Dynatrace

Connect Dynatrace to CloudThinker for DQL queries, problem investigation, security vulnerability review, and entity discovery

Connect your Dynatrace environment to enable CloudThinker agents to run DQL queries, investigate problems, review security vulnerabilities, discover entities and ownership context, and inspect documents such as notebooks and dashboards across your observability stack.

CloudThinker connects to Dynatrace through the official Dynatrace MCP server using a Dynatrace Platform token and your Dynatrace Platform environment URL.

---

Prerequisites

• A Dynatrace Platform environment with the logs, events, spans, metrics, problems, entities, or documents you want CloudThinker to investigate.
• Your Dynatrace Platform environment URL, such as https://abc12345.apps.dynatrace.com.
• A Dynatrace Platform token with the read scopes CloudThinker needs.

CloudThinker runs the Dynatrace MCP server with npx, so you only need to provide the Dynatrace environment URL and Platform token in the connection form.

---

Setup

1. Open Dynatrace

   Sign in to your Dynatrace Platform environment. Use the Platform URL that follows the format https://<environment-id>.apps.dynatrace.com.

2. Create a Platform token

   Create a dedicated Dynatrace Platform token for CloudThinker and grant only the scopes listed in Required permissions for the workflows you want to enable.

   Copy the token immediately — it may not be shown again.

3. Add the connection in CloudThinker

   Navigate to Connections → Dynatrace and enter:

   • DT_ENVIRONMENT: your Dynatrace Platform environment URL
   • DT_PLATFORM_TOKEN: the Platform token you just created

   Click Connect. CloudThinker verifies the credentials and shows a Connected status.

Use a Dynatrace Platform token, not a classic Dynatrace API token. Classic API tokens do not provide the Platform scopes needed by the MCP server.

---

Connection details

Field	Description	Example
DT_ENVIRONMENT	Dynatrace Platform environment URL	https://abc12345.apps.dynatrace.com
DT_PLATFORM_TOKEN	Dynatrace Platform token	—

Use the Platform environment URL, not a classic live.dynatrace.com URL. The MCP server uses DT_ENVIRONMENT to reach Dynatrace Platform APIs and Grail data.

---

Required permissions

Create a dedicated Dynatrace Platform token and grant only the scopes required for the CloudThinker workflows you plan to use.

Scope	What it enables
app-engine:apps:run	Run most Dynatrace MCP tools
storage:buckets:read	Read system data stored on Grail and discover accessible buckets
storage:logs:read	Query logs through DQL
storage:metrics:read	Query metrics through DQL
storage:bizevents:read	Query business events through DQL
storage:spans:read	Query traces and spans through DQL
storage:entities:read	Query monitored entities through DQL
storage:events:read	Query events through DQL
storage:security.events:read	Query security events through DQL
storage:system:read	Query system data through DQL
storage:user.events:read	Query user events through DQL
storage:user.sessions:read	Query user sessions through DQL
storage:smartscape:read	Query Smartscape data through DQL
storage:files:read	Use DQL load statements for lookup data
document:documents:read	List and read notebooks, dashboards, and launchpads
document:documents:write	Create documents for approved workflows (optional)

Start with app-engine:apps:run plus the read scopes for the data types you need. Add document:documents:write only for approved workflows that need agents to create Dynatrace documents. Older MCP server versions also required app-engine:functions:run, settings:objects:read, and environment-api:entities:read — current versions no longer need those scopes.

---

Agent capabilities

Once connected, agents have access to the Dynatrace observability data allowed by the Platform token.

Capability	Description
DQL execution	Run and validate Dynatrace Query Language queries against Grail data
Logs, events, spans, and metrics	Investigate telemetry across short time windows and focused queries
Problem investigation	Retrieve Dynatrace problems and summarize affected services or infrastructure
Security vulnerabilities	Review reported vulnerabilities when the token includes security problem read access
Entity discovery	Discover monitored entities and ownership context for impacted systems
Documents	Inspect notebooks and dashboards when document scopes are granted

Verify the connection

@alex run Dynatrace discovery and list active problems and monitored entity count

Example prompts

@alex investigate current Dynatrace problems affecting production and summarize impacted entities
@alex run a Dynatrace DQL query for error logs from the checkout service over the last 30 minutes
@oliver check Dynatrace security vulnerabilities affecting internet-facing services

For large environments, scope requests with a known service, entity, bucket, and short time window so DQL queries stay focused.

---

Troubleshooting

Invalid environment URL

Make sure DT_ENVIRONMENT is the Dynatrace Platform URL, such as https://abc12345.apps.dynatrace.com. Classic live.dynatrace.com URLs are not valid for this connection.

Unauthorized or expired token

The Platform token is missing, expired, revoked, or copied incorrectly. Create a new Dynatrace Platform token with the required scopes and reconnect.

Permission errors

The token is missing one or more required scopes. If DQL works for events but not logs, add storage:logs:read. If most tools fail, confirm the token includes app-engine:apps:run.

Empty DQL results

The query may target an empty bucket, a data type the token cannot read, or a time range without matching telemetry. Try a shorter known query against a known service, bucket, or timeframe.

Large or slow Grail queries

Unbounded DQL queries can return too much data or take too long. Add filters, use short time windows, and ask agents to validate the query before expanding it.

---

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Platform token only — use a Dynatrace Platform token, not a classic API token; classic tokens lack the scopes the MCP server requires.
• Start with read scopes — grant document:documents:write only for workflows that need agents to create documents.

---

Related

Datadog Connection

Logs, metrics, APM, and incidents

New Relic Connection

APM, NRQL, infrastructure, and alerts