{
"markdown": "# Dynatrace Managed MCP Server\n\n\n\n\n Use cases
\n\n> 1. Your Dynatrace Managed environment(s) is/are the primary Observability system, containing all live data; or\n> 2. There has been a migration from a Dynatrace Managed environment to a Dynatrace Saas environment; however, historical observability data has not been migrated and can still be accessed via a Dynatrace Managed environment.\n> The Dynatrace Managed MCP is used to access historical data, and a separate Dynatrace SaaS MCP is used to access live and more recent data.\n\n> Specific use cases for the Dynatrace Managed MCP include:\n>\n> - **Real-time observability** - Fetch production-level data for early detection and proactive monitoring\n> - **Contextual debugging** - Fix issues with full context from monitored exceptions, logs, and anomalies\n> - **Security insights** - Get detailed vulnerability analysis and security problem tracking. This can include multicloud compliance assessment with evidence-based investigation.\n> - **Natural language queries** - Queries are mapped to MCP tool usage, and thus API queries, with guidance for the next step\n> - **Multiphase incident investigation** - Systematic impact assessment and troubleshooting\n> - **Multienvironment support** - Query multiple Dynatrace Managed environments from the same MCP server\n\n \n\n\n Capabilities
\n\n> - **Problems** - List and get [problem](https://www.dynatrace.com/hub/detail/problems/) details from your services (for example Kubernetes)\n> - **Security** - List and get security problems / [vulnerability](https://www.dynatrace.com/hub/detail/vulnerabilities/) details\n> - **Entities** - Get more information about a monitored entity, including relationship mappings\n> - **SLO** - List and get Service Level Objective details, including evaluation and error budgets\n> - **Event Tracking** - List and get system events\n> - **Log Investigation** - Search and filter logs with advanced content and time-based queries\n> - **Metrics Analysis** - Query and analyze performance metrics using V2 Metrics API\n\n \n\nThe local _Dynatrace Managed MCP server_ allows AI Assistants to interact with one or more self-hosted [Dynatrace Managed](https://www.dynatrace.com/) deployments, bringing observability data directly into your AI-assisted workflow.\n\nThis MCP server supports **two modes**:\n\n- **Local mode:** Runs on your machine for development and testing.\n- **Remote mode:** Connects over HTTP/SSE for distributed or production-like setups.\n\n> [!TIP]\n> This MCP server is specifically designed for Dynatrace Managed (self-hosted) deployments.\n> For Dynatrace SaaS environments, please use the [Dynatrace MCP](https://github.com/dynatrace-oss/dynatrace-mcp).\n\n> [!NOTE]\n> This open source product is supported by the community.\n> For feature requests, questions, or assistance, please use [GitHub Issues](https://github.com/dynatrace-oss/dynatrace-managed-mcp/issues).\n\n## Quickstart in stdio (local) mode\n\nYou can add this MCP server to your AI Assistant, such as VSCode, Claude, Cursor, Kiro, Windsurf, ChatGPT, or GitHub Copilot.\n\nTo run this MCP server, you to have to configure four things:\n\n- _**Dynatrace Managed API token**_\n- _**Configuration file**_: `dt-config.yaml` or `dt-config.json` file which is responsible for defining list of environments you intend to use\n- _**MCP Server connection configuration file:**_ local mcp configuration, which is dependent on tools you are using\n- Set `DT_CONFIG_FILE` to the path of your `dt-config.yaml` or `dt-config.json` file in the MCP server environment.\n\n### Dynatrace Managed API token\n\nFor information about creating API tokens in Managed deployments, refer to the [Dynatrace Managed documentation](https://docs.dynatrace.com/managed/shortlink/api-authentication#create-token).\nYour API token must include the following scopes for full functionality:\n\n- Access problem and event feed, metrics, and topology (`DataExport`)\n- Read entities (`entities.read`)\n- Read events (`events.read`)\n- Read logs (`logs.read`)\n- Read metrics (`metrics.read`)\n- Read problems (`problems.read`)\n- Read security problems (`securityProblems.read`)\n- Read SLO (`slo.read`)\n\n### Configuration File\n\n#### Configuration parameters\n\n| Parameter | Required | Description | Example value |\n| -------------- | ------------------ | --------------------------------------------------------------------------------- | ------------------------------------------------- |\n| apiEndpointUrl | Yes | Base URL for Dynatrace Managed cluster API | https://dmz123.dynatrace-managed.com |\n| environmentId | Yes | ID of the managed environment | 01234567-89ab-cdef-abcd-ef0123456789 |\n| alias | Yes | Human-friendly name of the environment | MyEnvironment |\n| apiToken | Only in stdio mode | API token of the cluster with required scopes created using the instruction above | dt0s01.ABCDEFGHIJK0123 |\n| httpProxyUrl | No | URL of proxy server for requests. Do not use with the other proxy parameter | http://proxy.company.com:8080 |\n| httpsProxyUrl | No | URL of proxy server for requests. Do not use with the other proxy parameter | https://proxy.company.com:8080 |\n\nThere are **two ways** to configure your Dynatrace Managed environments.\n\n#### Method 1: Configuration File (Recommended for Local Development)\n\nExample: `dt-config.yaml`\n\n```yaml\n# Production environment\n- apiEndpointUrl: https://my-api.company.com/\n environmentId: abc-123\n alias: production\n # Token is injected from an environment variable at runtime\n apiToken: ${DT_PROD_TOKEN}\n # You can also use the token directly\n # apiToken: dt0s01.ABCDEFGHIJK0123\n\n# Staging environment\n- apiEndpointUrl: https://staging-api.company.com/\n environmentId: xyz-789\n alias: staging\n apiToken: ${DT_STAGING_TOKEN}\n```\n\nExample: `dt-config.json`\n\n```json\n[\n {\n \"apiEndpointUrl\": \"https://my-api.company.com/\",\n \"environmentId\": \"abc-123\",\n \"alias\": \"production\",\n \"apiToken\": \"${DT_PROD_TOKEN}\"\n }\n]\n```\n\n#### Method 2: Environment Variable (Docker/Kubernetes)\n\nFor Kubernetes deployments or if you prefer environment variables, you can set `DT_ENVIRONMENT_CONFIGS` with a JSON string in either your `.env` file or directly in MCP Server connection configuration file\n\n```shell\nDT_ENVIRONMENT_CONFIGS='[{\"apiEndpointUrl\":\"https://api.example.com/\",\"environmentId\":\"abc-123\",\"alias\":\"production\",\"apiToken\":\"dt0s01.ABCDEFGHIJK0123\"}]'\n```\n\n### MCP Server connection configuration file\n\nTo actually connect to the MCP server you have to configure your MCP connection in your AI Assistant\n\nWe recommend always setting it up for your current workspace instead of using it globally.\n\n#### VS Code\n\n```json\n{\n \"servers\": {\n \"npx-dynatrace-managed-mcp\": {\n \"command\": \"npx\",\n \"cwd\": \"${workspaceFolder}\",\n \"args\": [\"-y\", \"@dynatrace-oss/dynatrace-managed-mcp-server@latest\"],\n \"envFile\": \"${workspaceFolder}/.env\"\n }\n }\n}\n```\n\nAlternatively, this can also be stored in user settings, and you can define `env` as follows:\n\n```json\n{\n \"servers\": {\n \"npx-dynatrace-managed-mcp\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@dynatrace-oss/dynatrace-managed-mcp-server@latest\"],\n \"env\": {\n \"DT_PROD_TOKEN\": \"dt0s01.ABCDEFGHIJK0123\",\n \"DT_CONFIG_FILE\": \"dt-config.yaml\"\n }\n }\n }\n}\n```\n\n#### Claude Desktop\n\n```json\n{\n \"mcpServers\": {\n \"dynatrace-managed-mcp\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@dynatrace-oss/dynatrace-managed-mcp-server@latest\"],\n \"env\": {\n \"DT_PROD_TOKEN\": \"dt0s01.ABCDEFGHIJK0123\",\n \"DT_CONFIG_FILE\": \"dt-config.yaml\"\n }\n }\n }\n}\n```\n\n#### Kiro\n\n```json\n{\n \"mcpServers\": {\n \"dynatrace-managed-mcp\": {\n \"command\": \"npx\",\n \"args\": [\"-y\", \"@dynatrace-oss/dynatrace-managed-mcp-server@latest\"],\n \"env\": {\n \"DT_PROD_TOKEN\": \"dt0s01.ABCDEFGHIJK0123\",\n \"DT_CONFIG_FILE\": \"dt-config.yaml\"\n }\n }\n }\n}\n```\n\nThis configuration should be stored in `/.kiro/settings/mcp.json`, or in user-level settings (`~/.kiro/settings/mcp.json`).\n\n#### Google Gemini CLI\n\nUsing `gemini` CLI directly (recommended):\n\n```bash\ngemini extensions install https://github.com/dynatrace-oss/dynatrace-managed-mcp\nexport DT_ENVIRONMENT_CONFIGS=\"[{\\\"apiEndpointUrl\\\":\\\"https://my-api-endpoint.com/\\\",\\\"environmentId\\\":\\\"my-env-id-1\\\",\\\"alias\\\":\\\"alias-env\\\",\\\"apiToken\\\":\\\"my-api-token\\\"},{\\\"apiEndpointUrl\\\":\\\"https://my-api2-endpoint.com/\\\",\\\"environmentId\\\":\\\"my-env-id-2\\\",\\\"alias\\\":\\\"alias-env-2\\\",\\\"apiToken\\\":\\\"my-api-token-2\\\"}]\"\n```\n\nand verify that the server is running via\n\n```bash\ngemini mcp list\n```\n\nOr manually in your `~/.gemini/settings.json` or `.gemini/settings.json`:\n\n```json\n{\n \"mcpServers\": {\n \"dynatrace-managed-mcp\": {\n \"command\": \"npx\",\n \"args\": [\"@dynatrace-oss/dynatrace-managed-mcp-server@latest\"],\n \"env\": {\n \"DT_ENVIRONMENT_CONFIGS\": \"[{\\\"apiEndpointUrl\\\":\\\"https://my-api-endpoint.com/\\\",\\\"environmentId\\\":\\\"my-env-id-1\\\",\\\"alias\\\":\\\"alias-env\\\",\\\"apiToken\\\":\\\"my-api-token\\\"},{\\\"apiEndpointUrl\\\":\\\"https://my-api2-endpoint.com/\\\",\\\"environmentId\\\":\\\"my-env-id-2\\\",\\\"alias\\\":\\\"alias-env-2\\\",\\\"apiToken\\\":\\\"my-api-token-2\\\"}]\",\n \"DT_CONFIG_FILE\": \"dt-config.yaml\"\n },\n \"timeout\": 30000,\n \"trust\": false\n }\n }\n}\n```\n\n## HTTP Server Mode (Alternative)\n\nThe default mode for this local MCP uses stdio for transport.\n\nFor scenarios where you need to run the MCP server as an HTTP service instead, you can use the HTTP server mode (e.g., for load balancing or integration with web clients):\n\n### Running as HTTP server\n\nMake sure you have the [Configuration File](#configuration-file) in the same folder. You do not have to define API tokens for configurations ran in HTTP mode.\n\n```bash\n# Get help and see all available options\nnpx -y @dynatrace-oss/dynatrace-managed-mcp-server@latest --help\n\n# Run with HTTP server on default port 3000\nnpx -y @dynatrace-oss/dynatrace-managed-mcp-server@latest --http\n\n# Run with custom port\nnpx -y @dynatrace-oss/dynatrace-managed-mcp-server@latest --http --port 3001\n\n# Run with custom host/IP\nnpx -y @dynatrace-oss/dynatrace-mcp-server@latest --http --host 127.0.0.1 # recommended for local computers\nnpx -y @dynatrace-oss/dynatrace-mcp-server@latest --http --host 0.0.0.0 # recommended for container\nnpx -y @dynatrace-oss/dynatrace-mcp-server@latest --http --host 192.168.0.1 # recommended when sharing connection over a local network\n```\n\n> [!WARNING]\n> In HTTP mode the server validates the `Host` header to protect against DNS rebinding attacks. With `--host 0.0.0.0` (or `--host ::`) only **loopback** hostnames are accepted by default, so remote clients receive `403 Forbidden` until you set `DT_MCP_ALLOWED_HOSTS` to the hostnames they use. See [DNS Rebinding Protection](#dns-rebinding-protection-http-mode).\n\n#### MCP Server connection configuration file:\n\nAs explained earlier, HTTP mode does not store API tokens in its configuration. Authentication is done by the user by filling the `X-Dynatrace-Tokens` header.\n\n```json\n{\n \"mcpServers\": {\n \"dynatrace-managed-mcp\": {\n \"url\": \"http://localhost:3000\",\n \"transport\": \"http\",\n \"headers\": {\n \"Content-Type\": \"application/json\",\n \"Accept\": \"application/json,text/event-stream\",\n \"X-Dynatrace-Tokens\": \"alias1=token1;alias2=token2\"\n }\n }\n }\n}\n```\n\n### Performance Considerations\n\n**Important:** This MCP server makes API calls to the Dynatrace Managed environment(s). It is designed for efficient usage (e.g., limiting the response sizes), but care should be taken not to overload the Dynatrace Managed environment(s) with large queries.\n\n**Best Practices:**\n\n1. Use specific time ranges (e.g., 1-2 hours) rather than large historical queries.\n2. Use specific filters to limit the scope of queries as much as possible, for example, entity selectors that specify the entity ID.\n3. If using multiple environments, be specific about which one to query, where applicable. If querying multiple at once, be mindful of how much data will be returned to the LLM, e.g. top 10 problems from 2 envs = 20 problems, versus top 10 problems from 10 envs = 100 problems.\n\n### DNS Rebinding Protection (HTTP mode)\n\n- **`DT_MCP_ALLOWED_HOSTS`** (optional): Comma-separated list of hostnames the server accepts in the `Host` header. Ports are ignored, so list hostnames only (use the bracketed form for IPv6, e.g. `[::1]`).\n\nWhen this variable is **not** set, the allowlist is derived from `--host`: the bound address plus `localhost`, `127.0.0.1` and `[::1]`. Requests whose `Host` header is not on the list are rejected with `403 Forbidden`, as are requests carrying an `Origin` header for a hostname that is not on the list. This is what prevents [DNS rebinding attacks](https://en.wikipedia.org/wiki/DNS_rebinding).\n\nValidation is always active: there is no configuration in which it is silently skipped.\n\n> [!IMPORTANT]\n> When bound to a wildcard address (`--host 0.0.0.0` or `--host ::`), the bound address does not identify which hostnames are legitimate, so the server **accepts loopback hostnames only** and logs a warning at startup. DNS rebinding is blocked in this mode, but so is every remote client. If you run in a container or expose the server on a network, you **must** set `DT_MCP_ALLOWED_HOSTS` to the hostnames your clients use, or they will receive `403 Forbidden`.\n\n**Example:** container bound to all interfaces, reached as `mcp.internal.example.com`:\n\n```bash\nDT_MCP_ALLOWED_HOSTS=mcp.internal.example.com node dist/index.js --http --host 0.0.0.0\n```\n\n`DT_MCP_ALLOWED_HOSTS` **replaces** the derived list rather than extending it, so include loopback names explicitly if you also need local access:\n\n```bash\nDT_MCP_ALLOWED_HOSTS=mcp.internal.example.com,localhost,127.0.0.1\n```\n\n## Troubleshooting\n\n### Authentication Issues\n\nIn most cases, authentication issues stem from missing scopes or invalid tokens. Please ensure that you have added all required scopes as listed above.\n\nWhen experiencing errors, you can ask the AI Assistant for the exact error returned by the MCP. For startup issues, check the AI Assistant logs.\n\nYou can also try running the MCP directly to see if it reports errors on startup:\n\n ```bash\n npx @dynatrace-oss/dynatrace-managed-mcp-server@latest\n ```\n\n### Header size limits is too small\n\nThe `X-Dynatrace-Tokens` header grows with the number of environments. Each entry is roughly\n`alias=dt0s01.ABCDEFGHIJK0123` (~110 characters). Node.js enforces a default HTTP header size limit of\n**16 KB**, which accommodates approximately 140–150 environments before requests are rejected.\n\nIf you need more environments, increase the limit at server startup with the `--max-http-header-size`\nflag:\n\n```bash\nnode --max-http-header-size=65536 ./dist/index.js --http\n```\n\nIf you are running a **reverse proxy** (such as nginx) in front of the MCP server, the proxy also\nenforces its own limit. nginx defaults to 8 KB (`large_client_header_buffers`), which fits roughly\n70 environments. Raise it in your nginx configuration:\n\n```nginx\nlarge_client_header_buffers 4 32k;\n```\n\n## Telemetry\n\nThe Dynatrace MCP Server includes sending Telemetry Data via Dynatrace OpenKit to help improve the product. This includes:\n\n- Server start events\n- Tool usage (which tools are called, success/failure, execution duration)\n- Error tracking for debugging and improvement\n\n**Privacy and Opt-out:**\n\n- Telemetry is **disabled by default** but can be enabled by setting `DT_MCP_ENABLE_TELEMETRY=true`\n- No sensitive data from your Dynatrace environment is tracked\n- Only anonymous usage statistics and error information are collected\n- Usage statistics and error data is transmitted to Dynatrace’s analytics endpoint\n\n**Configuration options:**\n\n- `DT_MCP_ENABLE_TELEMETRY` (boolean, default: `false`) - Enable Telemetry\n- `DT_MCP_TELEMETRY_APPLICATION_ID` (string, default: `dynatrace-managed-mcp`) - Application ID for tracking\n- `DT_MCP_TELEMETRY_ENDPOINT_URL` (string, default: Dynatrace endpoint) - OpenKit endpoint URL\n- `DT_MCP_TELEMETRY_DEVICE_ID` (string, default: auto-generated) - Device identifier for tracking\n\n## Additional documentation\n\n### MCP Server usage\n\n- [API token scopes](docs/api_token_scopes.md) - table containing information about available tools, endpoints they are calling and required API token scopes to properly access them\n- [Architecture](docs/architecture.md) - detailed diagrams representing architecture of Dynatrace environment while using MCP server in either stdio or http mode\n- [Environment variables](docs/environment_variables.md) - detailed information about available environment variables\n- [Rule file](docs/rule_file.md) - determine rules for your AI Assistant to ensure smooth usage of the Managed cluster\n\n### Development\n\n- [Changelog format](docs/CHANGELOG.format.md) - instruction for developers on how to write consistent and structured changelogs\n- [Development](docs/DEVELOPMENT.md) - general information about running the project and its contents\n",
"bytes": 18752,
"sha": "1d878dc5dc33188c5659bf29a2e03f8163c0f1922b69398b87b112509e5fd6fc",
"repo_slug": "dynatrace-oss/dynatrace-managed-mcp",
"fonte": "repo",
"truncated": false,
"api": "https://agentalog.com/api/listings/mcp_io_github_dynatrace_oss_dynatrace_manage_de16ff32/readme"
}![\"Latest](\"https://img.shields.io/github/release/dynatrace-oss/dynatrace-managed-mcp?color=c05240\")
\n \n \n ![\"Dynatrace](\"https://img.shields.io/badge/License-Apache_2.0-blue?color=7c38a1\"){kind=icon}
\n \n \n ![\"npm\"](\"https://img.shields.io/npm/dm/@dynatrace-oss/dynatrace-managed-mcp-server?logo=npm&color=5ead35\")
\n \n \n ![\"Dynatrace](\"https://img.shields.io/github/contributors/dynatrace-oss/dynatrace-managed-mcp?color=5ead35\")
\n \n \n ![\"Dynatrace](\"https://img.shields.io/github/stars/dynatrace-oss/dynatrace-managed-mcp\")
\n \n