sbx/dynatrace-kit:20260921-d68f01b5d9a326b189351ed54139ef16e8e25b95

schemaVersion: "2"
kind: mixin
name: dynatrace
version: 1.0.0
displayName: Dynatrace (SaaS, Remote MCP)
description: 'Wires an agent to a Dynatrace SaaS environment through the official hosted Dynatrace Remote MCP server (no install): query problems, vulnerabilities, entities, logs, and run DQL against Grail. The kit holds no token; store it once with `sbx secret set dynatrace` and the sbx proxy injects it as a Bearer token on requests to *.apps.dynatrace.com.'
licenses:
    - Apache-2.0
args:
    environment:
        default: https://YOUR-ENV.apps.dynatrace.com
        description: Your Dynatrace SaaS (Gen3 "apps") environment URL, for example https://abc12345.apps.dynatrace.com. Use the "apps" URL, not the classic *.live.dynatrace.com. Left at the default, the kit installs but the Remote MCP registration and the runbooks stay inert until you set a real URL.
        pattern: ^https://[A-Za-z0-9-]+\.apps\.dynatrace\.com/?$
agentInstructions:
    content: |
        ## Dynatrace observability tooling (SaaS, Remote MCP)

        The official Dynatrace **Remote MCP server** is registered with the agent as
        `dynatrace`, pointed at the SaaS environment in `DT_ENVIRONMENT`
        (`https://<env>.apps.dynatrace.com`). It is hosted by Dynatrace, so nothing
        is installed in the sandbox. Through it you can list problems, security
        vulnerabilities and exceptions, find entities, run and explain DQL against
        Grail, and talk to Davis CoPilot.

        No token lives in the sandbox: it is stored on the host with
        `sbx secret set dynatrace`, and the sbx proxy overwrites the `Authorization`
        header with the real platform token on outbound requests to
        `*.apps.dynatrace.com`. If MCP calls fail with auth errors, check that
        `DT_ENVIRONMENT` is your real `*.apps.dynatrace.com` URL and that the secret
        is stored (`sbx secret ls`).

        For quick scripting, the `requests`-based runbooks in `~/runbooks/` run DQL
        directly against the Grail query API: `python3 ~/runbooks/run_dql.py 'fetch
        dt.davis.problems | limit 10'` or `python3 ~/runbooks/dynatrace_report.py`.
permissions:
    network:
        allow:
            - pypi.org
            - files.pythonhosted.org
            - '*.apps.dynatrace.com'
credentials:
    - service: dynatrace
      description: Dynatrace platform token, sent as a Bearer token to *.apps.dynatrace.com (the Remote MCP gateway and the Grail DQL API). Needs the storage read scopes for DQL. Stored on the host; the sandbox only ever sees a placeholder.
      required: true
      apiKey:
        name: DT_PLATFORM_TOKEN
        inject:
            - domain: '*.apps.dynatrace.com'
              header: Authorization
              format: Bearer %s
environment:
    variables:
        DT_ENVIRONMENT: ${{ kit.args.environment }}
        NO_PROXY: localhost,127.0.0.1,host.docker.internal
        no_proxy: localhost,127.0.0.1,host.docker.internal
setup:
    install:
        - command: pip install --break-system-packages 'requests>=2.31,<3'
          user: "1000"
          description: Install the requests library used by the DQL runbooks
    startup:
        - command:
            - sh
            - -c
            - 'command -v claude >/dev/null 2>&1 || exit 0; case "$DT_ENVIRONMENT" in *YOUR-ENV*) exit 0 ;; esac; claude mcp add --transport http dynatrace "$DT_ENVIRONMENT/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp" --header "Authorization: Bearer inject-me" >/dev/null 2>&1 || true'
          user: "1000"
          description: Register the Dynatrace Remote MCP server with the Claude agent (best-effort; no-op elsewhere)
    files:
        - path: /home/agent/.dynatrace/mcp.json
          content: |
            {
              "mcpServers": {
                "dynatrace": {
                  "type": "http",
                  "url": "${{ kit.args.environment }}/platform-reserved/mcp-gateway/v0.1/servers/dynatrace-mcp/mcp",
                  "headers": {
                    "Authorization": "Bearer inject-me"
                  }
                }
              }
            }
          mode: "0644"
          onlyIfMissing: true
          description: Portable Remote MCP definition for any agent that reads an mcpServers block. The Authorization value is a placeholder the proxy overwrites on the wire.