CHANGELOG.md

@dynatrace-oss/dynatrace-managed-mcp

Unreleased

Breaking changes

• Security (HTTP mode): unauthenticated requests are now rejected. A request that omits the X-Dynatrace-Tokens header, or supplies no token that is valid on its environment, receives HTTP 401 before any MCP server or tool is created. Previously such a request could complete the MCP initialize handshake and call tools — including get_environments_info, which disclosed configured environment aliases and URLs.
• Removed the dynatrace_managed_check_config_errors tool. The startup configuration errors it reported are redundant with get_environments_info; any automation referencing this tool by name must be updated.
• The server no longer starts when any configured environment is invalid — configuration errors now fail startup instead of being skipped. Fix all environment configuration errors before starting.

Changes

• Added DT_MCP_TOKEN_VALIDATION_TTL_MS (default 60000) to control how long per-caller token-validation results are cached.
• Updated fast-uri to 3.1.4.

Fixes

• Per-request tokens are validated against the cluster (POST /api/v2/apiTokens/lookup) before tools are exposed. Validation results are cached per caller (keyed by a hash of the supplied tokens) and concurrent requests share a single validation, so the cluster is not probed on every request.
• get_environments_info now reports only on environments the caller supplied a token for, and returns an identical "invalid token" message whether an alias is unknown or its token is invalid — so callers can no longer enumerate which environments are configured.
• Improved get_environments_info in stdio mode: now uses cached startup validation results (version, validity, error) instead of re-probing live on every call, eliminating redundant network requests. The cluster version and minimum version check are now displayed from the cached result.
• Improved rate-limiting key stability: deriveUserKey now normalises the X-Dynatrace-Tokens header (sorts aliases, strips whitespace) so equivalent token sets produce the same rate-limit bucket regardless of header ordering.

0.6.0

• Breaking change (HTTP mode): the HTTP server no longer uses server-side API tokens. Each request must supply per-environment tokens via the X-Dynatrace-Tokens header (alias=token;alias=token); the server authenticates each environment with the caller's token, so each user only accesses data their token allows. In HTTP mode, environment config no longer requires apiToken (just alias + URLs). Run the HTTP server behind TLS. Rate limiting is now per-token. stdio / local mode is unchanged (tokens still come from the local config file / env vars).
• Documented HTTP header size limits for large multi-environment deployments: Node.js enforces a 16 KB default (approximately 140–150 environments); use --max-http-header-size to increase it. Added nginx example for raising the large_client_header_buffers limit when running behind a reverse proxy.
• Fixed Docker container build failure caused by ts-jest@29.4.6 incompatibility with TypeScript 6; updated ts-jest to 29.4.11 (supports TypeScript >=4.3 <7) and added tsconfig.test.json so Jest type definitions resolve correctly under TypeScript 6.
• Fixed TypeScript 6 build error: migrated tsconfig.json from deprecated moduleResolution: "node" to "bundler"; TypeScript 6 treats the old setting as a hard error on clean builds (e.g., in Docker).

0.5.7

• Fixed HTTP transport to return application/json responses instead of keeping persistent SSE connections open. This resolves indefinite hangs experienced by MCP clients (such as GitHub Copilot CLI) that do not support server-sent event streams.
• Fixed tool inputSchema in tools/list responses to strip the $schema and additionalProperties fields added by the MCP SDK. These caused HTTP 400 errors from OpenAI-compatible model APIs with strict JSON Schema validation, preventing tool use in clients such as GitHub Copilot CLI.
• Breaking change: Renamed tool dynatrace_managed_check_for_configuration_errors to dynatrace_managed_check_config_errors to comply with the 64-character function name limit imposed by OpenAI-compatible model APIs when tool names are namespace-qualified by the MCP client. MCP clients that discover tools dynamically (the typical case) are unaffected; any automation or configuration referencing the old tool name by string must be updated.
• Refactored HTTP server to create a fresh McpServer instance per request, satisfying the MCP SDK stateless HTTP requirement and preventing transport reuse errors.
• Added configurable rate limiting via DT_MCP_RATE_LIMIT_MAX_CALLS and DT_MCP_RATE_LIMIT_WINDOW_MS environment variables. You can now tune the rate limit to your needs. Defaults changed from 5 calls per 20 seconds to 20 calls per 20 seconds.
• Fixed typo in MetricDataResponse interface: renamed vaules field to values
• Fixed typo in dynatrace_managed_query_metrics_data tool description: corrected "retreived" to "retrieved"
• Fixed npm run build on Windows
• Fixed security vulnerabilities in dependencies: updated hono to 4.12.2, diff to 4.0.4, and minimatch to latest patch versions

0.5.6

• Updated ajv dependency to version 8.18.0 to address SNYK-JS-AJV-15274295 security vulnerability (ReDoS in schema compilation)

0.5.5

• Added multi-format configuration support with DT_CONFIG_FILE environment variable
  • Supports JSON and YAML configuration files for cleaner, more readable configuration
  • YAML files support comments for better documentation
  • Environment variable interpolation with ${VAR_NAME} syntax enables secure token management
  • Configuration files can be version-controlled without exposing secrets
  • Cross-platform path resolution (supports relative paths, absolute paths, ~ expansion)
  • Configuration priority: DT_CONFIG_FILE > DT_ENVIRONMENT_CONFIGS (backward compatible)
  • See examples/dt-config.yaml and examples/dt-config.json for practical examples
• Fixed Docker build TypeScript errors by removing invalid elicitation capability (client-only feature), simplifying type annotations to prevent deep type instantiation issues, and migrating to registerTool API from deprecated tool method
• Improved logging configuration with comprehensive environment variables LOG_OUTPUT and LOG_FILE, providing greater flexibility for log destinations. You can now:
  • Redirect logs to stdout (stdout or console), stderr (errors/warnings only with stderr, or all levels with stderr-all), or a custom file path
  • Use multiple destinations simultaneously (e.g., file+console to log to both file and stdout, or file+stderr for file logging with errors to stderr)
  • Disable logging entirely with disabled
• Improved log readability for console and stderr output by switching from JSON to human-readable format (YYYY-MM-DD HH:mm:ss.SSS [level] message), making debugging easier when using LOG_OUTPUT=console or LOG_OUTPUT=stderr-all. File logging continues to use JSON format for machine parsing
• Added runtime warning when LOG_OUTPUT=console or LOG_OUTPUT=stdout is used with stdio transport (default for VS Code), guiding users to use LOG_OUTPUT=stderr-all or LOG_OUTPUT=file instead, as stdout is reserved for MCP protocol communication
• Enhanced documentation with clear guidance on which LOG_OUTPUT settings work with stdio transport (VS Code, Claude Desktop) versus HTTP transport, including practical examples for each scenario

0.5.3

• Add multi-environment support, enabling you to connect to multiple Dynatrace Managed deployments simultaneously through a unified configuration

0.5.0

• Add arm container image
• Prepare release to ghcr

0.4.0

• Use lowercase mcpName

0.3.0

• Fixed server.json schema validation

0.2.0

• Updated server.json schema to 11.12.2025

0.1.0

• First npm release

0.0.1

• Initial Release