Datadog MCP Server

Instructions

Implementation Reference

• datadog_mcp/server.py:75-146 (registration)

  Registers the GetUsageApplicationSecurityMonitoring tool by whitelisting the /api/v2/usage.* GET endpoint (line 109) as an MCP TOOL via FastMCP route maps. This is part of the security filter that exposes only safe read-only Datadog API endpoints.
  def _get_route_filters(self) -> list[RouteMap]: """Get route filtering rules for safe observability-focused tools. Security Model: 1. DENY ALL destructive operations (POST, PUT, PATCH, DELETE) 2. ALLOW ONLY specific read-only GET endpoints 3. DEFAULT DENY everything else This whitelist approach ensures only safe, read-only operations are exposed through the MCP interface. """ # Define safe read-only endpoints for observability workflows safe_endpoints = [ # Metrics and time-series data r"^/api/v2/metrics.*", # Query metrics data r"^/api/v2/query/.*", # Time-series queries # Dashboards and visualizations r"^/api/v2/dashboards.*", # Dashboard configurations r"^/api/v2/notebooks.*", # Notebook data # Monitoring and alerts r"^/api/v2/monitors.*", # Monitor configurations r"^/api/v2/downtime.*", # Scheduled downtimes r"^/api/v2/synthetics.*", # Synthetic tests # Logs and events r"^/api/v2/logs/events/search$", # Search logs r"^/api/v2/logs/events$", # List log events r"^/api/v2/logs/config.*", # Log pipeline configs # APM and traces r"^/api/v2/apm/.*", # APM data r"^/api/v2/traces/.*", # Trace data r"^/api/v2/spans/.*", # Span data # Infrastructure r"^/api/v2/hosts.*", # Host information r"^/api/v2/tags.*", # Tag management (read) r"^/api/v2/usage.*", # Usage statistics # Service management r"^/api/v2/services.*", # Service catalog r"^/api/v2/slos.*", # Service level objectives r"^/api/v2/incidents.*", # Incident management # Security and compliance r"^/api/v2/security_monitoring.*", # Security signals r"^/api/v2/cloud_workload_security.*", # CWS data # Teams and organization (read-only) r"^/api/v2/users.*", # User information r"^/api/v2/roles.*", # Role information r"^/api/v2/teams.*", # Team structure # API metadata r"^/api/v2/api_keys$", # List API keys (no create/delete) r"^/api/v2/application_keys$", # List app keys (no create/delete) ] filters = [ # SECURITY: Block ALL destructive operations first RouteMap( methods=["POST", "PUT", "PATCH", "DELETE"], mcp_type=MCPType.EXCLUDE ), ] # Add whitelisted read-only endpoints filters.extend( RouteMap( pattern=pattern, methods=["GET"], mcp_type=MCPType.TOOL, ) for pattern in safe_endpoints ) # SECURITY: Default deny everything else filters.append(RouteMap(pattern=r".*", mcp_type=MCPType.EXCLUDE)) return filters
• datadog_mcp/server.py:174-179 (registration)

  Creates all MCP tools from Datadog OpenAPI spec using FastMCP.from_openapi, applying the security route_maps that include the usage endpoint. The authenticated httpx client proxies requests to Datadog API.
  self.mcp_server = FastMCP.from_openapi( openapi_spec=openapi_spec, client=auth_client, route_maps=route_maps, )
• datadog_mcp/patches.py:6-46 (helper)

  Monkey patch for FastMCP OpenAPI parser to ensure proper parameter handling for generated tools like GetUsageApplicationSecurityMonitoring.
  def patch_fastmcp_parameter_parsing() -> None: """Patch FastMCP to handle enum parameter locations correctly. This fixes an incompatibility where FastMCP expects parameter locations as strings (e.g., "path", "query") but receives enum objects from the OpenAPI spec parser (e.g., <ParameterLocation.PATH: 'path'>). """ try: import fastmcp.utilities.openapi as openapi_utils # Store original function original_convert = getattr(openapi_utils.OpenAPIParser, '_convert_to_parameter_location', None) def patched_convert_to_parameter_location(self, param_in): """Patched parameter location converter that handles enum values.""" # Convert enum to string if needed if hasattr(param_in, 'value'): param_in = param_in.value elif hasattr(param_in, 'name'): param_in = param_in.name.lower() # Call original function with string value if original_convert: return original_convert(self, param_in) else: # Fallback implementation if param_in in ["path", "query", "header", "cookie"]: return param_in return "query" # Apply the patch if hasattr(openapi_utils, 'OpenAPIParser'): openapi_utils.OpenAPIParser._convert_to_parameter_location = patched_convert_to_parameter_location except ImportError: # If we can't import the modules, the patch won't work but we'll continue pass # Apply patches when module is imported patch_fastmcp_parameter_parsing()