Rootform

Rootform turns Terraform and OpenTofu plan or state exports into architecture you can explore, explain, compare and check against Policies. The saved result is a Form: resources, placements, connections and the evidence behind them. Unknown values remain unknown.

Analysis runs locally. Rootform reads exported JSON without running Terraform, executing providers or contacting a cloud account. There is no telemetry; the Explorer listens on loopback. Data handling documents content acquisition and every network boundary.

Playground | Documentation | Quickstart

Install

curl -fsSL https://rootform.dev/install | sh
rootform version

Installation covers macOS, Linux, Windows, containers and checksum verification. Check provider coverage for the resource types and facts Rootform interprets.

Analyze a plan

terraform plan -out=plan.tfplan
terraform show -json plan.tfplan > plan.json
rootform run plan.json --plan-file plan.tfplan

The Explorer opens in your browser. Add --no-serve -o analysis.json to save the Form, or --no-serve -o review.md for a Markdown report. For recorded architecture, export state with terraform show -json > state.json and run rootform run state.json. Keep raw plan and state files out of Git: they can contain secrets.

Compare and check

Try the synthetic commerce sample from the repository root. Its base plan reads the existing infrastructure with no changes, its head plan is the proposed change against the same state, and the first command compares the two:

rootform run examples/playground/commerce-platform/base/plan.json \
  --plan-file examples/playground/commerce-platform/base/plan.tfplan \
  --diff examples/playground/commerce-platform/head/plan.json \
  --diff-plan-file examples/playground/commerce-platform/head/plan.tfplan \
  --no-serve -o comparison.json
rootform check comparison.json --policy-pack ./policy-packs/baseline -o results.sarif

The comparison reports the architectural difference between the two plans. Policy checks return 0 on pass, 1 on a violation and 3 for indeterminate evidence or no target. See outputs and exit status, review workflows, evidence limits and compatibility.

Integrations

GitHub Actions, other CI runners, VS Code and Zed.

Repository

Path	Contents
cli/	Public Go command surface, Form and Policy result models
dialects/	Official Dialects and their validation evidence
policy-packs/	Synthetic Policy Pack examples
examples/	Synthetic projects and saved plans
contracts/, schemas/	Integration contracts, generated reference data and JSON Schemas
docs/	User and contributor documentation
distribution/	Native installers and OCI image packaging

Contributing covers setup, commands and change validation. Security covers private vulnerability reporting.

License

Repository source: Apache-2.0. Official Dialects: MPL-2.0. Distributed executables and runtime images: Elastic-2.0. Third-party notices and trademark terms apply.