dtctl CLI
Official Dynatrace CLI with kubectl-style syntax and a bundled skill: workflows, dashboards, DQL queries and SLOs
- 201 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The `apply` and `delete` commands change and remove workflows, dashboards and Dynatrace environment settings.
- The default safety level is `readwrite-all`, and it does not narrow the token's rights.
Install
- Works in
Manual install
brew install dynatrace-oss/tap/dtctlInstalls the client on macOS and Linux through Homebrew. The README also has an install script and PowerShell for Windows.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The `apply` and `delete` commands change and remove workflows, dashboards and Dynatrace environment settings.
- The default safety level is `readwrite-all`, and it does not narrow the token's rights.
This is third-party code. Review the repository files before installing.
What it does
dtctl is a command-line client for the Dynatrace cloud platform, made by the company itself. Commands follow kubectl: `dtctl get workflows`, `dtctl describe`, `dtctl apply -f workflow.yaml`, `dtctl delete`. The platform is managed from a terminal and scripts, with configuration kept in YAML. The client covers workflows, dashboards and notebooks, SLOs, settings, buckets, anomaly detectors, extensions and AWS, Azure and GCP cloud connections. DQL queries run with `dtctl query "fetch logs | limit 10"`, and `dtctl exec copilot nl2dql` turns a plain-language request into DQL. For agents there is the `--agent` flag with structured output, the `dtctl commands` command catalog and the `dtctl inventory` data overview. The repository carries the `skills/dtctl` skill that teaches Claude Code, Cursor, Codex and Copilot how to work with the client. Dynatrace domain knowledge, meaning DQL syntax and log analysis patterns, lives in separate skills in the Dynatrace/dynatrace-for-ai repository.
Who it is for. SRE and DevOps engineers on Dynatrace who investigate incidents and keep dashboards, workflows and SLOs as code, including through an agent.
Good fit when
- After an alert the agent pulls the last hour of errors out of Dynatrace and shows which services were hit.
- Dashboards and workflows live in Git and are rolled out to environments with `dtctl apply`, with variable substitution.
- SLO status is checked in a CI pipeline before a release.
- The question is phrased in plain words and writing DQL is a chore: `dtctl exec copilot nl2dql` produces a query draft.
- One engineer switches between dev, staging and prod and does not want to change production by accident.
Not a fit when
- You run Dynatrace Managed: it has its own tool, dtmgd, while dtctl targets SaaS.
- You only want to look at charts: the Dynatrace web interface is more convenient.
- A token with broad rights would go to an agent unrestricted: the safety level does not narrow the token itself.
- You need stable commands only: some flags are marked experimental.
Example request
Using dtctl, show the checkout service error logs for the last hour and the list of open problems, without changing anything.Limitations
dtctl works with Dynatrace SaaS only and needs an account and an environment; login goes through OAuth or a token. The safety level (`readonly`, `readwrite-mine`, `readwrite-all`) acts on the client side and does not narrow the token's rights, so give the agent a token with minimal scopes. The default level is `readwrite-all`. Queries against logs, events and spans are billed by scanned bytes, and dashboard tiles are billed on every refresh. Some commands and flags have the `experimental` or `development` status.
How to disable. Log out of the environment and remove the client: `brew uninstall dtctl` if it came from Homebrew, or delete the binary from `PATH`. Delete the skill from the agent's skills directory and revoke the tokens in Dynatrace.
FAQ
How do I install dtctl?
On macOS and Linux run `brew install dynatrace-oss/tap/dtctl`. A shell-script install and a PowerShell script for Windows also exist. Then log in with `dtctl auth login --context my-env --environment "https://abc12345.apps.dynatrace.com"` and check with `dtctl doctor`.
How do I install the dtctl skill in Claude Code?
Run `dtctl skills install --for claude` or `npx skills add Dynatrace/dtctl`. `dtctl skills install` without a flag detects the agent itself, and `--global` installs the skill for all projects.
How do I stop an agent from changing anything?
Set the context's safety level to `readonly`, for example `dtctl config set-context web --environment "$DT_ENVIRONMENT_URL" --token-ref t --safety-level readonly`. Also issue a token with read-only scopes.
How does dtctl differ from dtmgd?
dtctl manages Dynatrace SaaS, dtmgd manages Dynatrace Managed. A third tool, dtwiz, handles setup and data onboarding.
Where does the agent learn DQL syntax?
The `dtctl` skill sends the agent to `references/DQL-reference.md`. Deeper DQL and log knowledge comes from a separate pack: `npx skills add dynatrace/dynatrace-for-ai`.
Discussion
No questions or reviews yet.
Related
CLI toolsOfficial Dynatrace skills for agents: DQL, traces, logs, Kubernetes, cloud and security work inside Claude Code and Cursor.
Official Datadog skills: monitors, logs, APM, cloud integrations, RUM and LLM observability from inside the agent
The official Coralogix CLI with 19 skills: an agent reads production logs, traces and metrics and triages incidents
Datadog's official managed MCP server: logs, metrics, traces and incidents right in your agent
Deckhouse CLI (d8)
D8 - Deckhouse CLI
The d8 command-line client for Deckhouse Kubernetes Platform: cluster status, modules, backups, mirroring and diagnostics
JetBrains' official TeamCity CLI: start builds, tail logs, check the queue and shell into an agent from a terminal.
README in short
The README opens with command examples, then gives three install routes, OAuth login and a table of resources with their allowed operations. Separate sections describe the agent skill, the `dtctl serve http` HTTP server mode and OpenTelemetry trace export.
README badge
Original SKILL.md
--- name: dtctl description: Investigate incidents, debug performance issues, analyze logs, and manage observability resources in Dynatrace using the dtctl CLI. Use this skill whenever the user asks about error rates, latency spikes, service health, crash-looping pods, web vitals, SLO status, open problems, root cause analysis, log patterns, trace analysis, or building dashboards — even if they don't mention Dynatrace by name. Also covers DQL queries, workflow management, notebook and dashboard creation, settings configuration, and any operations against a Dynatrace environment. --- # Dynatrace Control with dtctl Operate `dtctl`, the kubectl-style CLI for Dynatrace. Pattern: `dtctl <verb> <resource> [flags]`. ## Initialization Run once to establish context, permissions, and the command catalog: ```bash dtctl commands # compact overview: verbs, resources, subcommands (TOON default) # dtctl commands --brief # + mutating/access/scopes + flag types # dtctl commands --full # exhaustive catalog: descriptions, flag defaults, global flags dtctl config current-context # active context dtctl config describe-context $(dtctl config current-context) --plain # env URL + safety level dtctl auth status --plain # token type (OAuth vs API/platform) + safety level dtctl inventory # what data exists HERE: fetchable objects, buckets, entity census, capabilities ``` Safety levels: `readonly`, `readwrite-mine`, `readwrite-all`, `dangerously-unrestricted`. `dtctl commands` answers "what can I run?"; `dtctl inventory` answers "what is there to query?" — run it before exploratory DQL. It partitions catalog objects into fetchable vs query-only (never `fetch metrics` or `fetch smartscape.*`), and reports capabilities as present, absent (with the evidence checked — cite it instead of re-probing), or unknown (no verdict; not evidence of absence). Org-specific capability definitions: `--definitions file.yaml`. Don't use `dtctl auth whoami` to test connectivity — it needs an OAuth token with `app-engine:apps:run` and returns a spurious 403 for plain API or read-scoped tokens even when reads work. Confirm with a real `get`/`query`. ## DQL (required reading) Before writing, modifying, or running any DQL (`dtctl query`, `dtctl wait query`, query files), consult `references/DQL-reference.md` and follow it over any assumption or memory. ```bash dtctl query "fetch logs | filter status='ERROR' | limit 100" -o json --plain dtctl query -f query.dql --set host=h-123 --set timerange=2h -o json --plain # Go-template vars dtctl wait query "fetch spans | filter test_id='test-123'" --for=count=1 --timeout 5m dtctl query "timeseries avg(dt.host.cpu.usage)" -o chart --plain ```