Architecture and security

Learn how the MCP server isolates credentials, handles data, and protects network connections.

For stdio, the Controller credential comes from the selected process-managed mode (APPD_API_TOKEN for env_bearer; APPD_CLIENT_ID, APPD_CLIENT_SECRET, and APPD_CUSTOMER for oauth). The optional Events key (EVENTS_API_KEY) remains separate in any stdio mode.

The two downstream credential families are isolated:

  • A Controller bearer token is never used as an Analytics Events key.
  • An Analytics Events key is never sent to the Controller.
  • Events URLs and account names are server configuration, not tool arguments.
  • The incoming HTTP bearer is request-scoped. Process-level APPD_API_TOKEN and EVENTS_API_KEY are ignored in HTTP mode. Selected Controller reads can derive and briefly cache an in-memory UI session from that bearer. This session is not a separate authentication mode.

HTTP authentication boundary

In streamable-http mode, every request except GET /health must contain:
CODE 
Authorization: Bearer <AppDynamics-Controller-token>

The middleware validates only the bearer-header syntax. The Controller validates the token when a Controller-backed tool runs. The Controller URL is server-owned.

An Events-only call does not contact the Controller; its downstream authorization is the supplied X-Events-API-Key plus the server-configured Events account name. Place any shared or remotely reachable HTTP deployment behind an independently authenticated ingress or gateway. Do not use an arbitrary placeholder bearer value as client authentication.

GET /health is intentionally unauthenticated and reports process status, service name, timestamp, and the resolved runtime build version.

By default, HTTP transport sends logs to standard output (stdout), while stdio transport sends logs to standard error (stderr) to avoid disrupting the MCP protocol stream. Set APPD_LOGFILE to also write logs to a file. Tool audit records capture the tool name, status, duration, transport, direct peer IP address, and error type when available, but they do not identify the authenticated principal or provide end-to-end request lineage.

Read-only and data handling

  • The server tools are read-oriented. They do not change Controller monitoring data or configuration, run alert actions, or publish Analytics events.
  • Shared structured-key redaction covers authorization, API-key, and password fields. It does not generically remove cookies, tokens, secrets, scripts, request data, SQL, error text, or bind values. Synthetic job output and raw call graphs can contain such diagnostic content; treat all tool output as sensitive.
  • DBMon query tools and APM snapshot-hotspot analysis reduce normalized SQL to literal-safe templates. get_apm_snapshot_call_graph defaults to compact grouped paths; its detail_level="raw" exception is restricted to one request-segment ID and enforces node/byte caps, but can include raw diagnostic content.
  • Raw Analytics ADQL can request any field authorized by the Events key. Structured-key redaction is defense in depth, not a substitute for least privilege.
  • Tool inputs, outputs, and monitoring data pass through server memory to the client. The server implements no monitoring-data database. Apply the retention and data-governance controls required for your client and model provider.
  • Structured tool responses redact fields whose names indicate sensitive data, such as authorization credentials, API keys, and passwords. Analytics Events query results apply additional redaction rules for fields containing URLs, headers, cookies, IP addresses, identifiers, user data, stack information, and scripts.

TLS and network posture

  • When HTTPS is used, outbound Controller and Events clients require TLS 1.2 or higher. The server does not force the Controller URL to use HTTPS. Use HTTPS for every production Controller connection.

  • APPD_VERIFY_SSL defaults to true and affects both outbound clients. Keep it enabled. For a private CA, make that CA trusted by the container (or use the standard SSL_CERT_FILE / SSL_CERT_DIR paths) rather than disabling verification.
  • A non-loopback Analytics Events URL must use HTTPS.

  • The MCP listener uses HTTPS only when both MCP_SSL_CERTFILE and MCP_SSL_KEYFILE are configured; otherwise it listens on HTTP.

    In-process HTTPS requires both MCP_SSL_CERTFILE and MCP_SSL_KEYFILE. If either setting is missing, the server starts with HTTP. Before exposing the endpoint, verify the protocol reported in the startup logs.

  • The server listens on 0.0.0.0 inside the container. Restrict exposure with host bindings, firewall rules, security groups, Kubernetes NetworkPolicy, or equivalent controls. Do not expose port 6350 directly on an untrusted network.