Skip to main content

Licensing and Limits

The MCP server enforces the same license tiering as the Terraback CLI — there is no separate "MCP tier." What changes between Community and Professional is a single limit on one tool.

The Community codify_batch cap​

On the Community (free) tier, a single codify_batch call is capped at 25 total resources, counted after tag_filters are applied and before exclude_managed is applied. If the requested scope has more resources than that, the tool returns an error and writes nothing to output_dir:

{
  "error": "resource_cap_exceeded",
  "total": 143,
  "cap": 25,
  "counts_by_type": {"aws_ec2": 40, "aws_ebs_volume": 103},
  "hint": "..."
}

To proceed on the Community tier, narrow the request with types or tag_filters until the total is under the cap, or call codify_resource once per resource instead. The Professional tier removes the cap entirely — a single codify_batch call can codify an unlimited number of resources.

Not capped, on any tier:

  • codify_resource — generates one resource at a time, so the cap does not apply.
  • scan_infrastructure — read-only; scan as much of an account as you want on Community.
  • detect_unmanaged, verify_plan, list_supported_resources — all read-only or local-only and uncapped.

Offline license activation​

Terraback license keys activate offline, with no network call required at activation time:

terraback license activate <key>

The activate command auto-detects the offline key format and validates it locally. Keys are Ed25519-signed and carry an expiry date plus a 14-day grace period after expiry. An invalid or expired key does not fail the MCP server or the CLI — it degrades gracefully to Community-tier behavior (including the codify_batch cap above) rather than blocking usage.

Supplying the license to the MCP server process​

Because MCP clients spawn the server as a subprocess with its own environment, make sure the license is visible to that process, either by:

  • Setting the TERRABACK_LICENSE environment variable in the MCP client's server config (the env block in .mcp.json), or
  • Activating the license once with terraback license activate <key>, which persists it to ~/.terraback/license.key — any process running as the same user picks it up automatically, including one launched by an MCP client.
{
  "mcpServers": {
    "terraback": {
      "type": "stdio",
      "command": "terraback",
      "args": ["mcp"],
      "env": {
        "TERRABACK_LICENSE": "<your-license-key>"
      }
    }
  }
}

No phone-home​

License validation for the MCP server is local: Ed25519 signature verification against the key's embedded expiry, with no outbound network call. Combined with the local-first stdio posture, this means neither license checks nor tool calls send data off the machine running the server.

  • Tool Reference: the codify_batch entry documents the exact cap-exceeded error shape.
  • Agent Workflow: step 4 describes how an agent should react to a capped response mid-loop.
  • Security and Credentials: the broader local-first, no-telemetry posture the license model follows.