@dynatrace-oss/dynatrace-mcp-server 0.8.0 → 0.9.0

package/README.md

@@ -29,15 +29,11 @@ https://github.com/user-attachments/assets/25c05db1-8e09-4a7f-add2-ed486ffd4b5a
 
 ## Quickstart
 
-You can add this MCP server to your MCP Client like VSCode, Claude, Cursor, Amazon Q, Windsurf, ChatGPT, or Github Copilot via the npmjs package `@dynatrace-oss/dynatrace-mcp-server`, and type `stdio`.
-You can find more details about the configuration for different AI Assistants, Agents and MCP Clients in the [Configuration section below](#configuration).
+You can add this MCP server to your MCP Client like VSCode, Claude, Cursor, Amazon Q, Windsurf, ChatGPT, or Github Copilot via the command is `npx -y @dynatrace-oss/dynatrace-mcp-server` (type: `stdio`). For more details, please refer to the [configuration section below](#configuration).
 
-Furthermore, you need your Dynatrace environment URL, e.g., `https://abc12345.apps.dynatrace.com`, as well as a [Platform Token](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens), e.g., `dt0s16.SAMPLE.abcd1234`, with [required scopes](#scopes-for-authentication).
-
-Depending on your MCP Client, you need to configure these as environment variables or as settings in the UI:
+Furthermore, you need to configure the URL to a Dynatrace environment:
 
 - `DT_ENVIRONMENT` (string, e.g., `https://abc12345.apps.dynatrace.com`) - URL to your Dynatrace Platform (do not use Dynatrace classic URLs like `abc12345.live.dynatrace.com`)
-- `DT_PLATFORM_TOKEN` (string, e.g., `dt0s16.SAMPLE.abcd1234`) - **Recommended**: Dynatrace Platform Token
 
 Once you are done, we recommend looking into [example prompts](#-example-prompts-), like `Get all details of the entity 'my-service'` or `Show me error logs`. Please mind that these prompts lead to executing DQL statements which may incur [costs](#costs) in accordance to your licence.
 
@@ -111,97 +107,6 @@ fetch dt.system.events
 
 > **Note:** While Davis CoPilot AI is generally available (GA), the Davis CoPilot APIs are currently in preview. For more information, visit the [Davis CoPilot Preview Community](https://dt-url.net/copilot-community).
 
-## 🎯 AI-Powered Observability Workshop Rules
-
-Enhance your AI assistant with comprehensive Dynatrace observability analysis capabilities through our streamlined workshop rules. These rules provide hierarchical workflows for security, compliance, incident response, and distributed systems investigation.
-
-### **🚀 Quick Setup for AI Assistants**
-
-Copy the comprehensive rule files from the [`dynatrace-agent-rules/rules/`](./dynatrace-agent-rules/rules/) directory to your AI assistant's rules directory:
-
-**IDE-Specific Locations:**
-
-- **Amazon Q**: `.amazonq/rules/` (project) or `~/.aws/amazonq/rules/` (global)
-- **Cursor**: `.cursor/rules/` (project) or via Settings → Rules (global)
-- **Windsurf**: `.windsurfrules/` (project) or via Customizations → Rules (global)
-- **Cline**: `.clinerules/` (project) or `~/Documents/Cline/Rules/` (global)
-- **GitHub Copilot**: `.github/copilot-instructions.md` (project only)
-
-Then initialize the agent in your AI chat:
-
-```
-load dynatrace mcp
-```
-
-### **🏗️ Enhanced Analysis Capabilities**
-
-The workshop rules unlock advanced observability analysis modes:
-
-#### **🚨 Incident Response & Problem Investigation**
-
-- **4-phase structured investigation** workflow (Detection → Impact → Root Cause → Resolution)
-- **Cross-data source correlation** (problems → logs → spans → metrics)
-- **Kubernetes-aware incident analysis** with namespace and pod context
-- **User impact assessment** with Davis AI integration
-
-#### **📊 Comprehensive Data Investigation**
-
-- **Unified log-service-process analysis** in single workflow
-- **Business logic error detection** patterns
-- **Deployment correlation analysis** with ArgoCD/GitOps integration
-- **Golden signals monitoring** (Rate, Errors, Duration, Saturation)
-
-#### **🔗 Advanced Transaction Analysis**
-
-- **Precise root cause identification** with file/line numbers
-- **Exception stack trace analysis** with business context
-- **Multi-service cascade failure analysis**
-- **Performance impact correlation** across distributed systems
-
-#### **🛡️ Enhanced Security & Compliance**
-
-- **Latest-scan analysis** prevents outdated data aggregation
-- **Multi-cloud compliance** (AWS, Azure, GCP, Kubernetes)
-- **Evidence-based investigation** with detailed remediation paths
-- **Risk-based scoring** with team-specific guidance
-
-#### **⚡ DevOps Automation & SRE**
-
-- **Deployment health gates** with automated promotion/rollback
-- **SLO/SLI automation** with error budget calculations
-- **Infrastructure as Code remediation** with auto-generated templates
-- **Alert optimization workflows** with pattern recognition
-
-### **📁 Hierarchical Rule Architecture**
-
-The rules are organized in a context-window optimized structure:
-
-```
-rules/
-├── DynatraceMcpIntegration.md                    # 🎯 MAIN ORCHESTRATOR
-├── workflows/                                    # 🔧 ANALYSIS WORKFLOWS
-│   ├── incidentResponse.md                       # Core incident investigation
-│   ├── DynatraceSecurityCompliance.md           # Security & compliance analysis
-│   ├── DynatraceDevOpsIntegration.md            # CI/CD automation
-│   └── dataSourceGuides/                        # 📊 DATA ANALYSIS GUIDES
-│       ├── dataInvestigation.md                 # Logs, services, processes
-│       └── DynatraceSpanAnalysis.md             # Transaction tracing
-└── reference/                                   # 📚 TECHNICAL DOCUMENTATION
-    ├── DynatraceQueryLanguage.md                # DQL syntax foundation
-    ├── DynatraceExplore.md                      # Field discovery patterns
-    ├── DynatraceSecurityEvents.md               # Security events schema
-    └── DynatraceProblemsSpec.md                 # Problems schema reference
-```
-
-**Key Architectural Benefits:**
-
-- **All files under 6,500 tokens** - Compatible with most LLM context limits
-- **Hierarchical organization** - Clear entry points and specialized guides
-- **Eliminated circular references** - No more confusing cross-referencing webs
-- **DQL-first approach** - Prefer flexible queries over rigid MCP calls
-
-For detailed information about the workshop rules, see the [Rules README](./dynatrace-agent-rules/rules/README.md).
-
 ## Configuration
 
 You can add this MCP server (using STDIO) to your MCP Client like VS Code, Claude, Cursor, Amazon Q Developer CLI, Windsurf Github Copilot via the package `@dynatrace-oss/dynatrace-mcp-server`.
@@ -233,7 +138,6 @@ This only works if the config is stored in the current workspaces, e.g., `<your-
       "command": "npx",
       "args": ["-y", "@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       }
     }
@@ -250,7 +154,6 @@ This only works if the config is stored in the current workspaces, e.g., `<your-
       "command": "npx",
       "args": ["-y", "@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       }
     }
@@ -269,7 +172,6 @@ The [Amazon Q Developer CLI](https://docs.aws.amazon.com/amazonq/latest/qdevelop
       "command": "npx",
       "args": ["-y", "@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       }
     }
@@ -287,7 +189,7 @@ Using `gemini` CLI directly (recommended):
 
 ```bash
 gemini extensions install https://github.com/dynatrace-oss/dynatrace-mcp
-export DT_PLATFORM_TOKEN=...
+export DT_PLATFORM_TOKEN=... # optional
 export DT_ENVIRONMENT=https://...
 ```
 
@@ -306,7 +208,6 @@ Or manually in your `~/.gemini/settings.json` or `.gemini/settings.json`:
       "command": "npx",
       "args": ["@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       },
       "timeout": 30000,
@@ -381,17 +282,15 @@ For fetching just error-logs, add `| filter loglevel == "ERROR"`.
 
 ## Environment Variables
 
-You can set up authentication via **Platform Tokens** (recommended) or **OAuth Client** via the following environment variables:
-
-- `DT_ENVIRONMENT` (string, e.g., `https://abc12345.apps.dynatrace.com`) - URL to your Dynatrace Platform (do not use Dynatrace classic URLs like `abc12345.live.dynatrace.com`)
-- `DT_PLATFORM_TOKEN` (string, e.g., `dt0s16.SAMPLE.abcd1234`) - **Recommended**: Dynatrace Platform Token
-- `OAUTH_CLIENT_ID` (string, e.g., `dt0s02.SAMPLE`) - Alternative: Dynatrace OAuth Client ID (for advanced use cases)
-- `OAUTH_CLIENT_SECRET` (string, e.g., `dt0s02.SAMPLE.abcd1234`) - Alternative: Dynatrace OAuth Client Secret (for advanced use cases)
-- `DT_GRAIL_QUERY_BUDGET_GB` (number, default: `1000`) - Budget limit in GB (base 1000) for Grail query bytes scanned per session. The MCP server tracks your Grail usage and warns when approaching or exceeding this limit.
+- `DT_ENVIRONMENT` (**required**, string, e.g., `https://abc12345.apps.dynatrace.com`) - URL to your Dynatrace Platform (do not use Dynatrace classic URLs like `abc12345.live.dynatrace.com`)
+- `DT_PLATFORM_TOKEN` (optional, string, e.g., `dt0s16.SAMPLE.abcd1234`) - Dynatrace Platform Token
+- `OAUTH_CLIENT_ID` (optional, string, e.g., `dt0s02.SAMPLE`) - Alternative: Dynatrace OAuth Client ID (for advanced use cases)
+- `OAUTH_CLIENT_SECRET` (optional, string, e.g., `dt0s02.SAMPLE.abcd1234`) - Alternative: Dynatrace OAuth Client Secret (for advanced use cases)
+- `DT_GRAIL_QUERY_BUDGET_GB` (optional, number, default: `1000`) - Budget limit in GB (base 1000) for Grail query bytes scanned per session. The MCP server tracks your Grail usage and warns when approaching or exceeding this limit.
 
-**Platform Tokens are recommended** for most use cases as they provide a simpler authentication flow. OAuth Clients should only be used when specific OAuth features are required.
+When just providing `DT_ENVIRONMENT`, the local MCP server will try to open a browser window to authenticate against the Dynatrace SSO.
 
-For more information, please have a look at the documentation about
+For more information about the other authentication methods, please have a look at the documentation about
 [creating a Platform Token in Dynatrace](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens), as well as
 [creating an OAuth Client in Dynatrace](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/oauth-clients) for advanced scenarios.
 

package/dist/authentication/dynatrace-clients.js

@@ -4,37 +4,13 @@ exports.createDtHttpClient = void 0;
 const http_client_1 = require("@dynatrace-sdk/http-client");
 const dt_app_1 = require("dt-app");
 const user_agent_1 = require("../utils/user-agent");
-/**
- * Uses the provided oauth Client ID and Secret and requests a token via client-credentials flow
- * @param clientId - OAuth Client ID for Dynatrace
- * @param clientSecret - Oauth Client Secret for Dynatrace
- * @param ssoAuthUrl - SSO Authentication URL
- * @param scopes - List of requested scopes
- * @returns Response of the OAuth Endpoint (which, in the best case includes a token)
- */
-const requestToken = async (clientId, clientSecret, ssoAuthUrl, scopes) => {
-    const res = await fetch(ssoAuthUrl, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-        body: new URLSearchParams({
-            grant_type: 'client_credentials',
-            client_id: clientId,
-            client_secret: clientSecret,
-            scope: scopes.join(' '),
-        }),
-    });
-    // check if the response was okay (HTTP 2xx) or not (HTTP 4xx or 5xx)
-    if (!res.ok) {
-        // log the error
-        console.error(`Failed to fetch token: ${res.status} ${res.statusText}`);
-    }
-    // and return the JSON result, as it contains additional information
-    return await res.json();
-};
+const dynatrace_oauth_auth_code_flow_1 = require("./dynatrace-oauth-auth-code-flow");
+const token_cache_1 = require("./token-cache");
+const utils_1 = require("./utils");
+const dynatrace_oauth_client_credentials_1 = require("./dynatrace-oauth-client-credentials");
 /**
  * Create a Dynatrace Http Client (from the http-client SDK) based on the provided authentication credentials
+ * Supports Platform Token, OAuth Client Credentials Flow, and OAuth Authorization Code Flow (interactive)
  * @param environmentUrl
  * @param scopes
  * @param clientId
@@ -43,50 +19,128 @@ const requestToken = async (clientId, clientSecret, ssoAuthUrl, scopes) => {
  * @returns an authenticated HttpClient
  */
 const createDtHttpClient = async (environmentUrl, scopes, clientId, clientSecret, dtPlatformToken) => {
-    if (clientId && clientSecret) {
-        // create an OAuth client if clientId and clientSecret are provided
-        return createOAuthHttpClient(environmentUrl, scopes, clientId, clientSecret);
-    }
+    /** Logic:
+     * * if a platform token is provided, use it
+     * * If no platform token is provided, but clientId and clientSecret are provided, use client credentials flow
+     * * If no platform token is provided, and no clientSecret is provided, but a clientId is provided, use OAuth authorization code flow (interactive)
+     * * If neither platform token nor OAuth credentials are provided, throw an error
+     */
     if (dtPlatformToken) {
         // create a simple HTTP client if only the platform token is provided
-        return createBearerTokenHttpClient(environmentUrl, dtPlatformToken);
+        return createPlatformTokenHttpClient(environmentUrl, dtPlatformToken);
     }
-    throw new Error('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret or dtPlatformToken');
+    else if (clientId && clientSecret) {
+        // create an Oauth client using client credentials flow (non-interactive)
+        return createOAuthClientCredentialsHttpClient(environmentUrl, scopes, clientId, clientSecret);
+    }
+    else if (clientId) {
+        // create an OAuth client using authorization code flow (interactive)
+        return createOAuthAuthCodeFlowHttpClient(environmentUrl, scopes, clientId);
+    }
+    throw new Error('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret for client credentials flow, clientId only for interactive OAuth flow, or just a platform token.');
 };
 exports.createDtHttpClient = createDtHttpClient;
-/** Creates an HTTP Client based on environmentUrl and a platform token */
-const createBearerTokenHttpClient = async (environmentUrl, dtPlatformToken) => {
+/**
+ * Creates an HTTP Client based on environmentUrl and a bearer token, and also sets the user agent
+ */
+const createBearerTokenHttpClient = async (environmentUrl, bearerToken) => {
     return new http_client_1.PlatformHttpClient({
         baseUrl: environmentUrl,
         defaultHeaders: {
-            'Authorization': `Bearer ${dtPlatformToken}`,
+            'Authorization': `Bearer ${bearerToken}`,
             'User-Agent': (0, user_agent_1.getUserAgent)(),
         },
     });
 };
-/** Create an Oauth Client based on clientId, clientSecret, environmentUrl and scopes
+/**
+ * Creates an HTTP Client based on environmentUrl and a platform token (as bearer token)
+ */
+const createPlatformTokenHttpClient = async (environmentUrl, dtPlatformToken) => {
+    console.error(`🔒 Using Platform Token to authenticate API Calls to ${environmentUrl}`);
+    return createBearerTokenHttpClient(environmentUrl, dtPlatformToken);
+};
+/**
+ * Create an OAuth Client based on clientId, clientSecret, environmentUrl and scopes
  * This uses a client-credentials flow to request a token from the SSO endpoint.
+ * Note: We do not refresh the token here, we always request a new one on each client creation.
  */
-const createOAuthHttpClient = async (environmentUrl, scopes, clientId, clientSecret) => {
-    if (!clientId) {
-        throw new Error('Failed to retrieve OAuth client id from env "DT_APP_OAUTH_CLIENT_ID"');
-    }
-    if (!clientSecret) {
-        throw new Error('Failed to retrieve OAuth client secret from env "DT_APP_OAUTH_CLIENT_SECRET"');
-    }
-    if (!environmentUrl) {
-        throw new Error('Failed to retrieve environment URL from env "DT_ENVIRONMENT"');
-    }
-    console.error(`Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
-    const ssoBaseUrl = await (0, dt_app_1.getSSOUrl)(environmentUrl);
-    const ssoAuthUrl = new URL('/sso/oauth2/token', ssoBaseUrl).toString();
-    console.error(`Using SSO auth URL: ${ssoAuthUrl}`);
+const createOAuthClientCredentialsHttpClient = async (environmentUrl, scopes, clientId, clientSecret) => {
+    console.error(`🔒 Client-Creds-Flow: Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
+    // Get SSO Base URL
+    const ssoBaseURL = await (0, dt_app_1.getSSOUrl)(environmentUrl);
     // try to request a token, just to verify that everything is set up correctly
-    const tokenResponse = await requestToken(clientId, clientSecret, ssoAuthUrl, scopes);
+    const tokenResponse = await (0, dynatrace_oauth_client_credentials_1.requestTokenForClientCredentials)(clientId, clientSecret, ssoBaseURL, scopes);
     // in case we didn't get a token, or error / error_description / issueId is set, we throw an error
     if (!tokenResponse.access_token || tokenResponse.error || tokenResponse.error_description || tokenResponse.issueId) {
         throw new Error(`Failed to retrieve OAuth token (IssueId: ${tokenResponse.issueId}): ${tokenResponse.error} - ${tokenResponse.error_description}. Note: Your OAuth client is most likely not configured correctly and/or is missing scopes.`);
     }
-    console.error(`Successfully retrieved token from SSO!`);
+    console.error(`Successfully retrieved token from SSO! Token valid for ${tokenResponse.expires_in}s with scopes: ${tokenResponse.scope}`);
+    // now that we have the access token, we can just use a plain bearer token client
+    return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
+};
+/** Create an OAuth Client using authorization code flow (interactive authentication)
+ * This starts a local HTTP server to handle the OAuth redirect and requires user interaction.
+ * Implements token caching (via .dt-mcp/token.json) to avoid repeated OAuth flows.
+ * Note: Always requests a complete set of scopes for maximum token reusability. Else the user will end up having to approve multiple requests.
+ */
+const createOAuthAuthCodeFlowHttpClient = async (environmentUrl, scopes, clientId) => {
+    // Get SSO Base URL
+    const ssoBaseURL = await (0, dt_app_1.getSSOUrl)(environmentUrl);
+    // Fast Track: Fetch cached token and check if it is still valid
+    const cachedToken = token_cache_1.globalTokenCache.getToken(scopes);
+    const isValid = token_cache_1.globalTokenCache.isTokenValid(scopes);
+    // If we have a valid cached token, we can use it
+    if (isValid && cachedToken) {
+        const expiresIn = cachedToken.expires_at ? Math.round((cachedToken.expires_at - Date.now()) / 1000) : 'never';
+        console.error(`✅ Auth-Code-Flow: Using cached access token (expires in ${expiresIn}s)`);
+        // just use the cached token as a bearer token
+        return createBearerTokenHttpClient(environmentUrl, cachedToken.access_token);
+    }
+    // If we have an expired token that can be refreshed, refresh it
+    if (cachedToken && cachedToken.refresh_token && !isValid) {
+        const expiresIn = cachedToken.expires_at ? Math.round((cachedToken.expires_at - Date.now()) / 1000) : 'never';
+        console.error(`🔍 Auth-Code-Flow: Found expired cached token (expires in ${expiresIn}s), attempting refresh...`);
+        try {
+            console.error(`🔄 Attempting to refresh expired access token...`);
+            const tokenResponse = await (0, dynatrace_oauth_auth_code_flow_1.refreshAccessToken)(ssoBaseURL, clientId, cachedToken.refresh_token, scopes);
+            if (tokenResponse.access_token && !tokenResponse.error) {
+                console.error(`✅ Successfully refreshed access token!`);
+                // Update the cache with the new token
+                token_cache_1.globalTokenCache.setToken(scopes, tokenResponse);
+                // now use the updated token as a bearer token
+                return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
+            }
+            else {
+                console.error(`❌ Token refresh failed: ${tokenResponse.error} - ${tokenResponse.error_description}`);
+                // Clear the invalid token from cache
+                token_cache_1.globalTokenCache.clearToken();
+            }
+        }
+        catch (error) {
+            console.error(`❌ Token refresh failed with error: ${error instanceof Error ? error.message : String(error)}`);
+            // Clear the invalid token from cache
+            token_cache_1.globalTokenCache.clearToken();
+        }
+    }
+    // If we get here, we are currently not authenticated, and need to perform a full OAuth Authorization Code Flow
+    console.error(`🚀 Auth-Code-Flow: No valid cached token found, initiating OAuth Authorization Code Flow...`);
+    console.error(`Using SSO base URL ${ssoBaseURL}`);
+    // Randomly select a port for the OAuth redirect URL (e.g., 5344)
+    const port = (0, utils_1.getRandomPort)();
+    // Perform the OAuth authorization code flow with all scopes
+    const tokenResponse = await (0, dynatrace_oauth_auth_code_flow_1.performOAuthAuthorizationCodeFlow)(ssoBaseURL, {
+        clientId,
+        // redirectUri will be used as a redirect/callback from the authorization code flow
+        redirectUri: `http://localhost:${port}/auth/login`,
+        scopes: scopes, // Request all scopes upfront
+    }, port);
+    // Check if we got a valid token
+    if (!tokenResponse.access_token || tokenResponse.error || tokenResponse.error_description || tokenResponse.issueId) {
+        throw new Error(`Failed to retrieve OAuth token via authorization code flow (IssueId: ${tokenResponse.issueId}): ${tokenResponse.error} - ${tokenResponse.error_description}`);
+    }
+    // Cache the new token with all scopes
+    token_cache_1.globalTokenCache.setToken(scopes, tokenResponse);
+    console.error(`✅ Successfully retrieved token from SSO! Token cached for future use with scopes: ${scopes.join(', ')}`);
+    // now that we have the access token, we can just use a plain bearer token client
     return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
 };

package/dist/authentication/dynatrace-clients.test.js

@@ -3,9 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const dynatrace_clients_1 = require("./dynatrace-clients");
 const http_client_1 = require("@dynatrace-sdk/http-client");
 const dt_app_1 = require("dt-app");
+const dynatrace_oauth_auth_code_flow_1 = require("./dynatrace-oauth-auth-code-flow");
+const token_cache_1 = require("./token-cache");
 // Mock external dependencies
 jest.mock('@dynatrace-sdk/http-client');
 jest.mock('dt-app');
+jest.mock('./dynatrace-oauth-auth-code-flow');
+jest.mock('./token-cache');
 jest.mock('../../package.json', () => ({
     version: '1.0.0-test',
 }));
@@ -13,12 +17,21 @@ jest.mock('../../package.json', () => ({
 global.fetch = jest.fn();
 const mockPlatformHttpClient = http_client_1.PlatformHttpClient;
 const mockGetSSOUrl = dt_app_1.getSSOUrl;
+const mockPerformOAuthAuthorizationCodeFlow = dynatrace_oauth_auth_code_flow_1.performOAuthAuthorizationCodeFlow;
+const mockGlobalTokenCache = token_cache_1.globalTokenCache;
 const mockFetch = global.fetch;
 describe('dynatrace-clients', () => {
     beforeEach(() => {
         jest.clearAllMocks();
         // Reset console.error mock
         jest.spyOn(console, 'error').mockImplementation(() => { });
+        // Mock token cache methods
+        mockGlobalTokenCache.getToken.mockReturnValue(null);
+        mockGlobalTokenCache.isTokenValid.mockReturnValue(false);
+        mockGlobalTokenCache.setToken.mockImplementation(() => { });
+        mockGlobalTokenCache.clearToken.mockImplementation(() => { });
+        // Mock getSSOUrl
+        mockGetSSOUrl.mockResolvedValue('https://sso.dynatrace.com');
     });
     afterEach(() => {
         jest.restoreAllMocks();
@@ -67,12 +80,6 @@ describe('dynatrace-clients', () => {
                 });
                 expect(result).toBeInstanceOf(http_client_1.PlatformHttpClient);
             });
-            it('should throw error when clientId, clientSecret and platformToken are missing', async () => {
-                await expect((0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes, undefined, undefined, undefined)).rejects.toThrow('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret or dtPlatformToken');
-            });
-            it('should throw error when environmentUrl is missing', async () => {
-                await expect((0, dynatrace_clients_1.createDtHttpClient)('', scopes, clientId, clientSecret)).rejects.toThrow('Failed to retrieve environment URL from env "DT_ENVIRONMENT"');
-            });
             it('should throw error when token request fails with HTTP error', async () => {
                 mockFetch.mockResolvedValueOnce({
                     ok: false,
@@ -120,7 +127,7 @@ describe('dynatrace-clients', () => {
                     json: async () => mockTokenResponse,
                 });
                 await (0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes, clientId, clientSecret);
-                expect(console.error).toHaveBeenCalledWith(`Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
+                expect(console.error).toHaveBeenCalledWith(`🔒 Client-Creds-Flow: Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
             });
         });
         describe('with Bearer token', () => {
@@ -137,11 +144,6 @@ describe('dynatrace-clients', () => {
                 expect(result).toBeInstanceOf(http_client_1.PlatformHttpClient);
             });
         });
-        describe('with no authentication', () => {
-            it('should throw error when no authentication method is provided', async () => {
-                await expect((0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes)).rejects.toThrow('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret or dtPlatformToken');
-            });
-        });
     });
     describe('requestToken function (indirectly tested)', () => {
         it('should handle fetch errors gracefully', async () => {

package/dist/authentication/dynatrace-oauth-auth-code-flow.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthorizationUrl = createAuthorizationUrl;
+exports.exchangeCodeForToken = exchangeCodeForToken;
+exports.refreshAccessToken = refreshAccessToken;
+exports.startOAuthRedirectServer = startOAuthRedirectServer;
+exports.performOAuthAuthorizationCodeFlow = performOAuthAuthorizationCodeFlow;
+const node_crypto_1 = require("node:crypto");
+const node_http_1 = require("node:http");
+const node_url_1 = require("node:url");
+const dynatrace_oauth_base_1 = require("./dynatrace-oauth-base");
+const utils_1 = require("./utils");
+const open_1 = __importDefault(require("open"));
+/**
+ * Generates PKCE code verifier and challenge according to RFC 7636
+ * Uses 46 bytes for code verifier as recommended by Auth0/OAuth best practices
+ */
+function generatePKCEChallenge() {
+    const codeVerifier = (0, utils_1.base64URLEncode)((0, node_crypto_1.randomBytes)(46));
+    const codeChallenge = (0, utils_1.base64URLEncode)((0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest());
+    return { codeVerifier, codeChallenge };
+}
+/**
+ * Constructs the OAuth authorization URL with PKCE
+ */
+function createAuthorizationUrl(ssoBaseURL, config) {
+    const state = (0, utils_1.generateRandomState)();
+    const { codeVerifier, codeChallenge } = generatePKCEChallenge();
+    const authUrl = new node_url_1.URL('/oauth2/authorize', ssoBaseURL);
+    // Build query parameters manually to control encoding and exact order
+    // Order parameters to match working OAuth implementation:
+    // client_id → redirect_uri → state → response_type → code_challenge_method → code_challenge → scope
+    const queryParts = [
+        `client_id=${encodeURIComponent(config.clientId)}`,
+        `redirect_uri=${encodeURIComponent(config.redirectUri)}`,
+        `state=${encodeURIComponent(state)}`,
+        `response_type=code`,
+        `code_challenge_method=S256`,
+        `code_challenge=${encodeURIComponent(codeChallenge)}`,
+        `scope=${encodeURIComponent(config.scopes.join(' ')).replace(/%20/g, '%20')}`, // Ensure %20 for spaces
+    ];
+    const queryString = queryParts.join('&');
+    // Manually construct the final URL to ensure exact parameter order and encoding required by some OAuth implementations.
+    const finalUrl = `${authUrl.origin}${authUrl.pathname}?${queryString}`;
+    return {
+        authorizationUrl: finalUrl,
+        codeVerifier,
+        state,
+    };
+}
+/**
+ * Exchanges authorization code for access token using PKCE
+ */
+async function exchangeCodeForToken(ssoBaseURL, config, code, codeVerifier) {
+    return (0, dynatrace_oauth_base_1.requestOAuthToken)(ssoBaseURL, {
+        grant_type: 'authorization_code',
+        client_id: config.clientId,
+        code,
+        redirect_uri: config.redirectUri,
+        code_verifier: codeVerifier,
+    });
+}
+/**
+ * Refreshes an access token using a refresh token
+ */
+async function refreshAccessToken(ssoBaseURL, clientId, refreshToken, scopes) {
+    const tokenResponse = await (0, dynatrace_oauth_base_1.requestOAuthToken)(ssoBaseURL, {
+        grant_type: 'refresh_token',
+        client_id: clientId,
+        refresh_token: refreshToken,
+        scope: scopes.join(' '),
+    });
+    // For refresh token, we want to throw an error if the request failed
+    // since this is different from other flows where we just return the error response
+    if (!tokenResponse.access_token || tokenResponse.error) {
+        throw new Error(`Failed to refresh access token: ${tokenResponse.error} - ${tokenResponse.error_description}`);
+    }
+    return tokenResponse;
+}
+/**
+ * Starts a temporary HTTP server to handle the OAuth redirect
+ */
+async function startOAuthRedirectServer(port = 5344) {
+    const redirectUri = `http://localhost:${port}/auth/login`;
+    let resolveAuthCode;
+    let rejectAuthCode;
+    const authCodePromise = new Promise((resolve, reject) => {
+        resolveAuthCode = resolve;
+        rejectAuthCode = reject;
+    });
+    const server = (0, node_http_1.createServer)((req, res) => {
+        const url = new node_url_1.URL(req.url || '', `http://localhost:${port}`);
+        if (url.pathname === '/auth/login') {
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>OAuth Error</title></head>
+            <body>
+              <h1>OAuth Authorization Error</h1>
+              <p><strong>Error:</strong> ${error}</p>
+              <p><strong>Description:</strong> ${errorDescription || 'Unknown error'}</p>
+              <p>You can close this tab and check the console for more information.</p>
+            </body>
+          </html>
+        `);
+                rejectAuthCode(new Error(`OAuth error: ${error} - ${errorDescription}`));
+                return;
+            }
+            if (code && state) {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>OAuth Success</title></head>
+            <body>
+              <h1>Authorization Successful!</h1>
+              <p>You have successfully authorized the Dynatrace MCP Server.</p>
+              <p>You can close this tab and return to your terminal.</p>
+              <script>
+                // Auto-close after 3 seconds
+                setTimeout(() => window.close(), 3000);
+              </script>
+            </body>
+          </html>
+        `);
+                resolveAuthCode({ code, state });
+            }
+            else {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>Invalid Request</title></head>
+            <body>
+              <h1>Invalid OAuth Callback</h1>
+              <p>The authorization code or state parameter is missing.</p>
+              <p>You can close this tab and try again.</p>
+            </body>
+          </html>
+        `);
+                rejectAuthCode(new Error('Missing authorization code or state parameter'));
+            }
+        }
+        else {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('Not Found');
+        }
+    });
+    return new Promise((resolve, reject) => {
+        server.listen(port, 'localhost', () => {
+            console.error(`🌐 OAuth redirect server listening on ${redirectUri}`);
+            resolve({
+                server,
+                redirectUri,
+                waitForAuthorizationCode: () => authCodePromise,
+            });
+        });
+        server.on('error', reject);
+    });
+}
+/**
+ * Performs the complete OAuth authorization code flow
+ */
+async function performOAuthAuthorizationCodeFlow(ssoBaseURL, config, serverPort = 5344) {
+    console.error('🚀 Starting OAuth Authorization Code Flow with local redirect/callback...');
+    // Start the redirect server
+    const { server, redirectUri, waitForAuthorizationCode } = await startOAuthRedirectServer(serverPort);
+    try {
+        // Update config with the actual redirect URI
+        const updatedConfig = { ...config, redirectUri };
+        // Create authorization URL
+        const { authorizationUrl, codeVerifier, state } = createAuthorizationUrl(ssoBaseURL, updatedConfig);
+        // Print a pretty message telling the user to open the URL
+        console.error('\n' + '='.repeat(60));
+        console.error('🔐 OAuth Authorization Required');
+        console.error('='.repeat(60));
+        console.error('');
+        // Open the authorization URL in the default browser
+        console.error('Trying to open the authorization URL in your default browser...');
+        try {
+            (0, open_1.default)(authorizationUrl);
+        }
+        catch (error) {
+            console.error('Failed to open browser automatically. Please click on the following URL to authorize the application:', error.message);
+        }
+        console.error('');
+        console.error('👉 ' + authorizationUrl);
+        console.error('');
+        console.error('After authorization, you will be redirected back and the server will continue automatically.');
+        console.error('');
+        console.error('='.repeat(60) + '\n');
+        // Wait for the authorization code
+        const { code, state: receivedState } = await waitForAuthorizationCode();
+        // Validate state parameter
+        if (receivedState !== state) {
+            throw new Error('OAuth state parameter mismatch - possible CSRF attack');
+        }
+        console.error('✅ Authorization code received! Exchanging for access token...');
+        // Exchange code for token
+        const tokenResponse = await exchangeCodeForToken(ssoBaseURL, updatedConfig, code, codeVerifier);
+        if (!tokenResponse.access_token || tokenResponse.error) {
+            throw new Error(`Failed to exchange code for token: ${tokenResponse.error} - ${tokenResponse.error_description}`);
+        }
+        console.error('🎉 Successfully obtained access token via OAuth Authorization Code Flow!');
+        return tokenResponse;
+    }
+    finally {
+        // Clean up the server
+        server.close();
+    }
+}

package/dist/authentication/dynatrace-oauth-auth-code-flow.test.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
+const dynatrace_oauth_auth_code_flow_1 = require("./dynatrace-oauth-auth-code-flow");
+describe('OAuth Authorization Code Flow', () => {
+    const mockConfig = {
+        clientId: 'dt0s08.mocked-client',
+        redirectUri: 'http://localhost:5343/auth/login',
+        scopes: ['app-engine:apps:run', 'app-engine:functions:run', 'storage:logs:read'], // Basic Example scopes
+    };
+    test('createAuthorizationUrl generates valid URL with PKCE', () => {
+        const result = (0, dynatrace_oauth_auth_code_flow_1.createAuthorizationUrl)('https://sso.dynatrace.com', mockConfig);
+        // URL needs to match sso.dynatrace.com/oauth2/authorize
+        expect(result.authorizationUrl).toMatch(/^https:\/\/sso\.dynatrace\.com\/oauth2\/authorize\?/);
+        expect(result.codeVerifier).toMatch(/^[A-Za-z0-9_-]{62}$/); // Base64URL without padding (46 bytes = ~62 chars)
+        expect(result.state).toMatch(/^[a-f0-9]{40}$/); // Hex string (20 bytes = 40 hex chars)
+        // Parse the URL and verify query parameters
+        const url = new URL(result.authorizationUrl);
+        expect(url.searchParams.get('response_type')).toBe('code');
+        expect(url.searchParams.get('client_id')).toBe('dt0s08.mocked-client');
+        expect(url.searchParams.get('redirect_uri')).toBe('http://localhost:5343/auth/login');
+        expect(url.searchParams.get('scope')).toBe('app-engine:apps:run app-engine:functions:run storage:logs:read');
+        expect(url.searchParams.get('code_challenge_method')).toBe('S256');
+        expect(url.searchParams.get('code_challenge')).toMatch(/^[A-Za-z0-9_-]{43}$/); // SHA256 base64url = 43 chars
+        expect(url.searchParams.get('state')).toBe(result.state);
+    });
+    test('createAuthorizationUrl encodes scopes with %20 for spaces instead of +', () => {
+        const result = (0, dynatrace_oauth_auth_code_flow_1.createAuthorizationUrl)('https://sso.dynatrace.com', mockConfig);
+        // Check that the raw URL string contains %20 for spaces, not +
+        expect(result.authorizationUrl).toMatch(/scope=app-engine%3Aapps%3Arun%20app-engine%3Afunctions%3Arun%20storage%3Alogs%3Aread/);
+        // Verify that + is not used for space encoding in scopes
+        expect(result.authorizationUrl).not.toMatch(/scope=.*\+.*(?=&|$)/);
+        // Verify that colons are properly encoded as %3A
+        expect(result.authorizationUrl).toMatch(/app-engine%3Aapps%3Arun/);
+        expect(result.authorizationUrl).toMatch(/app-engine%3Afunctions%3Arun/);
+        expect(result.authorizationUrl).toMatch(/storage%3Alogs%3Aread/);
+        // Double-check by parsing the URL and verifying the decoded scope
+        const url = new URL(result.authorizationUrl);
+        expect(url.searchParams.get('scope')).toBe('app-engine:apps:run app-engine:functions:run storage:logs:read');
+    });
+    test('startOAuthRedirectServer returns server configuration', async () => {
+        const port = ((0, crypto_1.randomBytes)(2).readUInt16BE(0) % 10000) + 5000; // Random port between 5000-5999
+        const result = await (0, dynatrace_oauth_auth_code_flow_1.startOAuthRedirectServer)(port);
+        expect(result.redirectUri).toBe(`http://localhost:${port}/auth/login`);
+        expect(result.server).toBeDefined();
+        expect(result.waitForAuthorizationCode).toBeDefined();
+        // Clean up
+        result.server.close();
+    });
+});

package/dist/authentication/dynatrace-oauth-base.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestOAuthToken = void 0;
+/**
+ * Generic OAuth token request function that can handle different grant types
+ * @param ssoBaseURL - SSO Base URL (e.g., sso.dynatrace.com)
+ * @param params - OAuth parameters for the specific grant type (client_credentials, authorization_code, or refresh_token)
+ * @returns Response of the OAuth Endpoint
+ */
+const requestOAuthToken = async (ssoBaseURL, params) => {
+    const tokenUrl = new URL('/sso/oauth2/token', ssoBaseURL).toString();
+    const res = await fetch(tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams(params),
+    });
+    // check if the response was okay (HTTP 2xx) or not (HTTP 4xx or 5xx)
+    if (!res.ok) {
+        // log the error
+        console.error(`Failed to fetch token: ${res.status} ${res.statusText}`);
+        // Note: Do not throw here, as we want to return the error response from the OAuth endpoint
+    }
+    // and return the JSON result, as it contains additional information
+    return await res.json();
+};
+exports.requestOAuthToken = requestOAuthToken;

package/dist/authentication/dynatrace-oauth-client-credentials.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestTokenForClientCredentials = void 0;
+const dynatrace_oauth_base_1 = require("./dynatrace-oauth-base");
+/**
+ * Uses the provided oauth Client ID and Secret and requests a token via client-credentials flow
+ * @param clientId - OAuth Client ID for Dynatrace
+ * @param clientSecret - OAuth Client Secret for Dynatrace
+ * @param ssoBaseURL - SSO Base URL (e.g., sso.dynatrace.com)
+ * @param scopes - List of requested scopes
+ * @returns Response of the OAuth Endpoint (which, in the best case includes a token)
+ */
+const requestTokenForClientCredentials = async (clientId, clientSecret, ssoBaseURL, scopes) => {
+    return (0, dynatrace_oauth_base_1.requestOAuthToken)(ssoBaseURL, {
+        grant_type: 'client_credentials',
+        client_id: clientId,
+        client_secret: clientSecret,
+        scope: scopes.join(' '),
+    });
+};
+exports.requestTokenForClientCredentials = requestTokenForClientCredentials;

package/dist/authentication/token-cache.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalTokenCache = exports.FileTokenCache = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * File-based token cache implementation that persists tokens to disk
+ * Stores tokens in .dt-mcp/token.json for persistence across dynatrace-mcp-server restarts
+ */
+class FileTokenCache {
+    tokenFilePath;
+    token = null;
+    constructor() {
+        // Create .dt-mcp directory in the current working directory
+        const tokenDir = path.join(process.cwd(), '.dt-mcp');
+        this.tokenFilePath = path.join(tokenDir, 'token.json');
+        // Ensure the directory exists
+        if (!fs.existsSync(tokenDir)) {
+            fs.mkdirSync(tokenDir, { recursive: true });
+        }
+        this.loadToken();
+    }
+    /**
+     * Loads the token from the file system
+     */
+    loadToken() {
+        try {
+            if (fs.existsSync(this.tokenFilePath)) {
+                const tokenData = fs.readFileSync(this.tokenFilePath, 'utf8');
+                this.token = JSON.parse(tokenData);
+                console.error(`🔍 Loaded token from file: ${this.tokenFilePath}`);
+            }
+            else {
+                console.error(`🔍 No token file found at: ${this.tokenFilePath}`);
+                this.token = null;
+            }
+        }
+        catch (error) {
+            console.error(`❌ Failed to load token from file: ${error}`);
+            this.token = null;
+        }
+    }
+    /**
+     * Saves the token to the file system
+     */
+    saveToken() {
+        try {
+            if (this.token) {
+                fs.writeFileSync(this.tokenFilePath, JSON.stringify(this.token, null, 2), 'utf8');
+                console.error(`✅ Saved token to file: ${this.tokenFilePath}`);
+            }
+            else {
+                // Remove the file if no token exists
+                if (fs.existsSync(this.tokenFilePath)) {
+                    fs.unlinkSync(this.tokenFilePath);
+                    console.error(`🗑️ Removed token file: ${this.tokenFilePath}`);
+                }
+            }
+        }
+        catch (error) {
+            console.error(`❌ Failed to save token to file: ${error}`);
+        }
+    }
+    /**
+     * Retrieves the cached token (ignores scopes since we use a global token)
+     */
+    getToken(scopes) {
+        // We ignore the scopes parameter since we use a single token with all scopes
+        return this.token;
+    }
+    /**
+     * Stores the global token in the cache and persists it to file
+     */
+    setToken(scopes, token) {
+        // We ignore the scopes parameter since we use a single token with all scopes
+        this.token = {
+            access_token: token.access_token,
+            refresh_token: token.refresh_token,
+            expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
+            scopes: [...scopes], // Store the actual scopes that were granted
+        };
+        this.saveToken();
+    }
+    /**
+     * Removes the cached token and deletes the file
+     */
+    clearToken(scopes) {
+        // We ignore the scopes parameter since we use a single global token
+        this.token = null;
+        this.saveToken();
+    }
+    /**
+     * Checks if the token exists and is still valid (not expired)
+     */
+    isTokenValid(scopes) {
+        // We ignore the scopes parameter since we use a single token with all scopes
+        if (!this.token) {
+            console.error(`🔍 Token validation: No token in cache`);
+            return false;
+        }
+        // If no expiration time is set, assume token is valid
+        if (!this.token.expires_at) {
+            console.error(`🔍 Token validation: Token has no expiration, assuming valid`);
+            return true;
+        }
+        // Add a 30-second buffer to avoid using tokens that are about to expire
+        const bufferMs = 30 * 1000; // 30 seconds
+        const now = Date.now();
+        const expiresAt = this.token.expires_at;
+        const isValid = now + bufferMs < expiresAt;
+        return isValid;
+    }
+}
+exports.FileTokenCache = FileTokenCache;
+// Global token cache instance - uses file-based persistence
+exports.globalTokenCache = new FileTokenCache();

package/dist/authentication/utils.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRandomPort = exports.generateRandomState = exports.base64URLEncode = void 0;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Base64URL encoding according to RFC 7636
+ */
+const base64URLEncode = (buffer) => {
+    return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+exports.base64URLEncode = base64URLEncode;
+/**
+ * Generates a cryptographically secure random string for OAuth state parameter
+ * Uses hex encoding for better compatibility
+ */
+const generateRandomState = () => {
+    return (0, node_crypto_1.randomBytes)(20).toString('hex');
+};
+exports.generateRandomState = generateRandomState;
+/**
+ * Generates a random port number between min and max (inclusive)
+ */
+const getRandomPort = (min = 5344, max = 5349) => {
+    return Math.floor(Math.random() * (max - min + 1)) + min;
+};
+exports.getRandomPort = getRandomPort;

package/dist/getDynatraceEnv.js

@@ -15,9 +15,8 @@ function getDynatraceEnv(env = process.env) {
     if (!dtEnvironment) {
         throw new Error('Please set DT_ENVIRONMENT environment variable to your Dynatrace Platform Environment');
     }
-    if (!oauthClientId && !oauthClientSecret && !dtPlatformToken) {
-        throw new Error('Please set either OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET, or DT_PLATFORM_TOKEN environment variables');
-    }
+    // Allow case where no auth credentials are provided - OAuth auth code flow will be inferred
+    // We only require DT_ENVIRONMENT to be set
     // For dev and hardening stages, set unlimited budget (-1) unless explicitly overridden
     if (dtEnvironment.includes('apps.dynatracelabs.com') && !env.DT_GRAIL_QUERY_BUDGET_GB) {
         grailBudgetGB = -1;

package/dist/getDynatraceEnv.test.js

@@ -26,14 +26,18 @@ describe('getDynatraceEnv', () => {
         const result = (0, getDynatraceEnv_1.getDynatraceEnv)(env);
         expect(result.slackConnectionId).toBe('fake-slack-connection-id');
     });
-    it('throws if environment variables for auth credentials are missing', () => {
+    it('allows missing auth credentials (OAuth auth code flow will be inferred)', () => {
         const env = {
             ...baseEnv,
             OAUTH_CLIENT_ID: undefined,
             OAUTH_CLIENT_SECRET: undefined,
             DT_PLATFORM_TOKEN: undefined,
         };
-        expect(() => (0, getDynatraceEnv_1.getDynatraceEnv)(env)).toThrow(/OAUTH_CLIENT_ID/);
+        expect(() => (0, getDynatraceEnv_1.getDynatraceEnv)(env)).not.toThrow();
+        const result = (0, getDynatraceEnv_1.getDynatraceEnv)(env);
+        expect(result.oauthClientId).toBeUndefined();
+        expect(result.oauthClientSecret).toBeUndefined();
+        expect(result.dtPlatformToken).toBeUndefined();
     });
     it('throws if DT_ENVIRONMENT is missing', () => {
         const env = { ...baseEnv, DT_ENVIRONMENT: undefined };

package/dist/index.js

@@ -41,16 +41,45 @@ else {
     // Successfully loaded .env file
     console.error(`.env file loaded successfully - loaded ${dotEnvOutput.parsed ? Object.keys(dotEnvOutput.parsed).length : 0} environment variables: ${Object.keys(dotEnvOutput.parsed || {}).join(', ')}`);
 }
+const DT_MCP_AUTH_CODE_FLOW_OAUTH_CLIENT_ID = 'dt0s08.dt-app-local'; // ToDo: Register our own oauth client
 let scopesBase = [
     'app-engine:apps:run', // needed for environmentInformationClient
     'app-engine:functions:run', // needed for environmentInformationClient
 ];
+// All scopes needed by the MCP server tools
+// Requesting all scopes upfront allows us to reuse a single token for all operations
+const allRequiredScopes = scopesBase.concat([
+    // Storage (Grail) scopes
+    'storage:events:read', // Read events from Grail
+    'storage:buckets:read', // Read all system data stored on Grail
+    'storage:security.events:read', // Read Security events from Grail
+    'storage:entities:read', // Read Entities from Grail
+    'storage:logs:read', // Read logs for reliability guardian validations
+    'storage:metrics:read', // Read metrics for reliability guardian validations
+    'storage:bizevents:read', // Read bizevents for reliability guardian validations
+    'storage:spans:read', // Read spans from Grail
+    'storage:system:read', // Read System Data from Grail
+    // Settings and configuration scopes
+    'app-settings:objects:read', // Read app settings objects
+    'settings:objects:read', // Read settings objects
+    'environment-api:entities:read', // Read entities via environment API
+    // Davis CoPilot scopes
+    'davis-copilot:nl2dql:execute', // Convert natural language to DQL
+    'davis-copilot:dql2nl:execute', // Convert DQL to natural language
+    'davis-copilot:conversations:execute', // Chat with Davis CoPilot
+    // Automation/Workflows scopes
+    'automation:workflows:write', // Create and modify workflows
+    'automation:workflows:read', // Read workflows
+    'automation:workflows:run', // Execute workflows
+    // Communication scopes
+    'email:emails:send', // Send emails
+]);
 /**
  * Performs a connection test to the Dynatrace environment.
  * Throws an error if the connection or authentication fails.
  */
 async function testDynatraceConnection(dtEnvironment, oauthClientId, oauthClientSecret, dtPlatformToken) {
-    const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase, oauthClientId, oauthClientSecret, dtPlatformToken);
+    const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, oauthClientId && !oauthClientSecret ? allRequiredScopes : scopesBase, oauthClientId, oauthClientSecret, dtPlatformToken);
     const environmentInformationClient = new client_platform_management_service_1.EnvironmentInformationClient(dtClient);
     // This call will fail if authentication is incorrect.
     await environmentInformationClient.getEnvironmentInformation();
@@ -78,7 +107,7 @@ async function retryTestDynatraceConnection(dtEnvironment, oauthClientId, oauthC
             break;
         }
         catch (error) {
-            console.error(`Error: Could not connect to the Dynatrace environment.`);
+            console.error(`Error: Could not connect to the Dynatrace environment at ${dtEnvironment}.`);
             if ((0, shared_errors_1.isClientRequestError)(error)) {
                 console.error(handleClientRequestError(error));
             }
@@ -108,9 +137,19 @@ const main = async () => {
         process.exit(1);
     }
     // Unpack environment variables
-    const { oauthClientId, oauthClientSecret, dtEnvironment, dtPlatformToken, slackConnectionId, grailBudgetGB } = dynatraceEnv;
+    let { oauthClientId, oauthClientSecret, dtEnvironment, dtPlatformToken, slackConnectionId, grailBudgetGB } = dynatraceEnv;
+    // Infer OAuth auth code flow if no OAuth Client credentials are provided
+    // -> configure default OAuth client ID for auth code flow
+    if (!oauthClientId && !oauthClientSecret && !dtPlatformToken) {
+        console.error('No OAuth credentials or platform token provided - switching to OAuth authorization code flow.');
+        oauthClientId = DT_MCP_AUTH_CODE_FLOW_OAUTH_CLIENT_ID; // Default OAuth client ID for auth code flow
+    }
     // Test connection on startup
     try {
+        // Depending on the authentication type, there are multiple pitfalls
+        // * For Platform Tokens, we can just try to access "get environment info" and we will know whether it works
+        // * For Oauth Client Credentials flow, we can also try to request an access token upfront with limited scopes, and verify whether everything works
+        // * for Oauth Auth Code flow, we can only verify whether the client ID is valid and the OAuth verifier call works, but we can't verify whether the user will be able to authenticate successfully
         await retryTestDynatraceConnection(dtEnvironment, oauthClientId, oauthClientSecret, dtPlatformToken);
     }
     catch (err) {
@@ -142,6 +181,14 @@ const main = async () => {
             elicitation: {},
         },
     });
+    // Helper function to create HTTP client with current auth settings
+    // This is used to provide global scopes for auth code flow
+    const createAuthenticatedHttpClient = async (scopes) => {
+        // If we use authorization code flow (e.g., oauthClientId is set, but oauthClientSecret is empty), we pass all scopes in.
+        // For all other cases, we use allRequiredScopes
+        return await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, oauthClientId && !oauthClientSecret ? allRequiredScopes : scopes, // Always use all scopes for maximum reusability
+        oauthClientId, oauthClientSecret, dtPlatformToken);
+    };
     // quick abstraction/wrapper to make it easier for tools to reply text instead of JSON
     const tool = (name, description, paramsSchema, annotations, cb) => {
         const wrappedCb = async (args) => {
@@ -221,7 +268,7 @@ const main = async () => {
         readOnlyHint: true,
     }, async ({}) => {
         // create an oauth-client
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase, oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase);
         const environmentInformationClient = new client_platform_management_service_1.EnvironmentInformationClient(dtClient);
         const environmentInfo = await environmentInformationClient.getEnvironmentInformation();
         let resp = `Environment Information (also referred to as tenant):
@@ -247,7 +294,7 @@ const main = async () => {
     }, {
         readOnlyHint: true,
     }, async ({ riskScore, additionalFilter, maxVulnerabilitiesToDisplay }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('storage:events:read', 'storage:buckets:read', 'storage:security.events:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('storage:events:read', 'storage:buckets:read', 'storage:security.events:read'));
         const result = await (0, list_vulnerabilities_1.listVulnerabilities)(dtClient, additionalFilter, riskScore);
         if (!result || result.length === 0) {
             return 'No vulnerabilities found in the last 30 days';
@@ -290,7 +337,7 @@ const main = async () => {
     }, {
         readOnlyHint: true,
     }, async ({ additionalFilter, maxProblemsToDisplay }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('storage:events:read', 'storage:buckets:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('storage:events:read', 'storage:buckets:read'));
         // get problems (uses fetch)
         const result = await (0, list_problems_1.listProblems)(dtClient, additionalFilter);
         if (result && result.records && result.records.length > 0) {
@@ -334,7 +381,7 @@ const main = async () => {
     }, {
         readOnlyHint: true,
     }, async ({ entityNames, maxEntitiesToDisplay, extendedSearch }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('storage:entities:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('storage:entities:read'));
         const result = await (0, find_monitored_entity_by_name_1.findMonitoredEntitiesByName)(dtClient, entityNames, extendedSearch);
         if (result && result.records && result.records.length > 0) {
             let resp = `Found ${result.records.length} monitored entities! Displaying the first ${maxEntitiesToDisplay} entities:\n`;
@@ -371,7 +418,7 @@ const main = async () => {
         if (!approved) {
             return 'Operation cancelled: Human approval was not granted for sending this Slack message.';
         }
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('app-settings:objects:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('app-settings:objects:read'));
         const response = await (0, send_slack_message_1.sendSlackMessage)(dtClient, slackConnectionId, channel, message);
         return `Message sent to Slack channel: ${JSON.stringify(response)}`;
     });
@@ -381,7 +428,7 @@ const main = async () => {
         readOnlyHint: true,
         idempotentHint: true, // same input always yields same output
     }, async ({ dqlStatement }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase, oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase);
         const response = await (0, execute_dql_1.verifyDqlStatement)(dtClient, dqlStatement);
         let resp = 'DQL Statement Verification:\n';
         if (response.notifications && response.notifications.length > 0) {
@@ -413,7 +460,7 @@ const main = async () => {
         openWorldHint: true,
     }, async ({ dqlStatement }) => {
         // Create a HTTP Client that has all storage:*:read scopes
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('storage:buckets:read', // Read all system data stored on Grail
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('storage:buckets:read', // Read all system data stored on Grail
         'storage:logs:read', // Read logs for reliability guardian validations
         'storage:metrics:read', // Read metrics for reliability guardian validations
         'storage:bizevents:read', // Read bizevents for reliability guardian validations
@@ -423,7 +470,7 @@ const main = async () => {
         'storage:system:read', // Read System Data from Grail
         'storage:user.events:read', // Read User events from Grail
         'storage:user.sessions:read', // Read User sessions from Grail
-        'storage:security.events:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        'storage:security.events:read'));
         const response = await (0, execute_dql_1.executeDql)(dtClient, { query: dqlStatement }, grailBudgetGB);
         if (!response) {
             return 'DQL execution failed or returned no result.';
@@ -474,7 +521,7 @@ const main = async () => {
         readOnlyHint: true,
         idempotentHint: true,
     }, async ({ text }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('davis-copilot:nl2dql:execute'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('davis-copilot:nl2dql:execute'));
         // Check if the nl2dql skill is available
         const isAvailable = await (0, davis_copilot_1.isDavisCopilotSkillAvailable)(dtClient, 'nl2dql');
         if (!isAvailable) {
@@ -508,7 +555,7 @@ const main = async () => {
         readOnlyHint: true,
         idempotentHint: true,
     }, async ({ dql }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('davis-copilot:dql2nl:execute'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('davis-copilot:dql2nl:execute'));
         // Check if the dql2nl skill is available
         const isAvailable = await (0, davis_copilot_1.isDavisCopilotSkillAvailable)(dtClient, 'dql2nl');
         if (!isAvailable) {
@@ -538,7 +585,7 @@ const main = async () => {
         idempotentHint: true,
         openWorldHint: true, // web-search like characteristics
     }, async ({ text, context, instruction }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('davis-copilot:conversations:execute'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('davis-copilot:conversations:execute'));
         // Check if the conversation skill is available
         const isAvailable = await (0, davis_copilot_1.isDavisCopilotSkillAvailable)(dtClient, 'conversation');
         if (!isAvailable) {
@@ -601,7 +648,7 @@ const main = async () => {
         if (!approved) {
             return 'Operation cancelled: Human approval was not granted for creating this workflow.';
         }
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('automation:workflows:write', 'automation:workflows:read', 'automation:workflows:run'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('automation:workflows:write', 'automation:workflows:read', 'automation:workflows:run'));
         const response = await (0, create_workflow_for_problem_notification_1.createWorkflowForProblemNotification)(dtClient, teamName, channel, problemType, isPrivate);
         let resp = `Workflow Created: ${response?.id} with name ${response?.title}.\nYou can access the Workflow via the following link: ${dtEnvironment}/ui/apps/dynatrace.automations/workflows/${response?.id}.\nTell the user to inspect the Workflow by visiting the link.\n`;
         if (response.type == 'SIMPLE') {
@@ -627,7 +674,7 @@ const main = async () => {
         if (!approved) {
             return 'Operation cancelled: Human approval was not granted for making this workflow public.';
         }
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('automation:workflows:write', 'automation:workflows:read', 'automation:workflows:run'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('automation:workflows:write', 'automation:workflows:read', 'automation:workflows:run'));
         const response = await (0, update_workflow_1.updateWorkflow)(dtClient, workflowId, {
             isPrivate: false,
         });
@@ -664,7 +711,7 @@ const main = async () => {
     }, {
         readOnlyHint: true,
     }, async ({ clusterId, kubernetesEntityId, eventType, maxEventsToDisplay }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('storage:events:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('storage:events:read'));
         const result = await (0, get_events_for_cluster_1.getEventsForCluster)(dtClient, clusterId, kubernetesEntityId, eventType);
         if (result && result.records && result.records.length > 0) {
             let resp = `Found ${result.records.length} events! Displaying the top ${maxEventsToDisplay} events:\n`;
@@ -687,7 +734,7 @@ const main = async () => {
     }, {
         readOnlyHint: true,
     }, async ({ entityIds }) => {
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('environment-api:entities:read', 'settings:objects:read'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('environment-api:entities:read', 'settings:objects:read'));
         console.error(`Fetching ownership for ${entityIds}`);
         const ownershipInformation = await (0, get_ownership_information_1.getOwnershipInformation)(dtClient, entityIds);
         console.error(`Done!`);
@@ -741,7 +788,7 @@ You can now execute new Grail queries (DQL, etc.) again. If this happens more of
         if (!approved) {
             return 'Operation cancelled: Human approval was not granted for sending this email.';
         }
-        const dtClient = await (0, dynatrace_clients_1.createDtHttpClient)(dtEnvironment, scopesBase.concat('email:emails:send'), oauthClientId, oauthClientSecret, dtPlatformToken);
+        const dtClient = await createAuthenticatedHttpClient(scopesBase.concat('email:emails:send'));
         const emailRequest = {
             toRecipients: { emailAddresses: toRecipients },
             ...(ccRecipients && { ccRecipients: { emailAddresses: ccRecipients } }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dynatrace-oss/dynatrace-mcp-server",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "mcpName": "io.github.dynatrace-oss/Dynatrace-mcp",
   "description": "Model Context Protocol (MCP) server for Dynatrace",
   "keywords": [
@@ -57,6 +57,7 @@
     "commander": "^14.0.0",
     "dotenv": "^17.2.1",
     "dt-app": "^0.148.1",
+    "open": "^8.4.2",
     "zod-to-json-schema": "^3.24.5"
   },
   "devDependencies": {