SchematIaC — Terraform & Bicep Visual Editor

Your Terraform or Bicep, as a drawing. Edit the drawing — it edits the files.

Open your Terraform (.tf/.tfvars) or Bicep (.bicep/.bicepparam) files on one canvas, see what every value actually resolves to, and change a mapping by dragging a wire or editing a value. The change is written back into your file as a clean one-line diff — comments, alignment and ordering untouched. Your code never leaves your machine.

SchematIaC = schematic + IaC. Say it like "schematic" with an ack: skee-MAT-ee-ack.

What it shows you

• Where every value comes from. Blocks become nodes, properties become rows, references become wires. A values-file entry (a tfvars line, a .bicepparam assignment) flows into a variable, which flows into a resource attribute — one connected path. Click a row and its whole lineage lights up while everything else dims.
• What it actually resolves to. The canvas evaluates your code locally and shows the computed value, not the expression: "${var.env}-acme" reads "dev-acme". A corner mark says when a value was computed rather than typed, and it is honest about what cannot be known before a real deployment.
• Which environment you are looking at. One canvas is one definition. For Terraform, simulated workspaces parameterize it with the variable values a real workspace injects at plan time — switch between them, or compare them all at once, with overridden values marked. For Bicep, add more than one .bicepparam file to the canvas and each is already its own environment.

What it lets you change

• Re-point a reference. Drag a wire's source dot onto a different variable, local, module output or resource attribute — a real resource value is a dependency Terraform can order, where a matching local is only a string. Compatible targets light up as you drag; a list cannot be dropped where a string is expected.

• Analyze. One click lists the re-wirings the canvas argues for: rows reading a local that is really the recipe for a resource's name, which should read the resource so Terraform can order the dependency; outputs echoing that recipe; literals that equal a value their siblings already read from one place. Rules over the graph, offline — not a model. Each suggestion draws the wire it would make, and Apply shows the same diff a drag does.

• Edit a value. Click a definition in the properties panel and type a new expression. It is validated in that file's own language before it can touch a file.

• Pick up several nodes. Ctrl-click node titles, or Shift-drag a rectangle over the canvas: every node it touches is outlined while you drag, so the answer is on screen before you let go. Group them into one box you can fold away, or move them together.

• Copy resources between canvases. Select resource, data or module nodes and press Ctrl+C, then Ctrl+V on another canvas — a second environment open beside the first, say. Paste over a file's box in the Group: file view to choose where the block goes, or pick the file from a list that puts the matching one first (qa/main.tf → prod/main.tf). The block arrives byte for byte, comments included, at the end of that file; a name that is already taken asks for a new one, and anything the block reads that the target does not have yet is listed before you approve. It is ordinary HCL on the clipboard, so it pastes into a text editor too, and HCL copied from anywhere pastes onto a canvas. Terraform only, for now.

• Review before anything moves. Every edit shows you the exact line diff for approval. Changes are staged until you press Save, which reviews every pending file one last time, with per-file revert. Only the expression you changed is rewritten — nothing is reformatted.

• Preview an upgrade. Upgrade on the toolbar — or Preview upgrade… on a registry module, or Preview provider upgrade… on a resource. Pick a newer version and the canvas paints what that bump would do here. For a module: inputs you set that vanish, required inputs you lack, outputs you read that disappear, provider pins that will not satisfy. For a provider: arguments you set that the target version's docs no longer list, arguments those docs mark required that you do not set, types with no docs page. Apply rewrites version / required_providers through the same review as any other edit. The Registry (and, if needed, the provider's GitHub tag) see only addresses, versions, and resource type names, after a first-use prompt.

Show Diffs

Toggle Diffs on the canvas toolbar to colour what changed against a git baseline — your own uncommitted edits, an AI agent's staged work, or a PR branch — without running terraform plan. Changed rows and wires are marked; a hollow mark means a definition is untouched but what it resolves to moved downstream; removed resources and wires show as dashed ghosts beside the current graph. The baseline defaults to your last commit and can be pointed at any branch, tag, or the merge base with one (what a PR against it would change).

Getting started

1. Run New SchematIaC Canvas from the command palette and name it.
2. Right-click a Terraform or Bicep file, or a folder of them, in the Explorer and choose Add to SchematIaC Canvas — or use + Add file on the canvas toolbar. A canvas holds one language; the first file you add decides which.
3. Click a row to trace it. Hover a marked value for the expression behind it.
4. Drag a wire, or edit a value in the properties panel. Approve the diff.
5. Press Save.

Local modules load automatically when you add the root files, and each appears as a box with input and output ports. For Terraform, that's local paths (./, ../) directly, and registry or git modules from what terraform init vendored under .terraform/modules. For Bicep, local file paths only for now — a registry (br:) module shows as a box with a note instead.

Folder Overview

For the shape of a whole tree rather than the wiring of one root, right-click a folder and choose SchematIaC Folder Overview. Every .tf and .tfvars beneath it is read — nothing is evaluated — into one read-only picture: a card per directory with what it declares (resources by type and provider, data sources, module calls, variables, outputs, tfvars files), nested in frames per folder that fold to a single box, and wires for composition — which directories call which as local modules, and which read whose remote state. Registry modules and states written elsewhere sit at the edge as stubs. Select a directory for its file list, and open it on a detailed canvas from there.

Terraform only, for now — a Bicep folder opens straight on a canvas instead.

Your code never leaves your machine

• The engine is compiled to WebAssembly and runs inside VS Code. Nothing is uploaded, ever. No terraform or bicep binary is needed.
• No telemetry, no analytics, no licence check-in.
• Licence keys are cryptographically signed and verified offline. Once activated, the extension needs no network at all.
• The one exception, stated plainly: getting the free licence sends your email address, an anonymous installation digest — a hash of the machine's own install identity and your user name, never the values themselves; two digests while an older format is still honoured — and the 6-digit code we email back. A second, also explicit: Preview upgrade… asks the Terraform Registry (and, if needed, the provider's GitHub tag) for version lists, module interfaces, and resource docs. It sends only addresses, version strings, and resource type names — never your files — and only after you accept a first-use prompt. Cached per version. An air-gapped machine loses that preview, not the canvas. Never any of your code, at any point. How we handle your data →

Works with your AI agent

Run Copy MCP Setup for AI Agents from the command palette, choose your client, and paste what it copies: a ready-to-run claude mcp add command for Claude Code, or the mcp.json block for Cursor, Claude Desktop and other MCP clients. The same command copies a short note for your agent's own instructions (CLAUDE.md, AGENTS.md, Cursor rules), so it uses these tools before it searches files. It gives your agent the same deterministic engine the canvas uses, Terraform or Bicep: where a value comes from, what it resolves to, and a validated diff for a proposed change — still local, still no CLI binary. The agent brings the AI; SchematIaC never writes a file — every edit tool returns a diff for your agent's own host to apply.

Licensing

SchematIaC is commercial software (see LICENSE.txt). A six-month free trial — start from the canvas with an email address, no card. The key we issue lasts six months from that day. After that a licence is required; canvases will not open without one, and your files are untouched.

• Get Free Licence, Enter Licence Key, Licence Status and Buy a Licence are in the command palette under SchematIaC.
• Buy at schematiac.com/pricing. Your key arrives by email and is pasted once with Enter Licence Key.

What it does not do yet

• Terraform registry and git modules load once terraform init has vendored them; Bicep registry (br:) modules do not have that vendoring step, so they show as a box with a note rather than real ports.
• A module is a box with ports — you cannot drill into it yet.
• count and for_each (Terraform) are not expanded: a resource with three instances is one node. Bicep's [for ...] loop resources render as one node the same way.
• A few functions (Terraform's templatefile and cidrsubnet; Bicep's user-defined func) are not evaluated; those rows read unresolved rather than guess.
• A resource can be copied from one canvas to another, but creating one from scratch, deleting one, and moved-block refactoring are roadmap.
• Bicep canvases don't have simulated workspaces — add more .bicepparam files instead, one per environment.

The changelog keeps shipped and roadmap strictly apart.

Requirements

VS Code 1.74 or newer. Works with OpenTofu — same HCL.

Links

schematiac.com · Getting started · Issues · Support · Privacy & data handling

SchematIaC is the editable successor to MetaCloudExplorer, which took first place in NVIDIA's Omniverse developer contest — the same idea, now living inside VS Code without the Omniverse overhead, and able to write back.

Published by SolidCloud, LLC. Third-party licences are listed in THIRD-PARTY-NOTICES.txt.