> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Dynatrace

> Connect Dynatrace to CloudThinker for DQL queries, problem investigation, security vulnerability review, and entity discovery

Connect your Dynatrace environment to enable CloudThinker agents to run DQL queries, investigate problems, review security vulnerabilities, discover entities and ownership context, and inspect documents such as notebooks and dashboards across your observability stack.

CloudThinker connects to Dynatrace through the official Dynatrace MCP server using a **Dynatrace Platform token** and your **Dynatrace Platform environment URL**.

***

## Prerequisites

* A **Dynatrace Platform environment** with the logs, events, spans, metrics, problems, entities, or documents you want CloudThinker to investigate.
* Your **Dynatrace Platform environment URL**, such as `https://abc12345.apps.dynatrace.com`.
* A **Dynatrace Platform token** with the read scopes CloudThinker needs.

<Info>
  CloudThinker runs the Dynatrace MCP server with `npx`, so you only need to provide the Dynatrace environment URL and Platform token in the connection form.
</Info>

***

## Setup

<Steps>
  <Step title="Open Dynatrace">
    Sign in to your Dynatrace Platform environment. Use the Platform URL that follows the format `https://<environment-id>.apps.dynatrace.com`.
  </Step>

  <Step title="Create a Platform token">
    Create a dedicated Dynatrace **Platform token** for CloudThinker and grant only the scopes listed in [Required permissions](#required-permissions) for the workflows you want to enable.

    Copy the token immediately — it may not be shown again.
  </Step>

  <Step title="Add the connection in CloudThinker">
    Navigate to **Connections → Dynatrace** and enter:

    * **DT\_ENVIRONMENT**: your Dynatrace Platform environment URL
    * **DT\_PLATFORM\_TOKEN**: the Platform token you just created

    Click **Connect**. CloudThinker verifies the credentials and shows a **Connected** status.
  </Step>
</Steps>

<Warning>
  Use a Dynatrace **Platform token**, not a classic Dynatrace API token. Classic API tokens do not provide the Platform scopes needed by the MCP server.
</Warning>

***

## Connection details

| Field                   | Description                        | Example                               |
| ----------------------- | ---------------------------------- | ------------------------------------- |
| **DT\_ENVIRONMENT**     | Dynatrace Platform environment URL | `https://abc12345.apps.dynatrace.com` |
| **DT\_PLATFORM\_TOKEN** | Dynatrace Platform token           | —                                     |

<Note>
  Use the Platform environment URL, not a classic `live.dynatrace.com` URL. The MCP server uses `DT_ENVIRONMENT` to reach Dynatrace Platform APIs and Grail data.
</Note>

***

## Required permissions

Create a dedicated Dynatrace **Platform token** and grant only the scopes required for the CloudThinker workflows you plan to use.

| Scope                          | What it enables                                                  |
| ------------------------------ | ---------------------------------------------------------------- |
| `app-engine:apps:run`          | Run most Dynatrace MCP tools                                     |
| `storage:buckets:read`         | Read system data stored on Grail and discover accessible buckets |
| `storage:logs:read`            | Query logs through DQL                                           |
| `storage:metrics:read`         | Query metrics through DQL                                        |
| `storage:bizevents:read`       | Query business events through DQL                                |
| `storage:spans:read`           | Query traces and spans through DQL                               |
| `storage:entities:read`        | Query monitored entities through DQL                             |
| `storage:events:read`          | Query events through DQL                                         |
| `storage:security.events:read` | Query security events through DQL                                |
| `storage:system:read`          | Query system data through DQL                                    |
| `storage:user.events:read`     | Query user events through DQL                                    |
| `storage:user.sessions:read`   | Query user sessions through DQL                                  |
| `storage:smartscape:read`      | Query Smartscape data through DQL                                |
| `storage:files:read`           | Use DQL `load` statements for lookup data                        |
| `document:documents:read`      | List and read notebooks, dashboards, and launchpads              |
| `document:documents:write`     | Create documents for approved workflows (optional)               |

<Tip>
  Start with `app-engine:apps:run` plus the read scopes for the data types you need. Add `document:documents:write` only for approved workflows that need agents to create Dynatrace documents. Older MCP server versions also required `app-engine:functions:run`, `settings:objects:read`, and `environment-api:entities:read` — current versions no longer need those scopes.
</Tip>

***

## Agent capabilities

Once connected, agents have access to the Dynatrace observability data allowed by the Platform token.

| Capability                           | Description                                                                          |
| ------------------------------------ | ------------------------------------------------------------------------------------ |
| **DQL execution**                    | Run and validate Dynatrace Query Language queries against Grail data                 |
| **Logs, events, spans, and metrics** | Investigate telemetry across short time windows and focused queries                  |
| **Problem investigation**            | Retrieve Dynatrace problems and summarize affected services or infrastructure        |
| **Security vulnerabilities**         | Review reported vulnerabilities when the token includes security problem read access |
| **Entity discovery**                 | Discover monitored entities and ownership context for impacted systems               |
| **Documents**                        | Inspect notebooks and dashboards when document scopes are granted                    |

### Verify the connection

```text theme={null}
@alex run Dynatrace discovery and list active problems and monitored entity count
```

### Example prompts

```text theme={null}
@alex investigate current Dynatrace problems affecting production and summarize impacted entities
@alex run a Dynatrace DQL query for error logs from the checkout service over the last 30 minutes
@oliver check Dynatrace security vulnerabilities affecting internet-facing services
```

For large environments, scope requests with a known service, entity, bucket, and short time window so DQL queries stay focused.

***

## Troubleshooting

<Accordion title="Invalid environment URL">
  Make sure **DT\_ENVIRONMENT** is the Dynatrace Platform URL, such as `https://abc12345.apps.dynatrace.com`. Classic `live.dynatrace.com` URLs are not valid for this connection.
</Accordion>

<Accordion title="Unauthorized or expired token">
  The Platform token is missing, expired, revoked, or copied incorrectly. Create a new Dynatrace Platform token with the required scopes and reconnect.
</Accordion>

<Accordion title="Permission errors">
  The token is missing one or more required scopes. If DQL works for events but not logs, add `storage:logs:read`. If most tools fail, confirm the token includes `app-engine:apps:run`.
</Accordion>

<Accordion title="Empty DQL results">
  The query may target an empty bucket, a data type the token cannot read, or a time range without matching telemetry. Try a shorter known query against a known service, bucket, or timeframe.
</Accordion>

<Accordion title="Large or slow Grail queries">
  Unbounded DQL queries can return too much data or take too long. Add filters, use short time windows, and ask agents to validate the query before expanding it.
</Accordion>

***

## Security

* **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later.
* **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection.
* **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
* **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves.

- **Platform token only** — use a Dynatrace Platform token, not a classic API token; classic tokens lack the scopes the MCP server requires.
- **Start with read scopes** — grant `document:documents:write` only for workflows that need agents to create documents.

***

## Related

<CardGroup cols={2}>
  <Card title="Datadog Connection" icon="https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/datadog.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=e8382167f2a1eb1e00971b5f4d703d48" href="/guide/connections/datadog" width="24" height="24" data-path="images/icons/datadog.svg">
    Logs, metrics, APM, and incidents
  </Card>

  <Card title="New Relic Connection" icon="https://mintcdn.com/cloudthinker/wCGuHK6EQ4nmA6Df/images/icons/newrelic.svg?fit=max&auto=format&n=wCGuHK6EQ4nmA6Df&q=85&s=5c54d5df836916a27f3e0b7e6c8f8edb" href="/guide/connections/newrelic" width="45" height="52" data-path="images/icons/newrelic.svg">
    APM, NRQL, infrastructure, and alerts
  </Card>
</CardGroup>