Unable to connect to Dynatrace when deploying mcp server on EKS which connects through AWS private link

[aakashsinghbisen]

I am trying to deploy Dynatrace MCP server on AWS EKS which has private link connectivity to multiple Dynatrace tenants.

I am using platform token with apps.dynatarce.com endpoints as mentioned on github repo.

Would this MCP server runs in this type of scenario?
I'll be building custom MCP client frontend and backend which connects to Dynatrace MCP server and uses LLM for below uses cases -

Real-time observability - Fetch production-level data for early detection and proactive monitoring
Contextual debugging - Fix issues with full context from monitored exceptions, logs, and anomalies
Security insights - Get detailed vulnerability analysis and security problem tracking
Natural language queries - Use AI-powered DQL generation and explanation
Multi-phase incident investigation - Systematic 4-phase approach with automated impact assessment
Advanced transaction analysis - Precise root cause identification with file/line-level accuracy
Cross-data source correlation - Connect problems → spans → logs with trace ID correlation
DevOps automation - Deployment health gates with automated promotion/rollback logic
Security compliance monitoring - Multi-cloud compliance assessment with evidence-based investigation

[christian-kreuzberger-dtx]

Hi @aakashsinghbisen , this should work, assuming AWS Private Link works like a VPN. The MCP server itself only establishes HTTPs connections to https://<environment-id>.apps.dynatrace.com, and sends JSON messages across.

In order to help you, could you please provide the following:

• Start Command of the MCP Server (e.g,. npx -y @dynatrace-oss/dynatrace-mcp-server --http)
• Logs of the MCP Server
• Any other information that you believe could be relevant

[aakashsinghbisen]

Hi @christian-kreuzberger-dtx ,

Below setup is running fine on stand alone Docker container on local machine but getting different errors on EKS.

1. Docker file has npx -y @dynatrace-oss/dynatrace-mcp-server@latest --http --port 3000

logs says on EKS pod (node:1) Warning: Setting the NODE_TLS_REJECT_UNAUTHORIZED environment variable to '0' makes TLS connections and HTTPS requests insecure by disabling certificate verification.
(Use node --trace-warnings ... to show where the warning was created) and hang.....

Additional information -

Manual curl tests show the API token works: curl -k -H "Authorization: Api-Token "
Platform token works as well -

When running it through docker exec manually, getting this error -

kubectl exec -n dynatrace-mcp dynatrace-mcp-server-85fcfb6884-jd7sw -- sh -c "node /usr/local/lib/node_modules/@dynatrace-oss/dynatrace-mcp-server/dist/index.js --http --port 3000 > /tmp/mcp.log 2>&1 &"

Error: Could not connect to the Dynatrace environment at https://xxxxxxx.apps.dynatrace.com.
Error: Response body does not conform to the specified response body type: 'json'. The content type of the response is 'text/html'. Response status is '403'. Response source is 'null'

I tried with Full access Platform token, Full access API token but same error.

Let me know if you need more information.

Deployment.yaml spec -

spec:
replicas: 1
selector:
matchLabels:
app: dynatrace-mcp-server
template:
metadata:
labels:
app: dynatrace-mcp-server
spec:
hostNetwork: true
dnsPolicy: ClusterFirstWithHostNet

  imagePullSecrets:
  - name: xxxx
  containers:
  - name: dynatrace-mcp-server
    image: My-registry/docker-dev-local/dynatrace/mcp/dynatrace-mcp-server:latest
    ports:
    - containerPort: 3000
    env:
    - name: DT_ENVIRONMENT
      value: "https://xxxxx.apps.dynatrace.com"
    - name: DT_PLATFORM_TOKEN
      valueFrom:
        secretKeyRef:
          name: dynatrace-secrets
          key: platform-token
    - name: DEBUG
      value: "*"
    - name: NODE_TLS_REJECT_UNAUTHORIZED
      value: "0"

    resources:
      requests:
        memory: "128Mi"
        cpu: "100m"
      limits:
        memory: "256Mi"
        cpu: "200m"

[christian-kreuzberger-dtx]

Hi!

Looking at your config and the mention of "AWS Private Link" in the title, as well as the error message

Error: Could not connect to the Dynatrace environment at https://xxxxxxx.apps.dynatrace.com/.
Error: Response body does not conform to the specified response body type: 'json'. The content type of the response is 'text/html'. Response status is '403'. Response source is 'null'

I'm suspecting a configuration issue on EKS or AWS Private Link. I am not familiar with AWS Private Link, but I'd still like to help to find the problem.

Could you please try execute the following curl or node command on the Kubernetes pod:

curl https://<environment-id>.apps.dynatrace.com

or

node -e "fetch('https://<enviornment-id>.apps.dynatrace.com').then((response) => response.text()).then(console.log)"

In both cases, we would epxect something like

{"error":{"code":401,"message":"Authentication required","details":{"traceId":""}}}

If that's not the case, maybe you are already seeing a more concrete error message.

[christian-kreuzberger-dtx]

I have just released version 0.9.2 which includes an improvement to error logging when the connection fails. I hope this helps to further pinpoint the problem.

[aakashsinghbisen]

With version 0.9.2, I am seeing this complete error -

Using Platform Token to authenticate API Calls to https://xxxx.apps.dynatrace.com
❌ Failed to connect to Dynatrace environment https://xxxx.apps.dynatrace.com: Response body does not conform to the specified response body type: 'json'. The content type of the response is 'text/html'. Response status is '403'. Response source is 'null'
DataTypeError: Response body does not conform to the specified response body type: 'json'. The content type of the response is 'text/html'. Response status is '403'. Response source is 'null'
at throwResponseBodyTypeError (/app/node_modules/@dynatrace-sdk/http-client/cjs/index.js:575:9)
at decodeAsyncResponseBody (/app/node_modules/@dynatrace-sdk/http-client/cjs/index.js:602:5)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
at async EnvironmentInformationClient.getEnvironmentInformation (/app/node_modules/@dynatrace-sdk/client-platform-management-service/cjs/index.js:416:33)
at async main (/app/dist/index.js:159:9) {
cause: SyntaxError: Unexpected token '<', "<bod"... is not valid JSON
at JSON.parse ()
at parseJSONFromBytes (node:internal/deps/undici/undici:5738:19)
at successSteps (node:internal/deps/undici/undici:5719:27)
at fullyReadBody (node:internal/deps/undici/undici:4609:9)
at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
at async consumeBody (node:internal/deps/undici/undici:5728:7)
at async decodeAsyncResponseBody (/app/node_modules/@dynatrace-sdk/http-client/cjs/index.js:590:16)
at async EnvironmentInformationClient.getEnvironmentInformation (/app/node_modules/@dynatrace-sdk/client-platform-management-service/cjs/index.js:416:33)
at async main (/app/dist/index.js:159:9)

[christian-kreuzberger-dtx]

And before Using Platform Token to authenticate API Calls, does it also provide some message? Maybe some HTML?

[aakashsinghbisen]

When i curl directly, i am seeing all 404, can you share a proper curl call for grail data query?

i am using this -

curl -X POST "https://xxxxx.apps.dynatrace.com/platform/storage/query/v1/query"
-H "Authorization: Bearer {token}"
-H "Content-Type: application/json"
-d '{"query": "fetch logs | filter contains(service.name, "xxxxx") | filter level in ("ERROR", "WARN") | fields timestamp, content, level, traceId, spanId, service.name | sort timestamp desc | limit 100"}'

Just FYI, I am still facing issues running the MCP server so i am trying to test the API calls first and see if it works.

I need to get this MCP running as well.

[christian-kreuzberger-dtx]

Hi @aakashsinghbisen ,

we just released v0.11.0 which contains a HTTP Proxy feature (via setting HTTP_PROXY environment variable), maybe this helps with your setup (see README for details).

Regarding your curl command, the correct URL to the DQL query endpoint is

https://<environment-id>.apps.dynatrace.com/platform/storage/query/v1/query:execute

You can find those URLs in Dynatrace Swagger UI, e.g., https://.apps.dynatrace.com/platform/swagger-ui/index.html