Datadog MCP Server
Provides tools for querying and managing Datadog observability data, including logs, metrics, traces, monitors, dashboards, and alerts.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Datadog MCP Servershow me the latest error logs in production"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Datadog MCP Server
DISCLAIMER: This is a community-maintained project and is not officially affiliated with, endorsed by, or supported by Datadog, Inc. This MCP server utilizes the Datadog API but is developed independently.
MCP server providing AI assistants with full Datadog observability access. Features grep-like log search, APM trace filtering with duration/status/error queries, smart sampling modes for token efficiency, and cross-correlation between logs, traces, and metrics. Supports both stdio (local) and http (remote/Kubernetes) transports.
Quick Start
Minimal Claude Desktop / VS Code / Cursor config — just the two required keys:
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["-y", "datadog-mcp"],
"env": {
"DD_API_KEY": "your-api-key",
"DD_APP_KEY": "your-app-key"
}
}
}
}With optional tuning (EU site, custom default limits, longer log windows):
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["-y", "datadog-mcp"],
"env": {
"DD_API_KEY": "your-api-key",
"DD_APP_KEY": "your-app-key",
"DD_SITE": "datadoghq.eu",
"MCP_DEFAULT_LIMIT": "50",
"MCP_DEFAULT_LOG_LINES": "200",
"MCP_DEFAULT_METRIC_POINTS": "1000",
"MCP_DEFAULT_TIME_RANGE": "24"
}
}
}
}To run as an HTTP server (e.g. inside a container or Kubernetes pod), add transport variables to the same env block:
"env": {
"DD_API_KEY": "your-api-key",
"DD_APP_KEY": "your-app-key",
"MCP_TRANSPORT": "http",
"MCP_PORT": "3000",
"MCP_HOST": "0.0.0.0"
}Related MCP server: datadog-mcp
Configuration
Required environment variables
DD_API_KEY=your-api-key
DD_APP_KEY=your-app-keyOptional environment variables
DD_SITE=datadoghq.com # Default. Use datadoghq.eu for EU, etc.
# Limit defaults (fallbacks when the AI doesn't specify)
MCP_DEFAULT_LIMIT=50 # General tools default limit
MCP_DEFAULT_LOG_LINES=200 # Logs tool default limit
MCP_DEFAULT_METRIC_POINTS=1000 # Metrics timeseries data points
MCP_DEFAULT_TIME_RANGE=24 # Default time range in hours
# Transport (alternative to CLI flags — useful in Kubernetes)
MCP_TRANSPORT=stdio # stdio | http
MCP_PORT=3000 # HTTP port
MCP_HOST=0.0.0.0 # HTTP hostOptional flags
--site=datadoghq.com # Datadog site (overrides DD_SITE)
--transport=stdio|http # Transport mode (default: stdio)
--port=3000 # HTTP port when using http transport
--host=0.0.0.0 # HTTP host when using http transport
--read-only # Block all write operations
--disable-tools=synthetics,rum,security # Comma-separated list of tools to disableTransports
Transport | When to use | Endpoints |
| Local MCP clients — Claude Desktop, Cursor, VS Code | n/a (process stdin/stdout) |
| Remote / container / Kubernetes |
|
Select with --transport=http or MCP_TRANSPORT=http.
Deployment
Docker
{
"mcpServers": {
"datadog": {
"command": "docker",
"args": [
"run", "-i", "--rm",
"-e", "DD_API_KEY",
"-e", "DD_APP_KEY",
"-e", "DD_SITE",
"ghcr.io/tantiope/datadog-mcp"
],
"env": {
"DD_API_KEY": "your-api-key",
"DD_APP_KEY": "your-app-key",
"DD_SITE": "datadoghq.com"
}
}
}
}Kubernetes
Use environment variables — not container args — for transport configuration:
env:
- name: DD_API_KEY
value: "your-api-key"
- name: DD_APP_KEY
value: "your-app-key"
- name: MCP_TRANSPORT
value: "http"
- name: MCP_PORT
value: "3000"
- name: MCP_HOST
value: "0.0.0.0"Note: Kubernetes
args:replaces the entire Dockerfile CMD, causing Node.js to receive the flags instead of your application. Environment variables avoid this issue.
Tools
Tool | Action | Category | Description | Required Scopes |
| list | Alerting | List monitors with optional filters |
|
| get | Alerting | Get monitor by ID |
|
| search | Alerting | Search monitors by query |
|
| create | Alerting | Create a new monitor; |
|
| update | Alerting | Update an existing monitor; same validated schema as |
|
| preview | Alerting | Render a monitor template (inline |
|
| test_notification | Alerting | Known limitation: returns | n/a |
| delete | Alerting | Delete a monitor |
|
| mute | Alerting | Mute a monitor |
|
| unmute | Alerting | Unmute a monitor |
|
| top | Alerting | Top N monitors by alert frequency with real monitor names and context breakdown. WARNING: |
|
| history | Alerting | Count and list real state transitions for one monitor over a time window. Filters by |
|
| list | Visualization | List all dashboards |
|
| get | Visualization | Get dashboard by ID |
|
| create | Visualization | Create a new dashboard |
|
| update | Visualization | Update a dashboard |
|
| delete | Visualization | Delete a dashboard |
|
| search | Logs | Search logs with query syntax and filters |
|
| aggregate | Logs | Aggregate log data with groupBy |
|
| list, get | Logs Config | Inspect log processing pipelines and their processors |
|
| create, update, delete, reorder | Logs Config | Author pipelines and processor chains |
|
| get_order | Logs Config | Read pipeline evaluation order |
|
| list, get | Logs Config | Inspect indexes (filter, retention, Flex tier, exclusion filters); |
|
| update, reorder | Logs Config | Update index filter/retention/quota and reorder evaluation |
|
| get_order | Logs Config | Read index evaluation order |
|
| list, get | Logs Config | Inspect log archives (S3 / GCS / Azure destinations); per-provider credential fields are forwarded unchanged |
|
| create, update, delete, reorder | Logs Config | Manage archive destinations; | gcs |
| get_order | Logs Config | Read archive evaluation order |
|
| query | Metrics | Query timeseries data. Response |
|
| search | Metrics | Search for metrics by name |
|
| list | Metrics | List active metrics |
|
| metadata | Metrics | Get metric metadata |
|
| search | APM | Search spans with filters |
|
| aggregate | APM | Aggregate trace data |
|
| services | APM | List APM services |
|
| list | Events | List events |
|
| get | Events | Get event by ID |
|
| create | Events | Create an event |
|
| search | Events | Search events with v2 API and cursor pagination. Optional |
|
| histogram | Events | Server-side bucketing of events by |
|
| aggregate | Events | Client-side aggregation by monitor_name, source, etc. |
|
| top | Events | Top N event groups by count with generic groupBy support (deployments, configs, alerts, etc.). Groups without context tags are included as "no_context" |
|
| timeseries | Events | Time-bucketed alert trends (hourly/daily counts) |
|
| incidents | Events | Deduplicate alerts into incidents with Trigger/Recover pairing |
|
| list | Incidents | List incidents |
|
| get | Incidents | Get incident by ID |
|
| search | Incidents | Search incidents |
|
| create | Incidents | Create an incident |
|
| update | Incidents | Update an incident |
|
| delete | Incidents | Delete an incident |
|
| list | SLOs | List SLOs. Each item exposes |
|
| get | SLOs | Get SLO by ID (same projection as |
|
| create | SLOs | Create an SLO |
|
| update | SLOs | Update an SLO |
|
| delete | SLOs | Delete an SLO |
|
| history | SLOs | Get SLO history |
|
| list | Synthetics | List synthetic tests |
|
| get | Synthetics | Get test by public ID |
|
| create | Synthetics | Create a test |
|
| update | Synthetics | Update a test |
|
| delete | Synthetics | Delete a test |
|
| trigger | Synthetics | Trigger a test run |
|
| results | Synthetics | Get test results |
|
| list | Downtimes | List downtimes |
|
| get | Downtimes | Get downtime by ID |
|
| create | Downtimes | Create a downtime |
|
| update | Downtimes | Update a downtime |
|
| cancel | Downtimes | Cancel a downtime |
|
| listByMonitor | Downtimes | List downtimes for a monitor |
|
| list | Infrastructure | List hosts |
|
| totals | Infrastructure | Get host totals |
|
| mute | Infrastructure | Mute a host |
|
| unmute | Infrastructure | Unmute a host |
|
| applications | RUM | List RUM applications |
|
| events | RUM | Search RUM events |
|
| aggregate | RUM | Aggregate RUM data |
|
| performance | RUM | Get Core Web Vitals (LCP, FCP, CLS, FID, INP) |
|
| waterfall | RUM | Get session timeline with resources/actions/errors |
|
| rules | Security | List security rules |
|
| signals | Security | Search security signals |
|
| findings | Security | List security findings |
|
| list | Notebooks | List notebooks |
|
| get | Notebooks | Get notebook by ID |
|
| create | Notebooks | Create a notebook |
|
| update | Notebooks | Update a notebook |
|
| delete | Notebooks | Delete a notebook |
|
| list | Admin | List users |
|
| get | Admin | Get user by ID |
|
| list | Admin | List teams |
|
| get | Admin | Get team by ID |
|
| members | Admin | List team members |
|
| list | Infrastructure | List all tags |
|
| get | Infrastructure | Get tags for a host |
|
| add | Infrastructure | Add tags to a host |
|
| update | Infrastructure | Update host tags |
|
| delete | Infrastructure | Delete host tags |
|
| summary | Billing | Usage summary |
|
| hosts | Billing | Host usage |
|
| logs | Billing | Log usage |
|
| custom_metrics | Billing | Custom metrics usage |
|
| indexed_spans | Billing | Indexed spans usage |
|
| ingested_spans | Billing | Ingested spans usage |
|
| validate | Auth | Test API and App key validity | — |
Limit Control
AI assistants have full control over query limits. The MCP_DEFAULT_* environment variables only set the fallback used when the AI doesn't specify a limit — they do NOT cap what the AI can request.
Tool | Default | Parameter | Description |
Logs | 200 |
| Log lines to return |
Metrics (timeseries) | 1000 |
| Data points per series (controls resolution) |
General tools | 50 |
| Results to return |
Tool-level token reduction features (compact: true on logs, sample: "diverse" | "spread" | "first", field projections, diagnostics) are surfaced in each tool's MCP description and chosen by the AI at call time.
Notable behaviors
A handful of patterns worth knowing about — the AI can discover the rest from tool descriptions.
Renotifies vs real fires.
monitors topandevents searchwithsource:alertcount every renotify Datadog emits (one everyrenotify_intervalwhile a monitor is Alert). To get actual state transitions, usemonitors history(defaults totransitionType: ["alert","alert recovery"]) or passtransitionTypetoevents search.DST-safe time buckets.
events histogrambuckets byhour_of_day/day_of_week/day_of_monthin any IANAtimezoneviaIntl.DateTimeFormat. Cursor-paginates the underlying search; cap controlled byMCP_MAX_EVENTS_HISTOGRAM(default 5000) withbucketCountIncomplete+nextCursoron overflow.Validate before create.
monitors createwithdry_run: truecalls/api/v1/monitor/validateinstead of persisting. Allowed in--read-onlymode.Monitor template preview.
monitors previewrenders a notification against acontextpayload — variable substitution + Datadog's six documented conditionals (is_alert,is_warning,is_no_data,is_recovery,is_alert_to_warning,is_warning_to_alert) + the tag conditionals{{#is_match "tag" "val"}}(substring) and{{#is_exact_match "tag" "val"}}(exact), with^negations and OR'd multiple comparison values (resolved againstcontext.variables; case-sensitive).{{#each}}and partials throwEUNSUPPORTED_TEMPLATE_SYNTAX.SLO round-trip.
slos getprojectsquery,monitorIds,monitorTags,groups, and a UIurlso you can edit and feed back intoslos updatewithout dropping definition fields.Cross-correlation.
logs(sample:"diverse")→ pulldd.trace_id→traces(query:"trace_id:<id>")→metrics(query:"p95:trace.express.request{service:...}")(root metric without.durationfor percentiles).
Deep links
Every query response includes a datadog_url field built for your configured DD_SITE — datadoghq.com (default), .eu, us3 / us5 / ap1.datadoghq.com, or ddog-gov.com. Supported on logs, metrics, traces, events, monitors, rum, slos.
Contributing
Contributions are welcome! Feel free to open an issue or a pull request if you have any suggestions, bug reports, or improvements to propose.
License
This project is licensed under the Apache License, Version 2.0.
Available Tools
23 toolsauthA
Validate Datadog API credentials. Use this to verify that the API key and App key are correctly configured before performing other operations.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform: validate - test if API key and App key are valid |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description clearly indicates a read/validation operation with no side effects. Since no annotations are provided, the description adequately covers the tool's behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no wasted words. The purpose is front-loaded, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema, no annotations), the description provides all necessary context for use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (one parameter with enum described). The description does not add significant meaning beyond the schema, but the parameter is straightforward enough that this is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Validate Datadog API credentials.' It uses a specific verb-resource pair and is well-distinguished from sibling tools which are other Datadog resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using this tool 'to verify that the API key and App key are correctly configured before performing other operations.' This provides good context, though it does not explicitly exclude any scenarios or mention alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dashboardsA
Access Datadog dashboards and visualizations.
Actions:
list: Filter dashboards by name/tags
get: Retrieve full dashboard config including widgets (useful for learning patterns)
create: Create new dashboard
update: Modify existing dashboard
delete: Remove dashboard
validate: Test dashboard config without creating (helps debug widget definitions)
Widget formats supported:
Simple: { "type": "timeseries", "requests": [{ "q": "avg:metric{*}" }] }
Advanced: { "type": "timeseries", "requests": [{ "queries": [...], "formulas": [...] }] }
Tags must use key:value format (e.g., ["team:ops", "env:prod"]).
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Dashboard ID (required for get/update/delete) | |
| name | No | Filter by name | |
| tags | No | Filter by tags | |
| limit | No | Maximum number of dashboards to return (default: 50) | |
| config | No | Dashboard configuration (for create/update) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It explains CRUD operations and their effects, provides widget format examples, and specifies tag format requirements. It could mention rate limits or authentication, but it is generally transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with bullet points for actions and examples for widget formats. Every sentence serves a purpose, no redundancy. It is appropriately front-loaded with the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (6 parameters, nested objects, no output schema), the description is remarkably complete. It covers all actions, parameter requirements (e.g., 'id' for get/update/delete), and provides formatting examples. The agent has sufficient context to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds substantial value beyond parameter names: it explains what each action does, describes the 'config' object with widget examples, and clarifies tag format. This enriches understanding significantly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool provides access to Datadog dashboards and visualizations, and lists six distinct actions (list, get, create, update, delete, validate) with brief explanations. This distinguishes it well from sibling tools like monitors, logs, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives guidance for each action (e.g., 'get' for learning patterns, 'validate' for debugging), which helps the agent choose appropriately. However, explicit 'when not to use' or comparative guidance against siblings is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
downtimesA
Manage Datadog scheduled downtimes for maintenance windows. Actions: list, get, create, update, cancel, listByMonitor. Use for: scheduling maintenance, preventing false alerts during deployments, managing recurring maintenance windows.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Downtime ID (required for get/update/cancel) | |
| monitorId | No | Monitor ID (required for listByMonitor) | |
| currentOnly | No | Only return active downtimes (for list) | |
| limit | No | Maximum number of downtimes to return (default: 50) | |
| config | No | Downtime configuration (for create/update). Must include scope and schedule. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It states actions like create, update, cancel but does not explain side effects (e.g., cancellations may suppress alerts, creation affects active monitors). The impact on alerting and dependencies is not described, leaving gaps for an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no fluff: first sentence states purpose, second lists actions, third gives use cases. Information is front-loaded and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 6 parameters and nested objects, and lacks an output schema. The description covers main uses and actions but omits details on error handling, idempotency, or response formats. It is adequate for basic understanding but not exhaustive for the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds value by stating the config parameter 'Must include scope and schedule,' which is not in the schema description. It also enumerates actions in plain text, reinforcing the enum. This goes beyond mere repetition.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog scheduled downtimes for maintenance windows, listing specific actions (list, get, create, update, cancel, listByMonitor). It distinguishes from sibling tools focused on other Datadog resources like monitors or dashboards.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage scenarios: scheduling maintenance, preventing false alerts during deployments, managing recurring maintenance windows. It does not mention when not to use the tool or name alternatives, but the context is clear enough for an agent to decide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
eventsA
Track Datadog events. Actions: list, get, create, search, aggregate, top, timeseries, incidents, discover, histogram. For monitor alerts, use tags: ["source:alert"].
IMPORTANT — re-evaluation vs transition:
source:alert events INCLUDE renotifies and re-evaluations (every Datadog re-evaluation of an alerting monitor emits an event). A "how many times did monitor X fire" question answered with source:alert alone over-counts.
To restrict to real state transitions, pass transitionType (e.g. ["alert","alert recovery"]). This appends @monitor.transition.transition_type:(...) to the query and matches the design's live investigation.
For a fires-only numeric count rooted in a single monitor ID, prefer the higher-level primitive monitors action=history — it returns {transitions, count, meta} with the same filter applied for you.
transitionType: Optional array of monitor transition types (alert, alert recovery, warning, warning recovery, no data, no data recovery, renotify). Empty array is treated as undefined. top: Generic event grouping by any fields (groupBy parameter). Returns groups ranked by count with optional context breakdown.
Example: {groupBy: ["service"], message: "...", service: "api", total_count: 50, by_context: [{context: "queue:X", count: 30}]}
Use for deployments, configs, custom events, or monitor alerts
Returns "message" field (event title), NOT monitor name (use monitors tool for real names)
total_count includes renotifies when source:alert is used without transitionType — see monitors action=history for fires-only counts discover: Returns available tag prefixes from events. aggregate: Custom groupBy, returns pipe-delimited keys. search: Full event details. timeseries: Time-bucketed trends with interval. incidents: Deduplicate alerts with dedupeWindow. histogram: Bucket events by local hour_of_day / day_of_week / day_of_month in the requested IANA timezone (DST-safe). Pass bucket_by (required) and optional timezone (default UTC) and cursor (for continuation). Caps at limits.maxEventsForHistogram (default 5000); when reached returns bucketCountIncomplete:true + nextCursor.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Event ID (for get action) | |
| query | No | Search query | |
| from | No | Start time (ISO 8601, relative like "1h", or Unix timestamp) | |
| to | No | End time (ISO 8601, relative like "1h", or Unix timestamp) | |
| priority | No | Event priority | |
| sources | No | Filter by sources | |
| tags | No | Filter by tags | |
| limit | No | Maximum number of events to return (default: 50) | |
| title | No | Event title (for create) | |
| text | No | Event text (for create) | |
| alertType | No | Alert type (for create) | |
| groupBy | No | Fields to group by (for aggregate and top actions). Top: custom fields like ["service"], ["user"]. Aggregate: monitor_name, priority, alert_type, source. Default for top: ["monitor_id"] | |
| cursor | No | Pagination cursor from previous response | |
| interval | No | Time bucket interval for timeseries: 1h, 4h, 1d (default: 1h) | |
| dedupeWindow | No | Deduplication window for incidents: 5m, 15m, 1h (default: 5m) | |
| enrich | No | Enrich events with monitor metadata (slower, adds monitor details) | |
| contextTags | No | Tag prefixes for context breakdown in top action (default: queue, service, ingress, pod_name, kube_namespace, kube_container_name) | |
| maxEvents | No | Maximum events to fetch for grouping in top action (default: 5000, max: 5000). Higher = more accurate but slower | |
| transitionType | No | Filter events by monitor state transition type. When set, restricts results to events with @monitor.transition.transition_type matching any value. Use ["alert","alert recovery"] to count real fires/recoveries and skip renotifies. Empty array is treated as undefined (no filter). For a fires-only count by monitor ID, prefer monitors action=history. | |
| bucket_by | No | Bucket dimension for histogram action: hour_of_day (0-23), day_of_week (0=Sun..6=Sat), day_of_month (1-31). | |
| timezone | No | Optional IANA timezone (e.g. "UTC", "Europe/Paris"). DST-safe. For histogram: controls hour/day bucketing (default: UTC). For search/aggregate/top/incidents read actions: adds sibling *Local ISO 8601 strings (e.g. timestampLocal) next to existing timestamps. Omit for byte-identical legacy shape. | |
| fields | No | Search action only: return only these event fields. Allowed values: id, title, message, timestamp, priority, source, tags, alertType, host, monitorId, monitorInfo, monitorMetadata (only populated when enrich=true). Default: full event. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral disclosure weight. It explains that source:alert includes renotifies, transitionType filters transitions, top returns message field not monitor name, histogram has limits and incomplete markers, and enrich is slower. Lacks details on create action behavior but overall strong.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is relatively long but well-structured with sections for actions, important notes, and action-specific details. It is front-loaded with the core purpose and overall usage guidelines. Every sentence adds value, though some redundancy exists (e.g., transitionType explanation repeated).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 23 parameters, no output schema, and complex semantics (e.g., transition filtering, histogram limits), the description is remarkably complete. It covers action purposes, parameter interactions, default values, edge cases (empty array), and behavior nuances (total_count includes renotifies, bucketCountIncomplete).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, baseline 3. The description adds significant value beyond schema: it explains transitionType filter behavior, default contextTags, bucket_by options, timezone DST-safety, and differences between top and aggregate. Elevates understanding beyond parameter descriptions alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Track Datadog events' and lists all 10 supported actions. It provides specific details on how to handle monitor-related events, such as using tags ["source:alert"] and transitionType. It distinguishes the tool from siblings like monitors by directing users to monitors action=history for fires-only counts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells users when to use this tool vs alternatives: 'For a fires-only numeric count... prefer the higher-level primitive monitors action=history'. It also explains the meaning of source:alert and transitionType, and provides guidance on when to use top vs aggregate vs histogram actions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hostsA
Manage Datadog infrastructure hosts. Actions: list (with filters), totals (counts), mute (silence alerts), unmute. Use for: infrastructure inventory, host health, silencing noisy hosts during maintenance.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| filter | No | Filter hosts by name, alias, or tag (e.g., "env:prod") | |
| from | No | Starting offset for pagination | |
| count | No | Number of hosts to return | |
| sortField | No | Field to sort by (e.g., "apps", "cpu", "name") | |
| sortDir | No | Sort direction | |
| hostName | No | Host name (required for mute/unmute) | |
| message | No | Mute reason message | |
| end | No | Mute end timestamp (POSIX). Omit for indefinite mute | |
| override | No | If true, replaces existing mute instead of failing |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosure. It lists actions but does not explain side effects, permissions required, rate limits, or what happens when muting/unmuting. For a tool with destructive actions (mute), more behavioral context is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences that front-load the purpose and actions, with no filler. Every word contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (10 parameters, multiple actions, no output schema), the description is incomplete. It does not explain return values for each action, pagination details for 'list', or the effect of mute/unmute. More details are needed for an AI to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions, so baseline is 3. The description does not add meaning beyond the schema; it only reiterates actions. Thus, no additional credit is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb-resource combination ('Manage Datadog infrastructure hosts') and enumerates specific actions (list, totals, mute, unmute) with brief explanations. It also provides use cases, effectively distinguishing this tool from sibling tools like monitors or events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use cases ('infrastructure inventory, host health, silencing noisy hosts during maintenance'), providing clear guidance on when to use the tool. However, it does not mention when not to use it or suggest alternatives, which would improve it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
incidentsA
Manage Datadog incidents for incident response. Actions: list, get, search, create, update, delete. Use for: incident management, on-call response, postmortems, tracking MTTR/MTTD.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Incident ID (required for get/update/delete) | |
| query | No | Search query (for search action) | |
| status | No | Filter by status (for list) | |
| limit | No | Maximum number of incidents to return (default: 50) | |
| config | No | Incident configuration (for create/update). Create requires: title. Update can modify: title, status, severity, fields. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It only states that actions exist but does not disclose behavioral traits such as side effects, idempotency, permissions, or what happens on create/update/delete. The lack of detail leaves significant ambiguity for the agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences that state purpose and list actions/use cases. It has no wasted words and is front-loaded with the core verb (Manage) and resource (incidents).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of 6 parameters including a nested object (config) and no output schema, the description is too high-level. It does not explain how actions interact with parameters, required fields for create, or return values, leaving the agent with insufficient context to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear parameter descriptions, so the description adds no additional meaning beyond the schema. The baseline of 3 applies because the description merely lists action types without enriching parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog incidents for incident response and lists specific actions (list, get, search, create, update, delete). It also provides use cases like incident management and on-call response. This distinguishes it from sibling tools that handle other Datadog resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit use cases (incident management, on-call response, postmortems, tracking MTTR/MTTD), helping an agent understand when to use this tool. However, it does not explicitly state when not to use it or mention alternatives among sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logsA
Search Datadog logs with grep-like text filtering. Actions: search (find logs), aggregate (count/group). Key filters: keyword (text grep), pattern (regex), service, host, status (error/warn/info). Time ranges: "1h", "3d@11:45:23". CORRELATION: Logs contain dd.trace_id in attributes for linking to traces and APM metrics. SAMPLING: Use sample:"diverse" for error investigation (dedupes by message pattern), sample:"spread" for time distribution. TOKEN TIP: Use compact:true to reduce payload size (strips heavy fields) when querying large volumes.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| query | No | Log search query (Datadog syntax). Examples: "error", "service:my-service status:error", "error AND timeout" | |
| keyword | No | Simple text search - finds logs containing this text (grep-like). Merged with query using AND | |
| pattern | No | Regex pattern to match in log message (grep -E style). Example: "ERROR.*timeout|connection refused" | |
| from | No | Start time. Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23, yesterday@14:00) | |
| to | No | End time. Same formats as "from". Example: from="3d@11:45:23" to="3d@12:55:34" | |
| service | No | Filter by service name | |
| host | No | Filter by host | |
| status | No | Filter by log status/level | |
| indexes | No | Log indexes to search | |
| limit | No | Maximum number of logs to return (default: 200) | |
| sort | No | Sort order | |
| sample | No | Sampling mode: first (chronological, default), spread (evenly across time range), diverse (distinct message patterns) | |
| compact | No | Strip custom attributes for token efficiency. Keeps: id, timestamp, service, host, status, message (truncated), dd.trace_id, dd.span_id, pod_name, kube_namespace, kube_container_name, error info | |
| groupBy | No | Fields to group by (for aggregate) | |
| compute | No | Compute operations (for aggregate) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It discloses correlations with traces, sampling behavior, compact flag effects, and time range formats. However, it does not mention that the tool is read-only or any potential side effects, though it is likely idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections (actions, filters, time ranges, CORRELATION, SAMPLING, TOKEN TIP). Every sentence provides useful information without redundancy. It is appropriately concise given the complexity of the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers most aspects: actions, filters, time ranges, sampling, and compact. However, it does not describe the output format or mention pagination (default limit is in schema). Given 16 parameters and no output schema, it is fairly complete but has minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description adds significant value beyond the schema: explaining grep-like filtering, time range syntax, sampling modes (diverse/spread/first), and compact stripping details. It also provides examples in the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches Datadog logs with grep-like text filtering and lists actions (search/aggregate). It distinguishes from general siblings like traces or metrics, but does not differentiate from specific log-related siblings like logs_archives or logs_indexes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides guidance on actions, filters, time ranges, sampling modes, and the compact flag. However, it does not explicitly state when to use this tool versus other log-related tools (e.g., logs_archives, logs_indexes), which are present in sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logs_archivesA
Manage Datadog Logs archives (long-term log retention to S3 / GCS / Azure Blob). Actions: list, get, create, update, delete, reorder, get_order. Archives accept destinations of type 's3', 'gcs', or 'azure_storage'; per-provider credential and integration fields (S3 IAM role ARN, GCS service account, Azure tenant/secret) are forwarded unchanged. Mutations (create, update, delete, reorder) are blocked when the server is in read-only mode.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Archive ID (required for get/update/delete) | |
| config | No | Archive configuration (for create/update). Requires name, query, and destination with type ∈ { s3, gcs, azure_storage }. Provider credential / integration fields are forwarded unchanged. | |
| archive_ids | No | Ordered archive ID list (required for reorder) | |
| verbose | No | Return full SDK payload alongside summary (default false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses that mutations are blocked in read-only mode and that credential fields are forwarded unchanged. However, it lacks details on destructive behavior, authorization needs, idempotency, or error handling for a tool with multiple mutating actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: it opens with the overall purpose, enumerates actions and destination types, and ends with the read-only constraint. Every sentence provides necessary information without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-action tool with no output schema, the description fails to explain return values for actions like list or create (e.g., what the response contains, pagination, error codes). The verbose parameter hint is insufficient. This leaves agents uncertain about expected output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds context about destination types and credential forwarding, but the schema already provides similar information. No additional meaning beyond the schema is introduced.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog logs archives for long-term retention to cloud storage (S3, GCS, Azure Blob). It lists all supported actions (list, get, create, update, delete, reorder, get_order) and destination types, distinguishing it from sibling tools like logs, logs_indexes, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for managing log archives by listing actions and configuration requirements, but it does not explicitly state when to use this tool versus alternatives (e.g., indexes or pipelines) or provide caveats like prerequisites or system constraints.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logs_indexesA
Manage Datadog Logs indexes (filters, retention, exclusion filters, daily limits). Actions: list, get, update, reorder, get_order. Datadog identifies indexes by 'name', not 'id'. Note: create/delete are UI-only per Datadog and not supported through the API. Mutations (update, reorder) are blocked when the server is in read-only mode.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| name | No | Index name (required for get/update). Datadog identifies indexes by name, not id. | |
| config | No | Index configuration (for update). Requires filter.query and numRetentionDays. Exclusion filters are forwarded unchanged. | |
| index_names | No | Ordered index name list (required for reorder) | |
| verbose | No | Return full SDK payload alongside summary (default false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that mutations (update, reorder) are blocked in read-only mode and that create/delete are UI-only. It clarifies that Datadog identifies indexes by 'name' not 'id', aiding correct usage. However, it could explicitly mention that updates are mutating and may have side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is four sentences with clear structure: first sentence states purpose, second lists actions, third clarifies identifier, fourth notes constraints. No wasted words, front-loaded with essential information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description covers actions, parameters, and constraints, it lacks information about return values or output format for each action. With no output schema, the tool would benefit from brief hints (e.g., 'list returns an array of indexes'). The description is adequate but has a clear gap in explaining what each action returns.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds significant meaning: it notes that Datadog identifies indexes by 'name', not 'id'; for update, it specifies that 'config' requires filter.query and numRetentionDays, and that exclusion filters are forwarded unchanged. This goes well beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog Logs indexes, listing specific actions (list, get, update, reorder, get_order). It distinguishes from sibling tools like logs_archives and logs_pipelines by focusing specifically on index operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies the available actions and notes that create/delete are not supported via API, guiding the agent away from unsupported operations. It also warns that mutations are blocked when the server is in read-only mode, providing clear usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logs_pipelinesA
Manage Datadog Logs pipelines (parsing & processor chains). Actions: list, get, create, update, delete, reorder, get_order. Pipelines run sequentially on incoming logs; reorder changes the structure of downstream data. Mutations are blocked when the server is in read-only mode. Unknown processor types in 'config.processors' are forwarded to Datadog unchanged.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Pipeline ID (required for get/update/delete) | |
| config | No | Pipeline configuration (for create/update). Requires name and filter.query. Processors are forwarded unchanged. | |
| pipeline_ids | No | Ordered pipeline ID list (required for reorder) | |
| verbose | No | Return full SDK payload alongside summary (default false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It discloses read-only mode blocking mutations and forwarding of unknown processor types. Yet it omits details on success/error responses, pagination for list/get, and the impact of deletion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences immediately state purpose and actions. Every sentence adds unique information with no redundancy, making the description efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (7 actions, 5 params, nested objects) and lack of output schema, the description should clarify return values and error patterns. It covers basic behaviors but leaves gaps about list/get outputs and reordering side effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 5 parameters have schema descriptions (100% coverage), achieving baseline 3. The description adds value by stating that config requires 'name and filter.query' and that processors are forwarded unchanged, plus explaining the verbose parameter. This enriches parameter understanding beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Manage Datadog Logs pipelines (parsing & processor chains)' and lists all 7 actions (list, get, create, update, delete, reorder, get_order), clearly identifying the verb and resource. It distinguishes from sibling tools like logs_archives, logs_indexes, and logs by focusing on pipelines.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context: pipelines run sequentially, reorder changes downstream data, and mutations are blocked in read-only mode. However, it doesn't explicitly contrast with other logging tools or specify when to use this tool over alternatives like logs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
metricsA
Query Datadog metrics. Actions:
query: Get timeseries data (requires from/to time range, PromQL query)
search: Find metrics by name (grep-like, NO time param needed)
list: Get recently active metrics (last 24h, optionally filter by tag)
metadata: Get metric details (unit, type, description)
APM METRICS (auto-generated from traces): Keyed by OPERATION name (e.g. express.request, pg.query), NOT service name. Filter by service using tags: {service:my-service}
PERCENTILES (p50/p75/p90/p95/p99) — use the ROOT metric (distribution type): p95:trace.express.request{service:my-service}
AVG/SUM/MIN/MAX — use the .duration SUFFIX (pre-aggregated gauge): avg:trace.express.request.duration{service:my-service}
Other trace metrics (gauges):
trace..hits - Request count
trace..errors - Error count
trace..apdex - Apdex score
To discover operation names for a service, use: traces tool with action "services"
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| query | No | For query: PromQL expression (e.g., "avg:system.cpu.user{*}"). For search: grep-like filter on metric names. For list: tag filter. | |
| from | No | Start time (ONLY for query action). Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23) | |
| to | No | End time (ONLY for query action). Same formats as "from". | |
| metric | No | Metric name (for metadata action) | |
| tag | No | Filter by tag | |
| limit | No | Maximum number of results (for search/list, default: 50) | |
| pointLimit | No | Maximum data points per timeseries (for query action). AI controls resolution vs token usage (default: 1000). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden and thoroughly discloses behavioral traits: time range requirements, search as grep-like, list for recent 24h, metadata returns details. It also explains APM metrics structure (operation names, tags, suffixes for percentiles/avg). This is comprehensive transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but well-structured with clear sections (Actions, APM Metrics, Percentiles, etc.). It is front-loaded with the core action list. Every sentence provides essential information for a complex tool, earning its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 params, 4 actions, APM intricacies) and no output schema, the description is remarkably complete. It covers time formats, action-specific requirements, advanced metric types, and even links to sibling tool 'traces' for discovery.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, setting baseline at 3. The description adds meaning beyond schema by clarifying parameter semantics: e.g., 'query' parameter meaning depends on action, from/to are only for query, metric for metadata, default limits. This adds significant value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries Datadog metrics and lists four distinct actions (query, search, list, metadata) with specific use cases. It distinguishes from sibling tools (e.g., traces, logs) by focusing on metrics, providing purpose clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidelines for each action, including required parameters (e.g., from/to for query) and search behavior (grep-like, no time param). It also includes advanced usage for APM metrics and percentiles. However, it does not explicitly state when not to use this tool vs siblings, though it's largely implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
monitorsA
Manage Datadog monitors. Actions: list, get, search, create, update, delete, mute, unmute, top, history, preview, test_notification. Filters: name, tags, groupStates (alert/warn/ok/no data). get/create/update return the full options object so callers can safely read-then-patch.
create/update accept a config object validated against a typed schema covering the documented Datadog Monitor fields:
Top-level: name, type, query, message, tags, priority (1-5, nullable), restrictedRoles, multi, options.
options.* validated keys grouped by category:
notification: notifyNoData, noDataTimeframe, notifyAudit, notificationPresetName.
evaluation/delay: newHostDelay, newGroupDelay, evaluationDelay, requireFullWindow, onMissingData.
renotification: renotifyInterval (nullable), renotifyOccurrences, renotifyStatuses, escalationMessage.
lifecycle: timeoutH (nullable), includeTags, locked, silenced (record of timestamps/null), groupRetentionDuration.
thresholds: thresholds (critical/warning/ok/criticalRecovery/warningRecovery/unknown), thresholdWindows.
scheduling: schedulingOptions. Unknown keys (top-level or under options) are forwarded to Datadog as-is and surfaced via an optional warnings array on the response, so the schema does not lag the API. snake_case aliases are accepted on input and normalized to camelCase before validation. Validation errors short-circuit before any HTTP call and surface as 'EINVALID_MONITOR_CONFIG: : '. Reference: https://docs.datadoghq.com/api/latest/monitors/
top: Ranked monitors by alert frequency with real monitor names and context breakdown.
Returns: {rank, monitor_id, name (with {{template.vars}}), message (template), total_count, by_context}
Perfect for weekly/daily alert reports
Gets real monitor names from monitors API (not event titles)
WARNING: total_count is the raw alert-event count and INCLUDES renotifies/re-evaluations. For monitors stuck in Alert state, Datadog emits a renotify event every renotify_interval minutes, which inflates this count well beyond the number of real fires. When the question is "how many times did this monitor actually fire", use action=history instead.
history: Count and list real state transitions for one monitor over a time window.
Inputs: id (required, monitor ID), from/to (optional time range), transitionType (optional filter, defaults to ["alert","alert recovery"]), group (optional multi-alert group filter).
Returns: {transitions: [{timestamp, monitorId, monitorName, group, fromState, toState, transitionType, eventId}], count, meta}
count = transitions.length — the number of REAL state changes (fires + recoveries by default), NOT the renotify-inflated count returned by action=top or events action=search.
Backed by Datadog v2 events search with a hardcoded source:alert + @monitor.transition. transition_type filter that excludes renotifies by default. To include renotifies, pass transitionType including "renotify".
preview: Render a Datadog monitor message template against a context (read-only safe).
Inputs: either inline 'message' OR 'monitor_id' (or existing 'id'); plus optional 'context' { variables, conditionals }.
Supported syntax: {{variable.name}} substitution and conditional blocks {{#name}}...{{/name}} / {{^name}}...{{/name}} where name is one of: is_alert, is_warning, is_no_data, is_recovery, is_alert_to_warning, is_warning_to_alert.
Missing variables render as {{undefined:name}} markers and are reported in 'variablesMissing'.
Loops ({{#each ...}}) and partials ({{> ...}}) return EUNSUPPORTED_TEMPLATE_SYNTAX.
Allowed under --read-only (no mutation; at most a getMonitor load).
test_notification: KNOWN LIMITATION — always returns ENOT_SUPPORTED.
Datadog's public REST API exposes no monitor test-notification endpoint at v1 or v2 (audited against the official OpenAPI specs). The v1 SDK has no notifyMonitor / testMonitor method.
Allowed under --read-only because no Datadog HTTP call is attempted.
If Datadog publishes such an endpoint in future, this action will be reimplemented to invoke it.
Workaround: use the 'Test Notifications' button in the Datadog monitor UI.
For generic event grouping (deployments, configs), use events tool instead. Note that the events tool's action=search with source:alert ALSO includes renotifies; use its transitionType filter (or this action=history) for fires-only counts.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Monitor ID (required for get/update/delete/mute/unmute) | |
| query | No | Search query (for search action) | |
| name | No | Filter by name (for list action) | |
| tags | No | Filter by tags | |
| groupStates | No | Filter multi-alert monitors by group states (e.g., alert by host). Does NOT filter by overall monitor status. Values: alert, warn, no data, ok | |
| limit | No | Maximum number of monitors to return (default: 50) | |
| config | No | Monitor configuration (for create/update) | |
| message | No | Mute message (for mute action) OR inline template source for the preview action. For preview, supply either this inline string or `monitor_id` (or the existing `id` field) so the action can load the monitor message via getMonitor. | |
| end | No | Mute end timestamp (for mute action) | |
| monitor_id | No | Numeric monitor ID used by the preview action when no inline `message` is supplied. Equivalent to passing the existing `id` field as a numeric string. | |
| context | No | Substitution context for monitors.preview (variables + conditionals). | |
| from | No | Start time (ISO 8601, relative like "1h", or Unix timestamp) | |
| to | No | End time (ISO 8601, relative like "1h", or Unix timestamp) | |
| contextTags | No | Tag prefixes for context breakdown in top action (default: queue, service, ingress, pod_name, kube_namespace, kube_container_name) | |
| maxEvents | No | Maximum events to fetch for top action (default: 5000, max: 5000) | |
| transitionType | No | For history action: filter by monitor state transition types. Default: ["alert","alert recovery"] (real fires + recoveries, excludes renotifies). Pass ["alert"] for fires only, or include "renotify" for full chronological audit. | |
| group | No | For history action: filter transitions to a specific multi-alert monitor group (e.g., "pod_name:foo,kube_namespace:bar"). Optional; omit for all groups. | |
| dry_run | No | When create + dry_run=true, validate the monitor body via POST /api/v1/monitor/validate without creating it. Allowed under --read-only because no monitor is created. Returns { valid, dryRun, monitor }. 400 responses surface verbatim like a failed create. | |
| timezone | No | Optional IANA timezone (e.g. "UTC", "Europe/Paris"). When supplied on get/list, the response adds sibling createdLocal/modifiedLocal ISO 8601 strings next to created/modified. Omit for byte-identical legacy shape. Invalid zones return EINVALID_TIMEZONE. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so description fully discloses behaviors: read-then-patch pattern, validation errors, snake_case aliases, unknown key forwarding, supported template syntax, dry_run behavior, and known limitations. Very transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with sections for each action and front-loaded with top-level info. However, it is somewhat lengthy; could be streamlined without losing clarity. Still appropriate for complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 20 parameters, no output schema, and diverse actions, the description is remarkably complete. It covers all actions, parameter details, edge cases, mistakes, and references, leaving no major gaps for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but description adds extensive context beyond schema: details on config options categories, preview parameters, history transition types, top context breakdown, timezone behavior, and more. Adds significant value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Manage Datadog monitors' and enumerates specific actions (list, get, search, etc.), clearly distinguishing the tool's purpose from siblings like events. It specifies the resource and verbs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit guidance on when to use each action (e.g., use history for fires-only counts, top for renotify-inflated counts) and mentions alternative tools (events) for generic event grouping. Clearly states caveats like test_notification not supported.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
notebooksB
Manage Datadog Notebooks. Actions: list (search notebooks), get (by ID with cells), create (new notebook), update (modify notebook), delete (remove notebook). Use for: runbooks, incident documentation, investigation notes, dashboards as code.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Notebook ID (required for get/update/delete actions) | |
| query | No | Search query for notebooks | |
| authorHandle | No | Filter by author handle (email) | |
| excludeAuthorHandle | No | Exclude notebooks by author handle | |
| includeCells | No | Include cell content in response (default: true for get) | |
| name | No | Notebook name (for create/update) | |
| cells | No | Notebook cells (for create/update) | |
| time | No | Time configuration for notebook | |
| status | No | Notebook status | |
| pageSize | No | Number of notebooks to return | |
| pageNumber | No | Page number for pagination |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as idempotency, authorization requirements, rate limits, or side effects of create/update/delete actions. The description only lists actions without further detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences) and front-loaded with actions. Every sentence adds value: first sentence lists actions, second provides use cases. No redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 12 parameters including nested objects and no output schema. The description does not explain return values, pagination behavior, or action-specific details (e.g., required parameters per action). It is too brief for such a complex tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides descriptions for all 12 parameters (100% coverage). The tool description adds no additional parameter-level meaning beyond the schema, so it meets the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it manages Datadog Notebooks and lists specific actions (list, get, create, update, delete). It also provides example use cases (runbooks, incident documentation, investigation notes, dashboards as code), which differentiates it from sibling tools that manage other resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions use cases but does not explicitly state when to avoid using the tool or compare it to alternatives. Given the sibling tools (e.g., dashboards) manage similar resources, the lack of exclusion guidance leaves room for ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rumA
Query Datadog Real User Monitoring (RUM) data. Actions: applications (list RUM apps), events (search RUM events), aggregate (group and count events), performance (Core Web Vitals: LCP, FCP, CLS, FID, INP), waterfall (session timeline with resources/actions/errors). Use for: frontend performance, user sessions, page views, errors, resource loading.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| query | No | RUM query string (e.g., "@type:view @application.id:abc") | |
| from | No | Start time (ISO 8601, relative like "1h", "7d", or precise like "1d@10:00") | |
| to | No | End time (ISO 8601, relative like "now", or precise timestamp) | |
| type | No | RUM event type filter | |
| sort | No | Sort order for events | |
| limit | No | Maximum number of events to return (default: 50) | |
| groupBy | No | Fields to group by for aggregation (e.g., ["@view.url_path", "@session.type"]) | |
| compute | No | Compute configuration for aggregation | |
| metrics | No | Core Web Vitals metrics to retrieve (default: all). lcp=Largest Contentful Paint, fcp=First Contentful Paint, cls=Cumulative Layout Shift, fid=First Input Delay, inp=Interaction to Next Paint, loading_time=View loading time | |
| applicationId | No | Application ID for waterfall action | |
| sessionId | No | Session ID for waterfall action | |
| viewId | No | View ID for waterfall action (optional, filters to specific view) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries full burden. It describes the tool as querying data and performing actions like aggregate, performance, and waterfall, which suggests read-only behavior. However, it does not explicitly state idempotency, rate limits, or authentication requirements. The lack of contradiction with annotations is fine, but more detail on behavioral traits would improve transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: a single paragraph with a clear structure—first sentence defines purpose, then a bullet-like list of actions with brief explanations, finally a sentence on use cases. No redundant information, and every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 parameters, no output schema), the description provides a solid overview of actions and use cases. It explains each action's purpose and mentions key metrics (Core Web Vitals). However, it could be more complete by explicitly stating the tool is read-only and how to construct queries for different actions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds value by explaining actions (e.g., 'Core Web Vitals: LCP, FCP, CLS, FID, INP') and giving examples for query syntax. It also describes the 'waterfall' action as 'session timeline with resources/actions/errors', which provides context beyond the schema's parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool queries Datadog RUM data and lists specific actions with their purposes (e.g., 'applications (list RUM apps)', 'events (search RUM events)'). It distinguishes from sibling tools by focusing on frontend performance, user sessions, page views, errors, and resource loading, which are unique to RUM.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for usage: 'Use for: frontend performance, user sessions, page views, errors, resource loading.' It does not explicitly state when not to use or compare to alternatives, but the listed use cases and sibling tools (logs, metrics) imply the tool's domain.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
schemaA
Get valid enum values for Datadog API fields. Returns palettes, widget types, aggregators, comparators, time spans, and other valid values for constructing dashboards, monitors, metrics queries, and SLOs. Use this to discover valid options before creating or updating Datadog resources.
| Name | Required | Description | Default |
|---|---|---|---|
| resource | Yes | Datadog resource type to get schema for: dashboards, events, metrics, monitors, slos |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden. It correctly conveys that the tool is read-only and returns enum values. While it doesn't detail error handling or auth, the behavioral traits are sufficiently clear for a simple schema lookup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two sentences, front-loaded with the core purpose, and every sentence adds value. It is appropriately sized with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no output schema), the description provides sufficient context. It explains the purpose, usage timing, and examples of returned values, leaving little ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the parameter. The description adds value by detailing the types of valid values returned for each resource (e.g., palettes, aggregators), enhancing understanding beyond the raw enum list.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Get valid enum values for Datadog API fields.' It lists concrete examples (palettes, widget types, etc.) and distinguishes it from sibling tools that operate on specific resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises using the tool 'before creating or updating Datadog resources,' providing clear context for when to use it. It does not mention alternatives or when not to use it, which is acceptable given the tool's straightforward nature.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
securityB
Query Datadog Security Monitoring. Actions: rules (list detection rules), signals (search security signals), findings (list security findings). Use for: threat detection, compliance, security posture, incident investigation.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Rule or signal ID (for specific lookups) | |
| query | No | Search query for signals or findings | |
| from | No | Start time (ISO 8601, relative like "1h", "7d") | |
| to | No | End time (ISO 8601, relative like "now") | |
| severity | No | Filter by severity | |
| status | No | Filter signals by status | |
| pageSize | No | Number of results to return | |
| pageCursor | No | Cursor for pagination |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must convey behavioral traits. It only says 'Query', implying read-only, but doesn't confirm mutability, rate limits, or permissions. The description is insufficient for a tool with multiple actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is concise (two sentences) and front-loads the core purpose. However, it could better organize the action list and use cases for faster parsing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Lacks details on return values, pagination behavior, or required permissions. Given no output schema, the description should provide more context for an agent to correctly interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so parameters are well-documented in the schema. The description does not add extra meaning beyond what the schema already provides, meeting the baseline but not exceeding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it queries Datadog Security Monitoring and lists three specific actions (rules, signals, findings), distinguishing it from sibling tools that focus on other areas like logs or metrics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides use cases (threat detection, compliance, etc.) but no explicit guidance on when not to use this tool or how it compares to alternatives like 'logs' or 'monitors'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
slosB
Manage Datadog Service Level Objectives. Actions: list (with SLI status & error budget), get, create, update, delete, history. SLO types: metric-based, monitor-based. Each list/get/create/update response includes a url field deep-linking to the Datadog UI. Use for: reliability tracking, error budgets, SLA compliance, performance targets.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | SLO ID (required for get/update/delete/history) | |
| ids | No | Multiple SLO IDs (for list with specific IDs) | |
| query | No | Search query (for list) | |
| tags | No | Filter by tags (for list) | |
| limit | No | Maximum number of SLOs to return (default: 50) | |
| config | No | SLO configuration (for create/update). Must include type, name, thresholds. | |
| from | No | Start time for history (ISO 8601 or relative like "7d", "1w") | |
| to | No | End time for history (ISO 8601 or relative, default: now) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It mentions that responses include a 'url' field and lists SLO types, but lacks details on destructive actions (e.g., delete irreversibility), permissions, or rate limits. This is insufficient for a tool with create/update/delete actions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (two sentences) and front-loaded with key actions and types. Every sentence contributes meaningful information, making it efficient for the agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema and the complexity of 9 parameters, the description covers basic functionality (actions, types, URL field) but lacks details on error handling, idempotency, or partial update behavior. It is adequate but not fully comprehensive for a multi-action tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds marginal value by noting that list includes SLI status and error budget, but does not significantly enhance understanding beyond the schema. Baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages SLOs and lists specific actions (list, get, create, etc.) and SLO types. It distinguishes the tool within the broader Datadog domain, but does not explicitly differentiate from sibling tools beyond the subject matter.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides use cases like 'reliability tracking, error budgets, SLA compliance, performance targets,' giving context. However, it does not specify when to avoid using this tool or mention alternative tools for similar tasks, leaving the agent without clear guidance on selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
syntheticsA
Manage Datadog Synthetic tests (API and Browser). Actions: list, get, create, update, delete, trigger, results. Use for: uptime monitoring, API testing, user journey testing, performance testing, canary deployments.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Test public ID (required for get/update/delete/trigger/results) | |
| ids | No | Multiple test IDs (for bulk trigger) | |
| testType | No | Test type filter (for list) or type for create | |
| locations | No | Filter by locations (for list) | |
| tags | No | Filter by tags (for list) | |
| limit | No | Maximum number of tests to return (default: 50) | |
| config | No | Test configuration (for create/update). Includes: name, type, config, options, locations, message. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, and the description only lists actions without disclosing behavioral traits such as destructiveness of delete/update, rate limits, or side effects. The agent is left to infer behavior from action names alone, which is insufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with one sentence and a list of use cases. Every part contributes value, though the list could be integrated into a more structured format. No redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, no output schema, and moderate complexity, the description covers purpose and use cases but lacks behavioral details and return value information. It is adequate but leaves gaps for an agent to function optimally.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with each parameter having a description. The description adds no additional meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it manages Datadog Synthetic tests, listing all supported actions and specific use cases like uptime monitoring and canary deployments. This differentiates it from sibling tools like monitors or dashboards by focusing on synthetic tests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly mentions use cases (uptime monitoring, API testing, etc.), giving clear context for when to use this tool. However, it does not provide when-not-to-use guidance or explicitly compare with alternatives, but the listed use cases are sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tagsA
Manage Datadog host tags. Actions: list (all host tags), get (tags for specific host), add (create tags), update (replace tags), delete (remove all tags). Use for: infrastructure organization, filtering, grouping.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| hostName | No | Host name (required for get/add/update/delete actions) | |
| tags | No | Tags to add or set (for add/update actions). Format: "key:value" | |
| source | No | Source of the tags (e.g., "users", "datadog"). Defaults to "users" |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden. It lists actions and their effects but does not disclose details like tag persistence, source behavior, or deletion reversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences efficiently convey purpose, actions, and use case. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Fairly complete for a CRUD tool: actions cover main operations. Missing details like response format or error handling, but adequate given no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all parameters. The description adds no new meaning beyond the schema; it only repeats the action names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog host tags and enumerates five specific actions (list, get, add, update, delete). This distinguishes it from sibling tools that manage other Datadog resources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes 'Use for: infrastructure organization, filtering, grouping' which gives clear usage context. However, it does not explicitly exclude scenarios or mention alternatives, leaving some gaps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
teamsB
Manage Datadog teams. Actions: list (with filters), get (by ID), members (list team members). Use for: team organization, access management, collaboration.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | Team ID (required for get/members actions) | |
| filter | No | Filter teams by name | |
| pageSize | No | Number of teams to return per page | |
| pageNumber | No | Page number for pagination |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only lists read-like actions (list, get, members) without explicitly stating that the tool performs only read operations or disclosing any behavioral traits like authorization requirements, rate limits, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise, consisting of two sentences that front-load the action list and usage context with no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters and no output schema, the description provides adequate high-level information but lacks details about return format, pagination behavior, or how errors are handled. It is minimally complete for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% coverage, so the baseline is 3. The description adds value by grouping parameters to actions (e.g., 'list (with filters)', 'get (by ID)'), which helps the agent understand which parameters apply to each action.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog teams and enumerates three actions (list, get, members). It is specific enough to distinguish from sibling tools like 'users' or 'dashboards', but does not explicitly state that it does not support create/update/delete operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides usage context ('Use for: team organization, access management, collaboration') but does not specify when not to use the tool or mention alternative tools for other team management operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tracesA
Analyze APM traces for request flow and latency debugging. Actions: search (find spans), aggregate (group stats), services (list APM services). Key filters: minDuration/maxDuration ("500ms", "2s"), httpStatus ("5xx", ">=400"), status (ok/error), errorMessage (grep). APM METRICS: Traces auto-generate metrics in trace..* namespace (e.g. trace.express.request). Use metrics tool to query: avg:trace.express.request.duration{service:my-service}. For percentiles (p95), use the root metric WITHOUT .duration suffix: p95:trace.express.request{service:my-service}
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| query | No | APM trace search query (Datadog syntax). Example: "@http.status_code:500", "service:my-service status:error" | |
| from | No | Start time. Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23, yesterday@14:00) | |
| to | No | End time. Same formats as "from". Example: from="3d@11:45" to="3d@12:55" | |
| service | No | Filter by service name. Example: "my-service", "postgres" | |
| operation | No | Filter by operation name. Example: "express.request", "mongodb.query" | |
| resource | No | Filter by resource name (endpoint/query). Supports wildcards. Example: "GET /api/*", "*orders*" | |
| status | No | Filter by span status - "ok" for successful, "error" for failed spans | |
| env | No | Filter by environment. Example: "production", "staging" | |
| minDuration | No | Minimum span duration (find slow spans). Examples: "1s", "500ms", "100ms" | |
| maxDuration | No | Maximum span duration. Examples: "5s", "1000ms" | |
| httpStatus | No | HTTP status code filter. Examples: "500", "5xx" (500-599), "4xx" (400-499), ">=400" | |
| errorType | No | Filter by error type (grep-like). Example: "TimeoutError", "ConnectionRefused" | |
| errorMessage | No | Filter by error message (grep-like). Example: "timeout", "connection refused" | |
| limit | No | Maximum number of results (default: 50) | |
| sort | No | Sort order | |
| groupBy | No | Fields to group by (for aggregate). Example: ["resource_name", "status"] |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It reveals that traces auto-generate metrics in a specific namespace, which is a behavioral trait. However, it does not disclose whether the tool is read-only, rate limits, or authentication requirements. The description adds some context but is not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is informative but somewhat lengthy; it front-loads the purpose and actions, then provides filter examples and APM metrics guidance. Most sentences add value, though the APM metrics section could be more concise. Overall, it is structured well with clear sections.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 17 parameters and no output schema, the description covers actions, filter details, and includes a crucial note about auto-generated metrics and percentile querying. This provides a comprehensive understanding of the tool's capabilities and relationships with other tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with every parameter having a description. The description adds value by providing examples and format details for parameters like 'from' and 'to' (ISO 8601, relative), 'httpStatus', and 'minDuration'. This goes beyond the basic schema, earning a score above the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Analyze APM traces for request flow and latency debugging.' It lists specific actions (search, aggregate, services) and resources (traces). This differentiates it from sibling tools like logs, metrics, etc., which handle different data types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use this tool: for APM trace analysis, with key filters for latency and status. It explicitly directs users to the metrics tool for percentile queries, offering an alternative. However, it does not explicitly state when not to use it or provide exclusions for specific scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
usageA
Query Datadog usage metering data. Actions: summary (overall usage), hosts (infrastructure), logs, custom_metrics, indexed_spans, ingested_spans. Use for: cost management, capacity planning, usage tracking, billing analysis.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform: summary (overall usage), hosts, logs, custom_metrics, indexed_spans, ingested_spans | |
| from | No | Start time (ISO 8601 date like "2024-01-01", or relative like "30d") | |
| to | No | End time (ISO 8601 date like "2024-01-31", or relative like "now") | |
| includeOrgDetails | No | Include usage breakdown by organization (for multi-org accounts) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral traits such as authentication requirements, rate limits, or side effects. It only indicates read-only query behavior, but adequate transparency for a simple query tool would still benefit from such details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two sentences that front-load the verb and resource, then enumerate actions and use cases efficiently. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema or annotations, the description provides adequate context for purpose and usage but lacks detail on return format, error handling, or data scoping. It is minimally complete for a straightforward query tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and descriptions already exist for all parameters. The description reiterates the enum values for action but adds no significant new meaning beyond the schema, resulting in a baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it queries Datadog usage metering data and lists specific actions (summary, hosts, logs, etc.), distinguishing it from sibling tools focused on other Datadog features.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly mentions use cases (cost management, capacity planning, usage tracking, billing analysis), providing context for when to use this tool. It does not explicitly state when not to use it, but the sibling list offers implicit differentiation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
usersB
Manage Datadog users. Actions: list (with filters), get (by ID). Use for: access management, user auditing, team organization.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Action to perform | |
| id | No | User ID (required for get action) | |
| filter | No | Filter users by name or email | |
| status | No | Filter by user status | |
| pageSize | No | Number of users to return per page | |
| pageNumber | No | Page number for pagination |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It indicates only read actions (list, get), implying non-destructive use. However, it does not detail authentication requirements, rate limits, or output format. The description is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and front-loads the key purpose. It is concise, though the second sentence could be more tightly integrated. No unnecessary words, but minor redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema is provided, and the description does not explain the return format, making it less complete for an agent. Pagination parameters exist but are not contextualized. For a read-only tool with pagination, additional details about default page size or output structure would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains all parameters. The description adds no new semantic detail beyond restating the action options. It meets the baseline but provides no extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages Datadog users and lists specific actions (list and get). It differentiates from siblings like 'auth' (authentication) and 'teams' (team management), though not explicitly stating alternatives. The verb 'Manage' is somewhat broad given only read actions are available, but the action list clarifies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description suggests use cases ('access management, user auditing, team organization') but does not explicitly state when to use this tool versus alternatives like 'teams'. No when-not-to-use guidance is provided, but the use cases imply appropriate contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a distinct Datadog domain (e.g., dashboards, monitors, logs, metrics) with clear description boundaries. Overlaps are minimal and intentional (e.g., events vs monitors for alert data), with descriptions providing enough detail to disambiguate.
All tool names are lowercase, single-word nouns (e.g., dashboards, downtimes, logs_archives) with no mixing of verb_noun or camelCase. The naming is uniform and predictable across the entire set.
23 tools is slightly above the typical 3-15 ideal range, but for a comprehensive monitoring platform like Datadog, each tool corresponds to a major functional area and contributes meaningful value. No tool feels extraneous.
The tool surface covers nearly all major Datadog features (auth, dashboards, monitors, logs, metrics, APM, RUM, security, etc.). Minor omissions like network performance monitoring or service maps exist, but core workflows are well-supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Open-source agent that observes and fixes your application. Query logs, traces, metrics, incidents.
AI agent observability for production traces, natural-language insights, and improvement loops.
Data + AI observability — monitor and troubleshoot production-grade agents and the context they use.
Query application logs, traces, and metrics from your AI coding assistant via Foam's MCP server.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with DataDog's observability platform through a standardized interface. Supports monitoring infrastructure, managing events, analyzing logs and metrics, and automating operations like alerts and downtimes.1MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to query and manage Datadog observability data including metrics, logs, traces, and monitors through natural language. Supports read-only operations by default for security.MIT
- FlicenseBqualityDmaintenanceEnables AI assistants to interact with Datadog APIs for querying metrics, logs, events, monitors, and APM traces.164
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Datadog's observability platform via natural language, covering metrics, logs, APM, monitors, dashboards, incidents, and infrastructure.1,1061MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/TANTIOPE/datadog-mcp-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server