Dynatrace SaaS MCP Server

An MCP server for Dynatrace SaaS (Gen3 Platform) that exposes observability and configuration capabilities as tools for LLM agents (Claude Code, Claude Desktop, and any other MCP-compatible client).

Overview

This server bridges AI agents with Dynatrace SaaS, providing:

• Observability — DQL queries, log search, span/trace lookup, metrics, entities, problems, vulnerabilities

• Configuration — Settings 2.0 CRUD, dashboards, notebooks, SLOs, synthetic monitors

All write operations (create / update / delete) are blocked by default and must be explicitly enabled with DT_ENABLE_WRITES=true.

Two-Host / Two-Token Model

Dynatrace SaaS exposes APIs across two distinct hostnames, each requiring a different token type.

Setup

1. Clone & install:

   npm install

2. Configure environment:

   cp .env.example .env
   # then edit .env

   .env is gitignored — never commit it.

   Variable	Required	Description
   DT_PLATFORM_URL	yes	Platform host base URL
   DT_CLASSIC_URL	yes	Classic host base URL
   DT_PLATFORM_TOKEN	yes	Bearer token (dt0s16…) for platform APIs
   DT_API_TOKEN	yes	Api-Token (dt0c01…) for classic APIs
   DT_ENABLE_WRITES	no	Set to true to allow create/update/delete operations
   DT_HTTP_TIMEOUT_MS	no	Request timeout in ms (default: 30000)

Required Token Scopes

Classic API token (dt0c01…)

Needed for settings, metrics, entities, problems:

• metrics.read

• slo.read, slo.write

• logs.read

• settings.read, settings.write

• entities.read

• problems.read

• ReadConfig, WriteConfig

• ExternalSyntheticIntegration (synthetic read/write)

• credentialVault.read

Platform token (dt0s16…)

Needed for DQL/Grail, document APIs, SLOs, synthetic, and vulnerabilities:

• storage:logs:read

• storage:metrics:read

• storage:spans:read

• storage:entities:read

• storage:bizevents:read

• storage:events:read

• storage:buckets:read

• storage:system:read

• document:documents:read, document:documents:write

• document:environment-shares:read, document:environment-shares:write

• slo:slos:read, slo:slos:write

• automation:workflows:read (optional, for synthetic execution)

• securitySensor:vulnerabilities:read

Build & Run

# Install dependencies
npm install

# Build (compiles TypeScript to dist/)
npm run build

# Run the MCP server
node dist/index.js
# or equivalently:
npm start

# Development mode (tsx, no build step)
npm run dev

# Run tests
npm test

# Type-check only (no emit)
npm run typecheck

Read-Only by Default

All mutating tools (create, update, delete) check the enableWrites config flag. If the flag is false (the default), calling any write tool returns an error immediately — no network request is made.

Set DT_ENABLE_WRITES=true in your .env (or in the MCP client env config) to enable writes. Even then, each destructive tool has its own description noting that it is a write operation.

Tool Catalog

Observability

Configuration

Settings (8 tools): list_settings_schemas, get_settings_schema, list_settings_objects, get_settings_object, validate_settings_object, create_settings_object, update_settings_object, delete_settings_object

Dashboards (5 tools): list_dashboards, get_dashboard, create_dashboard, update_dashboard, delete_dashboard

Notebooks (5 tools): list_notebooks, get_notebook, create_notebook, update_notebook, delete_notebook

SLOs (7 tools): list_slos, get_slo, evaluate_slo, list_objective_templates, create_slo, update_slo, delete_slo

Synthetic (7 tools): list_monitors, get_monitor, list_synthetic_locations, list_synthetic_nodes, create_monitor, update_monitor, delete_monitor

Notes

• get_entity returns relationships and host properties inline, so it covers host-detail and entity-relationship use cases (there are no separate get_host / get_entity_relationships tools).

• Synthetic location/node tools are named list_synthetic_locations / list_synthetic_nodes.

MCP Client Registration

Add the following to your MCP client config (Claude Code ~/.claude/mcp.json or Claude Desktop claude_desktop_config.json):

{
  "mcpServers": {
    "dynatrace-saas": {
      "command": "node",
      "args": ["/Users/nasr/mycode/personal/saas-mcp/dist/index.js"],
      "env": {
        "DT_PLATFORM_URL": "https://asn8731h.sprint.apps.dynatracelabs.com",
        "DT_CLASSIC_URL": "https://asn8731h.sprint.dynatracelabs.com",
        "DT_PLATFORM_TOKEN": "dt0s16...",
        "DT_API_TOKEN": "dt0c01...",
        "DT_ENABLE_WRITES": "false"
      }
    }
  }
}

Replace the token values with real credentials. Set DT_ENABLE_WRITES to "true" only if you intend to allow the agent to create or modify Dynatrace configuration.