Tool-Grounded LLM Agent 'TerraRepair' Lifts Terraform Security Fix Rates From 26.6% to 78.4%

arXiv·high signal

TerraRepair (arXiv 2607.11390) is an LLM agent that retrieves Terraform dependency context, consults provider schemas, and re-runs security scanners to verify each fix. It raises Checkov-verified fix rates on AWS misconfigurations from 26.6% to 78.4% (and Trivy from 44.8% to 72.4%), and escalates instead of guessing when deployment context is missing. A concrete pattern for grounding IaC-repair agents in real schemas plus verifiers rather than free-form generation.