Dynatrace deprecates its local MCP server, pointing users to dtctl and a hosted remote server

Dynatrace deprecated its open-source local MCP server on 2026-07-20. Version 2.1.2 is the repository's final release, and its notes carry a single change: "chore: deprecate repository, redirect to remote MCP and dtctl". The README now opens with a deprecation notice stating that no further updates will be made, and routes users by use case: local development moves to Dynatrace-for-AI with the dtctl CLI, while agent-to-agent and remote scenarios move to the hosted Dynatrace Remote MCP Server, which requires no local setup. A step-by-step migration guide ships in the repository.

The wind-down followed a security fix. v2.1.1, released six days earlier on 2026-07-14, closed a DQL injection in several read tools (GHSA-pqh8-p93p-2rx7, medium, CVSS 4.3, disclosed 2026-06-09): caller-supplied parameters typed as identifiers were interpolated into DQL query strings without quoting or escaping, letting a caller inject pipeline stages that bypass the tools' documented field-scope, time-window and display caps.

The local server remains installable (npm @dynatrace-oss/dynatrace-mcp-server at 2.1.2) but unmaintained, and it ranked 57th by measured adoption in the MCP 500 snapshot of 2026-08-21. Its catalog record now carries deprecated status.

This story is published as a dated backfill: the deprecation shipped on 2026-07-20 and surfaced during our 2026-08-25 verification pass over the catalog.