Terraform Plan Parser

devops.parse_terraform_plan

ProductionBounded custom (Class B)Deterministicstrictfastv1.0.0

No network

Overview

You pass the JSON output of terraform show -json and we summarize resource changes by action and type. Attribute values are never emitted — plans routinely embed credentials and we keep them out of the response. We do not run terraform or parse HCL. Do not use this for apply simulation or HCL linting.

Plan JSON embeds secrets; dumping after blocks leaks them into agent logs. We summarize actions and types only.

Reliability

STRICT and deterministic — attribute values never appear in output. Domain errors (not retryable — fix input): TERRAFORM_PLAN_INVALID (JSON is not a valid plan document — regenerate with terraform show -json); TERRAFORM_FORMAT_UNSUPPORTED (format_version not supported — upgrade or export a supported version); TERRAFORM_CHANGE_LIMIT_EXCEEDED (resource_changes exceeds internal limits — split the plan or raise maxResources only after reducing input size).

Context footprint

One call replaces hand-parsing resource_changes for review gates. A successful call costs 1 execution credit.

When to use it

When you have terraform show -json and need a safe change summary.

When you need HCL parsing, module graphs, or apply simulation.

Scope

Note

Summarizes terraform show -json resource changes without emitting attribute values.

Non-goals

Does not run terraform or read remote state
Does not parse HCL source
Does not recommend approval
Does not emit attribute values

Properties

IdempotentRetry safeStreaming supportedFile input supportedRequires external service

Capabilities

parsing

Cost & billing

Flat rate per invocation

MetercallsBillable onsuccessCost per call1 credit

File handling

Accepts file_refProduces file_refMax input2 MB

How we handle your data

Sensitive processing

What this means

This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.

Squillify guarantees

Runs inside Squillify
This skill runs inside Squillify.
Payloads are not sent to an external service by this skill.
Squillify does not permanently store submitted payloads.
Telemetry records metadata only, not submitted content.
Submitted payloads are not used for training.
Submitted payloads are not reviewed by humans.
Targets sensitive data
The response does not contain submitted content.

Your responsibility

Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.

Read the Microskill Data Handling Policy

Input schema

Field	Type	Required	Description
plan	string	Yes	Terraform JSON plan parsed without running Terraform.
options	object	No	Purpose-bound bounded Terraform parser options; omit it for safe defaults. Its purpose-bound option properties are bounded to 128 entries — unconstrained RFC 8259 JSON items.

Output schema

Field	Type	Required	Description
formatVersion	string	Yes	Terraform plan format version.
terraformVersion	string	No	Terraform producer version when present.
summary	object	Yes	Closed add/change/destroy action-count summary. Its documented receipt properties are bounded to 256 entries — unconstrained RFC 8259 JSON items.
hasDestructiveChanges	boolean	Yes	Whether any delete or replacement action exists.
byType	array	Yes	Bounded resource-type action summaries. The item shape is defined by the nested schema and the array contains from 0 through 100000 items.
resources	array	Yes	Bounded resource-change receipts. The item shape is defined by the nested schema and the array contains from 0 through 100000 items.
truncated	boolean	Yes	Whether a result cap omitted resource receipts.
findings	array	Yes	Bounded array of safe structured DevOps findings. The item shape is defined by the nested schema and the array contains from 0 through 20000 items.
_meta	object	Yes	Closed Terraform parser metadata receipt. Its documented receipt properties are bounded to 256 entries — unconstrained RFC 8259 JSON items.

API contract

POST /v1/execute

curl

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"devops.parse_terraform_plan","input":{"plan":"{\"format_version\":\"1.2\",\"resource_changes\":[]}"}}'

Integrations

TypeScript SDK

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("devops.parse_terraform_plan", {"plan":"{\"format_version\":\"1.2\",\"terraform_version\":\"1.9.5\",\"resource_changes\":[{\"address\":\"aws_s3_bucket.data\",\"type\":\"aws_s3_bucket\",\"name\":\"data\",\"change\":{\"actions\":[\"create\"],\"after\":{\"bucket\":\"data\"},\"after_sensitive\":{}}}]}"});

Errors

Code	HTTP	Retryable	Description
VALIDATION_ERROR	400	No	The request payload failed schema validation.
UNAUTHORIZED	401	No	Missing or invalid API key.
SKILL_NOT_ACCESSIBLE	403	No	The API key is not granted access to this skill.
SKILL_NOT_AVAILABLE_FOR_PLAN	403	No	This skill is not included in your current plan.
PLAN_ELIGIBILITY_UNAVAILABLE	503	Yes	Plan eligibility could not be decided. Retry after backoff.
SKILL_NOT_FOUND	404	No	The requested skill or version does not exist.
TENANT_RATE_LIMITED	429	Yes	Request rate limit exceeded. Retry after backoff.
QUOTA_EXCEEDED	429	Yes	Plan quota exhausted. Retryable once the quota period resets.
EXECUTION_TIMEOUT	504	Yes	Execution exceeded the allowed time budget.
TERRAFORM_PLAN_INVALID	400	No	The request payload failed this skill's input validation.
TERRAFORM_FORMAT_UNSUPPORTED	400	No	The skill does not support the requested variant.
TERRAFORM_CHANGE_LIMIT_EXCEEDED	429	No	A size, quota, rate, or time limit was exceeded.

Other limits

Limit	Value
Recommended inline bytes	32 KiB

Limitations

Does not run terraform or read remote state
Does not parse HCL source
Does not recommend approval
Does not emit attribute values
HCL lint or module graph analysis
Simulating apply side effects

How to call

POST /v1/execute (requires authentication)

Request bodyjson

{
  "skillKey": "devops.parse_terraform_plan",
  "input": {
    "plan": "{\"format_version\":\"1.2\",\"terraform_version\":\"1.9.5\",\"resource_changes\":[{\"address\":\"aws_s3_bucket.data\",\"type\":\"aws_s3_bucket\",\"name\":\"data\",\"change\":{\"actions\":[\"create\"],\"after\":{\"bucket\":\"data\"},\"after_sensitive\":{}}}]}"
  }
}

Examples

Create-only plan

Inputjson

{
  "plan": "{\"format_version\":\"1.2\",\"terraform_version\":\"1.9.5\",\"resource_changes\":[{\"address\":\"aws_s3_bucket.data\",\"type\":\"aws_s3_bucket\",\"name\":\"data\",\"change\":{\"actions\":[\"create\"],\"after\":{\"bucket\":\"data\"},\"after_sensitive\":{}}}]}"
}

Expected outputjson

{
  "byType": [
    {
      "update": 0,
      "replace": 0,
      "type": "aws_s3_bucket",
      "create": 1,
      "destroy": 0
    }
  ],
  "resources": [
    {
      "type": "aws_s3_bucket",
      "actions": [
        "create"
      ],
      "replaceReasons": [],
      "changeKind": "create",
      "name": "data",
      "address": "aws_s3_bucket.data"
    }
  ],
  "truncated": false,
  "findings": [],
  "hasDestructiveChanges": false,
  "formatVersion": "1.2",
  "summary": {
    "update": 0,
    "destroy": 0,
    "noOp": 0,
    "create": 1,
    "replace": 0,
    "read": 0
  },
  "terraformVersion": "1.9.5",
  "_meta": {
    "redactedValueCount": 0,
    "resourceChangeCount": 1
  }
}

Destroy-only plan flags destructive changes