Nothing to hand? Load the
— a hardcoded AMI, a database password inlined as a literal, SSH open to 0.0.0.0/0,
a public-read bucket and no version pins — or the
,
where the correct verdict is production-ready and the useful output is what to add next.
Paste the HCL — the prescan is free
No upload, no AI: the prescan reads every top-level block in your browser and lists what it mechanically found. The block inventory, then the flags — literal secrets, ingress open to the whole internet, public object-storage ACLs, wildcard IAM actions, missing required_version and required_providers, no state backend, variables without types or descriptions, hardcoded AMI ids, count over collections, missing tags and encryption switched off. Each group explains why it matters. This part costs nothing and happens while you type.
The AI reviews it — this is the metered part
A senior infrastructure engineer's pass: a production-readiness posture with the single most important change named, the inventory with each block's role, and prioritized findings across security, reliability, cost, maintainability, structure, portability and hygiene — each with the problem, the concrete impact, the fix and a corrected HCL fragment. Every prescan flag is confirmed or explicitly set aside. Findings may only cite blocks that actually appear in your configuration. Pricing is honest: a worst-case amount is reserved before the run and only what the run actually uses is charged — the meter next to the button shows both.
Fix, export, re-run
Every corrected fragment downloads as one paste-able .tf file, and each snippet has its own Copy HCL button — the fix never has to be retyped. Quick wins cover the one-line changes; focus areas tie the real work to specific findings; the findings table exports as CSV with the snippet column included. Pin any past review as a baseline and the free prescan then counts the flags you have cleared while you type, before you spend anything; the next review is diffed against that baseline — resolved, new, still open, and the critical count moving. Signed in, that history is saved to your account and comes back on any device, not just this browser.
Derived from the @wshobson/terraform-module-library skill (MIT license).