# tfmcp v0.2 Roadmap

v0.2.1 consolidates the completed v0.2.x work into one release. The product
remains local-first: Registry and HCP Terraform / Terraform Enterprise support
extend Terraform repository analysis rather than replacing it.

## v0.2.1 scope

### Terraform and Registry

- Public and private provider, module, and policy Registry tools
- Local project and entrypoint detection
- Plan review, provider lockfile checks, state safety, drift candidates, and
  module health analysis
- Terraform 1.15.8 CI and container baseline

### HCP Terraform and Terraform Enterprise

- Read APIs for organizations, projects, workspaces, runs, plans, applies,
  variables, policy sets, variable sets, tags, stacks, and private Registry
  content
- Write APIs guarded by `ENABLE_TF_OPERATIONS=false` by default
- Server-owned `TFE_TOKEN` credentials only; request token/address passthrough
  is intentionally unsupported
- Bounded response bodies and organization allowlists

### MCP deployment

- stdio as the default transport
- Streamable HTTP with loopback binding, Host and Origin validation, health and
  metrics endpoints, rate limits, TLS file wiring, heartbeat controls, and
  stateful/stateless sessions
- MCP Registry OCI metadata and tool filtering
- Tool execution errors for invalid domain input and disabled operations;
  protocol errors for malformed/unknown MCP requests

## Deferred

- Variable-set container update/delete APIs
- Stack write workflows
- Managed OAuth authorization-server integration
- Advanced OpenTelemetry export and cardinality policy
- Async Terraform subprocess execution with `tokio::process` for higher
  concurrent HTTP throughput
- Stronger TFE wire-to-domain validation with `TryFrom` and validated newtypes
- Plugin architecture

## Release gates

Run `./Release.sh v0.2.1` from the repository root. It is the canonical gate
for formatting, Clippy, tests, audit, architecture, duplication, package, and
publish verification. Architecture diagnostics and thresholds are maintained
in [quality-commands.md](../../.claude/rules/quality-commands.md).

## Release policy

- Keep versions synchronized across Cargo, MCP Registry, OCI, and Docker
  metadata.
- Keep one repository-wide `CHANGELOG.md`; do not add per-version release-note
  files.
- Publish only from a clean `main` commit whose Rust CI run has succeeded.
- Use an annotated immutable tag and publish the same version to crates.io and
  GitHub.
- Never enable HCP/TFE writes, local dangerous operations, or auto-approve by
  default.