io.github.dynatrace-oss/Dynatrace-mcp

The materials show it requires DT_PLATFORM_TOKEN, OAUTH_CLIENT_ID, OAUTH_CLIENT_SECRET, and DT_ENVIRONMENT; these can enable access to Dynatrace platform data and are highly sensitive. No abnormal privilege request is described, but if exposed, they could be used to query or misuse logs, metrics, problems, and vulnerability data.

Although no fixed remote host is explicitly listed, the stated purpose and DT_ENVIRONMENT configuration strongly imply outbound requests to the corresponding Dynatrace environment/API, with query content and returned results transmitted beyond the local session. No clear red flag indicates exfiltration to unrelated or unknown third-party endpoints.

The system checks indicate that the tool executes code/spawns processes, which is a normal MCP capability and warrants caution. The available materials do not indicate unusual system privileges or execution behavior unrelated to its stated function.

Its stated capabilities cover logs, metrics, problems, vulnerabilities, and DQL/Davis AI queries, meaning it can access potentially sensitive operational and security observability data. The materials do not show broad local file read/write requirements, but it should be assumed to access whatever Dynatrace data its credentials authorize, so least privilege is important.

It comes from an official registry and has an auditable open-source repository with updates within the last year, which are strong positive signals. While the missing README, unspecified license, and low star count reduce transparency, the current facts do not show high-risk red flags such as closed-source exfiltration, unknown origin, or obvious abandonment.