Claude Code gains TLA+ model checking via tla-mcp MCP server

tla-mcp is a Model Context Protocol server that exposes the tla-rs TLA+ model checker as a tool for Claude Code. With it registered, you can validate formal specifications, run bounded model checks, request counterexample traces, and replay specific scenarios — all from inside the AI chat.

What it does

TLA+ is a formal specification language for designing concurrent and distributed systems. The model checker exhaustively explores reachable states to catch invariant violations, deadlocks, and race conditions. tla-mcp translates Claude's requests into checker commands and returns results as structured tool responses.

Tool design philosophy

The tool descriptions are deliberately opinionated about how the LLM should use the checker:

• Budget all limits upfront (bounded checking parameters)
• Treat limit_reached as inconclusive — it means the checker ran out of states before completing the search
• When analyzing a counterexample trace, look at the last transition first (that's usually where the violation occurs)

These guardrails help the behavior survive context truncation and keep the model from drawing false conclusions from partial results.

Four tools

The server exposes four commands (exact names from the landing page):

• validate — check that a TLA+ spec is syntactically and structurally correct
• bounded_check — run model checking with a fixed depth limit, returns pass/fail or limit_reached
• trace — retrieve a counterexample trace for a failed check
• replay — replay a specific scenario step by step

Getting started

Head to the project page for installation instructions and the Claude Desktop/Code client config snippet. The server is an experiment — feedback and bug reports are welcome.

Who this is for

Developers who use formal methods for distributed systems and want to integrate model checking into their AI-assisted workflow.