Skip to main content
Connect your Dynatrace environment to enable CloudThinker agents to run DQL queries, investigate problems, review security vulnerabilities, discover entities and ownership context, and inspect documents such as notebooks and dashboards across your observability stack. CloudThinker connects to Dynatrace through the official Dynatrace MCP server using a Dynatrace Platform token and your Dynatrace Platform environment URL.

​
Prerequisites

  • A Dynatrace Platform environment with the logs, events, spans, metrics, problems, entities, or documents you want CloudThinker to investigate.
  • Your Dynatrace Platform environment URL, such as https://abc12345.apps.dynatrace.com.
  • A Dynatrace Platform token with the read scopes CloudThinker needs.
CloudThinker runs the Dynatrace MCP server with npx, so you only need to provide the Dynatrace environment URL and Platform token in the connection form.

​
Setup

1

Open Dynatrace

Sign in to your Dynatrace Platform environment. Use the Platform URL that follows the format https://<environment-id>.apps.dynatrace.com.
2

Create a Platform token

Create a dedicated Dynatrace Platform token for CloudThinker and grant only the scopes listed in Required permissions for the workflows you want to enable.Copy the token immediately — it may not be shown again.
3

Add the connection in CloudThinker

Navigate to Connections → Dynatrace and enter:
  • DT_ENVIRONMENT: your Dynatrace Platform environment URL
  • DT_PLATFORM_TOKEN: the Platform token you just created
Click Connect. CloudThinker verifies the credentials and shows a Connected status.
Use a Dynatrace Platform token, not a classic Dynatrace API token. Classic API tokens do not provide the Platform scopes needed by the MCP server.

​
Connection details

FieldDescriptionExample
DT_ENVIRONMENTDynatrace Platform environment URLhttps://abc12345.apps.dynatrace.com
DT_PLATFORM_TOKENDynatrace Platform token—
Use the Platform environment URL, not a classic live.dynatrace.com URL. The MCP server uses DT_ENVIRONMENT to reach Dynatrace Platform APIs and Grail data.

​
Required permissions

Create a dedicated Dynatrace Platform token and grant only the scopes required for the CloudThinker workflows you plan to use.
ScopeWhat it enables
app-engine:apps:runRun most Dynatrace MCP tools
storage:buckets:readRead system data stored on Grail and discover accessible buckets
storage:logs:readQuery logs through DQL
storage:metrics:readQuery metrics through DQL
storage:bizevents:readQuery business events through DQL
storage:spans:readQuery traces and spans through DQL
storage:entities:readQuery monitored entities through DQL
storage:events:readQuery events through DQL
storage:security.events:readQuery security events through DQL
storage:system:readQuery system data through DQL
storage:user.events:readQuery user events through DQL
storage:user.sessions:readQuery user sessions through DQL
storage:smartscape:readQuery Smartscape data through DQL
storage:files:readUse DQL load statements for lookup data
document:documents:readList and read notebooks, dashboards, and launchpads
document:documents:writeCreate documents for approved workflows (optional)
Start with app-engine:apps:run plus the read scopes for the data types you need. Add document:documents:write only for approved workflows that need agents to create Dynatrace documents. Older MCP server versions also required app-engine:functions:run, settings:objects:read, and environment-api:entities:read — current versions no longer need those scopes.

​
Agent capabilities

Once connected, agents have access to the Dynatrace observability data allowed by the Platform token.
CapabilityDescription
DQL executionRun and validate Dynatrace Query Language queries against Grail data
Logs, events, spans, and metricsInvestigate telemetry across short time windows and focused queries
Problem investigationRetrieve Dynatrace problems and summarize affected services or infrastructure
Security vulnerabilitiesReview reported vulnerabilities when the token includes security problem read access
Entity discoveryDiscover monitored entities and ownership context for impacted systems
DocumentsInspect notebooks and dashboards when document scopes are granted

​
Verify the connection

@alex run Dynatrace discovery and list active problems and monitored entity count

​
Example prompts

@alex investigate current Dynatrace problems affecting production and summarize impacted entities
@alex run a Dynatrace DQL query for error logs from the checkout service over the last 30 minutes
@oliver check Dynatrace security vulnerabilities affecting internet-facing services
For large environments, scope requests with a known service, entity, bucket, and short time window so DQL queries stay focused.

​
Troubleshooting

Make sure DT_ENVIRONMENT is the Dynatrace Platform URL, such as https://abc12345.apps.dynatrace.com. Classic live.dynatrace.com URLs are not valid for this connection.
The Platform token is missing, expired, revoked, or copied incorrectly. Create a new Dynatrace Platform token with the required scopes and reconnect.
The token is missing one or more required scopes. If DQL works for events but not logs, add storage:logs:read. If most tools fail, confirm the token includes app-engine:apps:run.
The query may target an empty bucket, a data type the token cannot read, or a time range without matching telemetry. Try a shorter known query against a known service, bucket, or timeframe.
Unbounded DQL queries can return too much data or take too long. Add filters, use short time windows, and ask agents to validate the query before expanding it.

​
Security

  • Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
  • Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
  • Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
  • Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.
  • Platform token only — use a Dynatrace Platform token, not a classic API token; classic tokens lack the scopes the MCP server requires.
  • Start with read scopes — grant document:documents:write only for workflows that need agents to create documents.
https://mintcdn.com/cloudthinker/aLd-ttc-SCW-aFky/images/icons/datadog.svg?fit=max&auto=format&n=aLd-ttc-SCW-aFky&q=85&s=e8382167f2a1eb1e00971b5f4d703d48

Datadog Connection

Logs, metrics, APM, and incidents
https://mintcdn.com/cloudthinker/wCGuHK6EQ4nmA6Df/images/icons/newrelic.svg?fit=max&auto=format&n=wCGuHK6EQ4nmA6Df&q=85&s=5c54d5df836916a27f3e0b7e6c8f8edb

New Relic Connection

APM, NRQL, infrastructure, and alerts