wtf is tf-triage?

tf-triage is a command line tool written in Go that reviews Terraform or OpenTofu infrastructure plans using an AI model before you apply them. You pipe the output of a terraform plan command into it, and it sends a simplified version of your planned changes to a language model, then returns a Markdown report you can post directly as a comment on a pull request. The report covers three things: a short plain English summary of what the change actually does, a security and architecture review that looks for problems like overly broad permissions, resources exposed to the public internet, missing encryption, or gaps in logging, and a blast radius rating of low, medium, or high explaining how risky the change is if something goes wrong. You can choose which AI model answers these questions. Ollama runs entirely on your own computer for free with no API key and no plans ever leaving your machine, which suits sensitive infrastructure or offline use. Alternatively you can use a cloud provider such as Groq, DeepSeek, Gemini, Anthropic, or OpenAI by setting the matching API key as an environment variable, generally trading local privacy for faster or more capable analysis. There is also a more aggressive mode called red team mode. Instead of a general summary, it tries to think like an attacker, looking specifically for chains of misconfigurations across multiple resources that could be combined into a real attack path, and it can suggest concrete commands to verify whether a given exposure is real. Installing it is possible through Homebrew on macOS, a one line install script for Linux or macOS, Go's own install command, or building from source. The project is released under the GPL 3.0 license.