AI-ready IaC

AI IaC needs a backend that keeps up.

Connect your AI solutions with Stategraph's API. Plan and apply AI-generated HCL at speed. Match the pace of your AI IaC coding tools.

Parallel Plan/Apply 20K Resources in 3s Versatile API
Get Started

Your IaC solution can't keep up with AI workflows

AI tools generate infrastructure code in seconds. OpenTofu and Terraform can't consume that AI output as fast as it's generated.

// the AI velocity gap
AI agent 3s
done
Terraform / OpenTofu 4m 7s
refreshing 2,847 resources… still going…
→ The gap between AI output and infrastructure deployment is where your team waits.

Stategraph Velocity can match AI's pace

Same infrastructure. Same change. Dramatically different wait time.

Stategraph plan completes in 2 minutes 48 seconds while Terraform plan is still running at 2 hours 42 minutes Stategraph plan completes in 2 minutes 48 seconds while Terraform plan is still running at 2 hours 42 minutes

Compatible with Terraform and OpenTofu

Stategraph API connects with your team's IaC solution. Terraform and OpenTofu can't handle the speed or scale AI teams operate at.

Terraform AI workflows

With Stategraph Velocity, you can execute deployments hundreds of times quicker than just standard Terraform.

OpenTofu AI workflows

As founding members of OpenTofu, we know how to leverage the open source solution to deliver fast, safe results.

What Makes Velocity Fast?

Subgraph Execution

Only process resources affected by your change. The dependency graph tells us exactly which resources need to be evaluated, so we skip the rest.

Parallel Operations

When changes don't overlap, run them simultaneously. Multiple teams can work on the same codebase without waiting in a queue.

Resource-Level Locking

Lock only what you need. No more global state locks that block everyone while one person runs a plan on a single resource.

Incremental Refresh

Refresh only changed resources, not the entire state. For large deployments, this means seconds instead of minutes.

SQL-Queryable State

Your infrastructure state lives in PostgreSQL. Query it directly, build dashboards, integrate with your existing tools.

Familiar CLI

Run plan and apply through stategraph. Same verbs, same workflow, dramatically faster execution.

Speed is downstream of the substrate

LLMs fail at raw Terraform because the primitive is wrong. Stategraph changes the primitive.

// wrong primitive
JSON blob on disk
grep to read · edit in place · global lock
// right primitive
Normalized graph in Postgres
SQL to query · transactional edits · resource locks
MCP, llms.txt, skill files are table stakes. The substrate is the hard part to copy.

Scope the key, not the prompt

“Only plan, never apply” in a system prompt is a suggestion, not a boundary. A confused or jailbroken model ignores prose. The one thing an agent cannot argue its way past is the credential you hand it — so Stategraph scopes the credential, on two axes the agent literally cannot step outside.

// hope it holds
Prompt as guardrail
full token · "please only plan" · one jailbreak from apply
// scope it
Credential as guardrail
plan-only token · aws_instance.* in one state · apply unreachable
Instructions are not enforcement. A model can ignore the system prompt. It cannot exercise a capability that was never minted into its token.

// two axes the agent cannot step outside

// axis 1 — capability

Plan-only, or plan and apply.

preview
plan-only · produce a plan, never apply
granted
commit
apply · commit changes through transactions
withheld

Two separate grants, gated independently — a plan-only token cannot apply. The worst case from a confused model is a wrong plan you throw away. There is no path from a confused model to a destroyed database.

// axis 2 — resource

Down to an address pattern in one state.

whole tenant
one state · sid
aws_instance.*
→ one flag value: sid=aws_instance.*

The pattern matches resource addresses in that state: * for the whole state, a prefix glob like module.foo.*, or a leading ! to deny. Everything else is untouchable.

bash
# mints from your existing STATEGRAPH_API_KEY — no browser session
# plan-only key, scoped to just the EC2 instances in one state
$ stategraph user access-tokens create \
  --name agent-plan-only \
  --preview \
  --preview-state '<state-id>=aws_instance.*'
token eyJhbGciOiJI...  # printed once, revocable any time
// where the agent runs
// token you issue
Autonomous / overnight
no human between the model and prod
--preview · plan-only
Past a review boundary
a CI runner on a green PR, for example
--preview --commit · plan + apply
A token is always a subset of the session that created it. Requested capabilities are capped at the creator's, so a token can never exceed its creator and you cannot accidentally over-grant. Tokens are listable and revocable at any time, and every one writes to the audit trail.

The rest of this page is speed — fast enough to keep up with an agent. This is the other half: scoped tightly enough that you can actually hand one the keys.

Transform Your Terraform State

From flat files to intelligent, queryable database. SQL interface, dependency visualization, and transaction history in one unified console.

Get Started Read the Docs

Drive it from Claude, Gemini, or Codex → github.com/stategraph/skills