Datadog MCP Server
Provides read-only access to Datadog API for searching logs, querying metrics, listing monitors, searching traces, managing hosts, exploring dashboards, listing events, and handling incidents.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Datadog MCP ServerFind errors in the checkout service in the last 30 minutes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Datadog MCP Server
A read-only Model Context Protocol server that connects to the Datadog API, enabling natural-language investigation workflows through Claude Desktop, Claude Code, or any MCP client.
Scan logs for errors, identify problematic services, query metrics, explore monitors/dashboards/traces — all through conversation.
Setup
npm install
npm run buildRequires three environment variables:
Variable | Required | Default | Description |
| Yes | — | API Key — identifies your Datadog organization. Found in Organization Settings → API Keys. |
| Yes | — | Application Key — tied to a specific user account and grants that user's read permissions. Create one in Organization Settings → Application Keys. |
| No |
| Datadog site (e.g. |
Related MCP server: Datadog MCP Server
MCP Client Configuration
Claude Code
claude mcp add datadog -- node /path/to/datadog/build/index.jsThen set DD_API_KEY and DD_APP_KEY in the environment where Claude Code runs.
Claude Desktop
Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json):
{
"mcpServers": {
"datadog": {
"command": "node",
"args": ["/path/to/datadog/build/index.js"],
"env": {
"DD_API_KEY": "your-api-key",
"DD_APP_KEY": "your-app-key"
}
}
}
}MCP Inspector (for testing)
DD_API_KEY=xxx DD_APP_KEY=yyy npx @modelcontextprotocol/inspector build/index.jsTools
Logs
Tool | Description |
| Search logs with structured filters ( |
Metrics
Tool | Description |
| Query timeseries data (e.g. |
| Search available metric names by prefix. |
Monitors
Tool | Description |
| List monitors filtered by name, tags, status, or type. |
| Get full monitor details including query, message, and thresholds. |
| Full-text search across monitor names, queries, and messages. |
Traces / APM
Tool | Description |
| Search APM spans by service, operation, environment, status, or duration. |
Hosts
Tool | Description |
| List infrastructure hosts with CPU, load, and IOWait metrics. |
| Get counts of active and up hosts. |
Dashboards
Tool | Description |
| List dashboards with optional title search. |
| Get dashboard details including all widgets and their queries. |
Events
Tool | Description |
| Search events (deploys, alerts, etc.) with cursor pagination. |
Incidents
Tool | Description |
| List incidents with optional search. |
| Get incident details including severity, status, and timeline. |
Time Parameters
All time parameters accept relative strings or ISO 8601:
Format | Example | Meaning |
Minutes |
| 15 minutes ago |
Hours |
| 4 hours ago |
Days |
| 7 days ago |
Weeks |
| 2 weeks ago |
Now |
| Current time |
ISO 8601 |
| Exact timestamp |
Example Prompts
"What errors have occurred in the last hour?"
"Show me CPU usage for production hosts over the past day"
"Which monitors are currently alerting?"
"Search for traces with errors in the checkout service"
"List recent deploy events"
Development
npm run dev # watch mode — recompiles on change
npm run build # one-time build
npm start # run the serverThis server is read-only — no write or mutate operations are exposed, making it safe for production investigation.
Available Tools
14 toolsget_dashboardA
Get full details of a Datadog dashboard including widgets, queries, and layout.
| Name | Required | Description | Default |
|---|---|---|---|
| dashboardId | Yes | The dashboard ID (e.g. 'abc-def-ghi') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. 'Get' implies a non-destructive read and it discloses the returned content (widgets, queries, layout), but it says nothing about authorization requirements, rate limits, or behavior when the dashboard ID does not exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the verb and resource first and the returned contents second. No filler or redundant restatement of the name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description covers both purpose and return shape adequately. It stops short of noting error behavior for invalid IDs or any prerequisite, which keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the sole dashboardId parameter is fully documented with a format example in the schema. The description adds no format or syntax detail beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Get) and resource (Datadog dashboard), and enumerates the returned scope: widgets, queries, layout. The singular 'a dashboard' implicitly separates it from the sibling list_dashboards, though it never names that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: use this to fetch one dashboard when you already have its ID. There is no explicit when-to-use, when-not-to-use, or reference to the list_dashboards alternative for discovery.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_host_totalsB
Get total counts of active and up hosts in Datadog.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Only count hosts alive since this time | 2h |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the high-level output but does not mention read-only safety, permissions, rate limits, side effects, or return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence that is front-loaded with the action and resource. There is no wasted wording, making it appropriately sized for the amount of information provided.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only count tool with no annotations or output schema, the description is minimally adequate. However, it omits important context such as the time-window behavior implied by the 'from' parameter and the structure of the returned counts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single 'from' parameter, so the schema already documents it fully. The description adds no additional meaning or format details beyond what the schema provides, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Get total counts of active and up hosts in Datadog.' Clear on what it does, but does not distinguish itself from the sibling list_hosts tool, which also deals with hosts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives no guidance on when to use this tool versus alternatives such as list_hosts. There is no context about when a count is preferable to a full host listing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_incidentA
Get full details of a specific Datadog incident by ID.
| Name | Required | Description | Default |
|---|---|---|---|
| incidentId | Yes | The incident ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Get' implies a read-only retrieval and 'full details' signals return completeness, but it does not disclose auth requirements, error behavior for invalid IDs, or rate limits. Adequate for a simple read tool but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence with zero waste, and the key information is front-loaded. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one fully documented input parameter and no output schema. 'Full details' gives a general sense of the return, but without an output schema the description could clarify what details are returned. It is sufficient to call correctly but leaves minor gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter has 100% schema description coverage, so the schema fully documents it. The description repeats 'by ID' but adds no extra meaning such as ID format or constraints; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (Get), resource (Datadog incident), and scope (full details by ID). It clearly differentiates from list_incidents by emphasizing a specific incident, though it does not explicitly name siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: call this when you have an incident ID and need full details. There is no explicit when-to-use, when-not-to-use, or named alternative such as list_incidents, so the guidance is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_monitorA
Get full details for a specific Datadog monitor by ID, including query, message, thresholds, and options.
| Name | Required | Description | Default |
|---|---|---|---|
| monitorId | Yes | The monitor ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. 'Get' plus the field list makes the read-only, retrieval nature reasonably clear, but it says nothing about auth/permission requirements, error behavior for invalid IDs, or rate limits relevant to the Datadog API.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the key noun (monitor) and the lookup key (ID) plus the returned payload are all stated up front.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with no output schema, listing the returned fields (query, message, thresholds, options) usefully previews the response shape. Only the ID-acquisition path and error semantics are left uncovered, which are minor for this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter with 100% schema description coverage, so the schema already documents monitorId. The description's 'by ID' adds no format, type, or range detail beyond the schema (e.g., whether IDs can be strings), so it does not compensate further.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Get') and resource ('Datadog monitor'), scoped to a single monitor by ID, and enumerates the returned payload (query, message, thresholds, options). This implicitly contrasts with list_monitors and search_monitors, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'by ID' implies usage when a monitor ID is already known, but there is no explicit when-to-use guidance, no when-not-to-use, and no pointer to list_monitors/search_monitors as the way to obtain an ID. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dashboardsC
List Datadog dashboards with optional search filtering.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Max dashboards to return | |
| query | No | Search query to filter dashboards by title | |
| start | No | Starting offset |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'List' implies a read-only operation, but it says nothing about pagination behavior despite start/count parameters, nor about permissions or result limits. A read tool with pagination params that never mentions paging is a meaningful transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with the resource front-loaded and no filler. It earns its place, though it is arguably too terse given the pagination parameters left unaddressed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with a fully documented schema and no output schema, this is minimally adequate. However, the pagination contract (start/count defaults) and the distinction from get_dashboard are left entirely to inference, so it is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (count, query, start) are already documented in the schema. The description's 'optional search filtering' loosely echoes the query param but adds no format, syntax, or semantics beyond what the schema provides. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List Datadog dashboards') and adds scope via 'optional search filtering.' It is distinguishable from the get_dashboard sibling by virtue of the list verb, though it does not explicitly name or contrast with siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance beyond the implied 'listing' semantics. It does not mention when to prefer get_dashboard for a single dashboard or how it relates to other list/search tools in the same namespace. The word 'optional' hints that filtering is not required but no conditions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_eventsC
Search Datadog events (deploys, alerts, comments, etc.) with filtering.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: relative or ISO 8601 or 'now' | now |
| from | No | Start time: relative (1h, 1d, 7d) or ISO 8601 | 1d |
| tags | No | Comma-separated tags to filter by | |
| limit | No | Max events to return | |
| query | No | Search query for events. E.g. 'sources:deploy', 'tags:env:prod' | |
| cursor | No | Pagination cursor from previous response | |
| source | No | Filter by event source | |
| priority | No | Filter by event priority |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only search but never states that, nor does it mention pagination behavior, result caps (limit max 1000), default time window, or rate limits — all relevant for an event query tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with no wasted words, front-loading the action and resource. It is arguably too terse for an 8-parameter tool, but nothing in it is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter query tool with no annotations and no output schema, the description is thin: it does not explain how query, tags, source, and priority interact, nor default behavior or pagination. The schema covers parameters, but the description leaves overall usage context incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all eight parameters (from/to/tags/limit/query/cursor/source/priority) are documented in the schema. The description adds no syntax or interaction detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search Datadog events') and clarifies scope with concrete examples (deploys, alerts, comments). It does not explicitly differentiate itself from siblings like search_logs or search_traces, but the resource is distinct enough to be actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no when-to-use guidance, no prerequisites, and no mention of alternatives among the many siblings (search_logs, search_traces, list_metrics). 'With filtering' hints at use but leaves selection entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_hostsC
List Datadog infrastructure hosts with status, CPU, load, and IOWait metrics.
| Name | Required | Description | Default |
|---|---|---|---|
| from | No | Only show hosts alive since this time | 2h |
| count | No | Number of hosts to return | |
| start | No | Starting offset for results | |
| filter | No | Filter string for host search | |
| sortDir | No | Sort direction | |
| sortField | No | Field to sort by |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It reveals what data is returned but says nothing about whether this is a read-only operation, default time window behavior, pagination limits (count max 1000), or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. Every clause ('Datadog infrastructure hosts' and the metric list) earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a read-only list tool with no annotations, no output schema, and six parameters. The description omits pagination, filtering, sorting, and the time window, all of which are needed to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description mentions CPU, load, and IOWait, which correspond to the sortField enum but adds no details about the parameters themselves.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List Datadog infrastructure hosts' and enumerates the metrics returned (status, CPU, load, IOWait). It clearly distinguishes from most siblings, which operate on different resources, but does not explicitly contrast with get_host_totals, a closely related host tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not-to-use guidance. The description does not mention pagination (count/start), the 'from' window, or filtering, nor does it point to get_host_totals for aggregate counts, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_incidentsC
List Datadog incidents with optional search filtering.
| Name | Required | Description | Default |
|---|---|---|---|
| query | No | Search query to filter incidents | |
| pageSize | No | Results per page | |
| pageOffset | No | Page offset |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read operation but says nothing about pagination behavior, defaults, result limits, ordering, auth requirements, or rate limits — notable given the presence of pageSize/pageOffset parameters with defaults.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is efficient, though arguably sparse enough that it leans toward under-specification rather than tight conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-parameter read tool with full schema coverage and no output schema, the description is minimally adequate. However, with zero annotations it should say more about pagination defaults and read-only semantics to be fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so query, pageSize, and pageOffset are already documented in the schema. The description's phrase 'optional search filtering' loosely maps to query but adds no syntax, format, or behavior beyond what the schema states; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List Datadog incidents') plus the optional filtering capability, so an agent knows exactly what the tool returns. It doesn't explicitly distinguish itself from siblings like get_incident or search_monitors, but the list-vs-get contrast is inferable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus get_incident (single incident) or when the query filter is appropriate. The word 'optional' hints that unfiltered listing is valid, but no conditions, exclusions, or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_metricsA
Search available Datadog metric names. Useful for discovering what metrics exist before querying.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | Search string for metric names. E.g. 'system.cpu', 'aws.ec2' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only search but says nothing about result caps, pagination, or how many names are returned, which matters for a discovery tool that could return thousands of metrics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero padding, with the core purpose front-loaded ahead of the workflow hint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with a fully documented schema and no output schema, the description is minimally sufficient. It leaves the behavioral surface (result limits, whether matching is prefix/substring) entirely unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single 'query' parameter is documented with concrete examples ('system.cpu', 'aws.ec2'). The description adds no syntax or matching-behavior detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (search) and resource (Datadog metric names), which clearly separates it from query_metrics and the monitor/host/dashboard siblings. It does not explicitly name a sibling, but the resource is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear usage context: discovery of metric names prior to querying. That is the correct mental model for this tool. It stops short of naming query_metrics explicitly or stating when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_monitorsB
List Datadog monitors with optional filtering by name, tags, status, or type.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Filter monitors by name (substring match) | |
| page | No | Page number (0-indexed) | |
| tags | No | Comma-separated tags to filter by. E.g. 'env:prod,team:backend' | |
| type | No | Filter by monitor type (e.g. 'metric alert', 'service check') | |
| status | No | Filter by monitor status | |
| pageSize | No | Results per page |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, yet it discloses nothing about pagination behavior, result caps, rate limits, or what a listing returns. For a paginated list tool with zero annotation coverage, that is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the resource and its filter surface with no filler or redundancy. Nothing could be removed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With six parameters, no output schema, and no annotations, the description covers the filtering surface but omits pagination semantics, defaults, and any hint of the response shape. It is minimally adequate but leaves the agent to consult the schema for the rest.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter (including page and pageSize) is already documented in the schema. The description only restates the filter fields and adds no syntax or format detail beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('List Datadog monitors') plus the filterable fields, so the purpose is immediately clear. However, it does not distinguish itself from the sibling tools search_monitors or get_monitor, leaving the agent to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states that filtering is optional but gives no when-to-use guidance, no exclusions, and never mentions when to prefer search_monitors or get_monitor over this tool. The agent must guess the intended scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_metricsA
Query Datadog timeseries metrics. Returns summary statistics (avg, min, max, latest) per series.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: relative or ISO 8601 or 'now' | now |
| from | No | Start time: relative (15m, 1h, 1d) or ISO 8601 | 1h |
| query | Yes | Datadog metric query. E.g. 'avg:system.cpu.user{env:prod} by {host}' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the return shape (summary statistics per series: avg, min, max, latest), which is useful since there's no output schema. However, it omits safety profile (read-only by nature of 'query' but not stated), rate limits, or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with zero waste, front-loading the purpose and then the return format. No unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only query tool with full schema descriptions, the purpose and return shape are covered. But the absence of any usage context relative to siblings and lack of behavioral notes leaves it adequate but with clear gaps for a tool in a crowded namespace.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters including examples. The description adds no extra parameter guidance beyond what's in the schema, making baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Query) and resource (Datadog timeseries metrics), and the second sentence clarifies the output shape. Easily distinguished from siblings like list_metrics or search_traces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no mention of alternatives despite many sibling tools, and no note that this is for numeric timeseries rather than metadata listing. The agent must infer usage entirely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_logsA
Search Datadog logs with structured filters or raw query. Returns log entries with timestamp, service, status, host, and message.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: relative or ISO 8601 or 'now' | now |
| env | No | Filter by environment (e.g. prod, staging) | |
| from | No | Start time: relative (15m, 1h, 1d, 7d) or ISO 8601 | 15m |
| host | No | Filter by host name | |
| sort | No | Sort order (- prefix for descending) | -timestamp |
| limit | No | Max logs to return | |
| query | No | Raw Datadog log query (overrides structured filters). E.g. 'service:web-api status:error' | |
| cursor | No | Pagination cursor from previous response | |
| source | No | Filter by log source | |
| status | No | Filter by log status/level | |
| message | No | Free-text search in log message | |
| service | No | Filter by service name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It helpfully enumerates the returned fields (timestamp, service, status, host, message), which compensates for the absent output schema, but omits pagination behavior (cursor), result defaults, and any rate-limit or auth context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and result set, with zero filler. Every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter read tool with no annotations and no output schema, the description covers purpose and return fields but leaves pagination, default time-window behavior, and query-vs-filter precedence unexplained. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented in the schema. The description adds no syntax or format details beyond that, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (Search) and resource (Datadog logs) and states the two supported modes (structured filters or raw query). It clearly distinguishes from siblings like search_traces and search_monitors, though it does not explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the phrasing 'structured filters or raw query,' but there is no explicit when-to-use, when-not-to-use, or routing guidance versus sibling search tools. Notably, it does not clarify the precedence rule that a raw query overrides structured filters, which the schema alone mentions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_monitorsA
Full-text search across Datadog monitors. Searches name, query, tags, and message.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number (0-indexed) | |
| query | Yes | Search query string | |
| perPage | No | Results per page |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden but only identifies the search scope. It omits read-only/non-destructive behavior, pagination behavior, auth/rate limits, and result format, so an agent gets little beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action and scope. No filler; every clause contributes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-parameter search tool with full schema coverage, the description covers the essential search behavior. However, with no annotations or output schema, it omits pagination/result-return context and sibling-routing guidance, leaving it minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so page/perPage and query are documented. The description adds meaningful detail for the query parameter by naming the fields searched (name, query, tags, message), which is not in the schema, though it adds nothing for pagination.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (full-text search) and resource (Datadog monitors), and its scope (name, query, tags, message) distinguishes it from list_monitors/get_monitor. An agent can identify it as the text-search tool without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance or alternatives are given. It does not say to prefer this over list_monitors for text queries or mention any prerequisites, leaving selection to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_tracesA
Search Datadog APM traces/spans with structured filters or raw query. Returns span details with service, resource, duration, and status.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | End time: relative or ISO 8601 or 'now' | now |
| env | No | Filter by environment | |
| from | No | Start time: relative (15m, 1h, 1d) or ISO 8601 | 15m |
| sort | No | Sort order (timestamp ascending or descending) | -timestamp |
| limit | No | Max spans to return | |
| query | No | Raw span query (overrides structured filters). E.g. 'service:web-api @http.status_code:500' | |
| status | No | Filter by span status | |
| service | No | Filter by service name | |
| operation | No | Filter by operation/resource name | |
| minDuration | No | Minimum duration filter. E.g. '1s', '500ms' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses the return fields (service, resource, duration, status), but omits read-only nature, pagination, rate limits, and other side-effect information, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose and return details, with no redundant or filler content. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter tool with no output schema and no annotations, the description provides a clear purpose and lists returned fields, while the schema fully documents all parameters. It lacks behavioral guidance and alternative tool selection, but is otherwise fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 10 parameters are fully documented in the schema. The description only generically mentions 'structured filters or raw query' without adding parameter-specific meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Search) and resource (Datadog APM traces/spans), clearly distinguishing it from sibling tools like search_logs and query_metrics. It also mentions the two input modes (structured filters or raw query) and the returned fields.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context that this tool is for searching APM traces/spans, with structured filters or raw query. However, it does not name alternative tools or specify when-not to use this tool, leaving sibling selection to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
14 tool updates
v1.0.0- First observed
get_dashboard - First observed
get_host_totals - First observed
get_incident - First observed
get_monitor - First observed
list_dashboards - First observed
list_events - First observed
list_hosts - First observed
list_incidents - First observed
list_metrics - First observed
list_monitors - First observed
query_metrics - First observed
search_logs - First observed
search_monitors - First observed
search_traces
TDQS
Scored across 14 tools
Tools target distinct Datadog resources (metrics, monitors, traces, logs, hosts, dashboards, events, incidents), so overlap is low. Minor ambiguity between list_monitors and search_monitors, since both can retrieve monitors with filtering.
Mostly consistent verb_noun style: list_*, get_*, search_*, query_*. The deviation is get_host_totals, which is noun-first rather than get_host_total/host resource style, but overall naming is readable and predictable.
14 tools is well-scoped for a Datadog observability surface. Each tool covers a distinct Datadog domain and earns its place without excessive redundancy.
The server provides strong read/search coverage across metrics, monitors, traces, logs, hosts, dashboards, events, and incidents. However, it is almost entirely read-only: there are no create, update, delete, mute, or incident management operations, leaving notable lifecycle gaps.
Maintenance
Related MCP Connectors
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
Query OneLens cloud-cost data in natural language: breakdowns, trends, cost centers. Read-only.
Ask data questions in natural language. Get SQL, insights, and charts from your databases.
Ask business questions in plain English. Get instant answers from your database, no SQL needed.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to query and manage Datadog observability data including metrics, logs, traces, and monitors through natural language. Supports read-only operations by default for security.MIT
- AlicenseNot gradedqualityDmaintenanceEnables interaction with Datadog APIs through natural language, supporting full CRUD operations on metrics, monitors, dashboards, logs, infrastructure, and more.4MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI assistants to interact with Datadog's observability platform via natural language, covering metrics, logs, APM, monitors, dashboards, incidents, and infrastructure.688 npm1MIT
- AlicenseAqualityBmaintenanceEnables AI assistants to access full Datadog observability, including log search, APM trace filtering, smart sampling, and cross-correlation between logs, traces, and metrics.23688 npm5Apache 2.0