotates them, but it's opt-in. No idempotency keys (12 of 20). Defaults for run type, page size and message, but search_provider_docs needs four required arguments. go-tfe is the only official client library (10 of 15).

Netlify API + MCP 55

No x402, MPP or L402 (0). Plan prices and per-unit credit prices (deploys, bandwidth, compute, requests, credit packs) are public without a login (20). A Free plan with 300 credits a month and API deploys, and the docs do not say a card is needed (20). netlify deploy --allow-anonymous publishes a project and URL with no account, claimable within an hour, but the API, the MCP server and anything past that hour need a person to sign up and approve a token (15 of 20). 0 + 20 + 20 + 15 = 55.

Terraform MCP Server 60

Free under MPL-2.0 with nothing to buy for the server, so 20 + 20 + 20. The registry half works with no account, which is the autonomous route. HashiCorp's hosted beta server at mcp.terraform.io needs an HCP Terraform token on every request and is open to any plan, including Free, during the beta. HCP Terraform usage is billed by HashiCorp on its own plans, which we didn't check. No payment protocol (0).

Netlify API + MCP 81

The MCP server is ISC and the CLI MIT, on a closed platform with clear terms naming Netlify, Inc. (25 of 30). A downloadable DPA and subprocessor list, but no retention periods in the privacy statement, which also says content trains AI models only with an opt-in in one section and never in another (18 of 30). Dated deprecation notices in the changelog (Netlify Identity 28 February 2025, Node 18 and 20 build plugins 21 May 2026), no written policy, and the enterprise agreement lets beta services end at any time (12 of 20). Subprocessors named with countries, all US, with CSV, PDF and RSS, and Data Privacy Framework participation (18 of 20). 25 + 18 + 12 + 18 = 73.

Terraform MCP Server 86

MPL-2.0 (30). Local software that talks to registry.terraform.io and the configured HCP Terraform or Terraform Enterprise address. Requests carry a User-Agent that identifies the MCP server to HashiCorp, which the changelog discloses, and since 1.4.1 tool-call logs leave out argument values. HashiCorp's remote-server page says the hosted beta doesn't store or log the token. There's no MCP-specific data statement beyond HashiCorp's privacy policy (20 of 30). Breaking changes are flagged in the changelog when they ship, and the docs keep versioned pages for 0.3.x to 0.5.x. No deprecation policy or advance notice found (8 of 20). No telemetry by default. OpenTelemetry and Instana are opt-in and send to your own collector (20).