Skip to main content
Glama
bgrgndzz

datadog-logs-mcp

by bgrgndzz

datadog-logs-mcp

MCP server for querying Datadog logs. Use with Claude Code, Claude Desktop, or any MCP-compatible client.

Setup

{
  "mcpServers": {
    "datadog-logs": {
      "command": "npx",
      "args": ["-y", "datadog-logs-mcp"],
      "env": {
        "DD_API_KEY": "your-api-key",
        "DD_APP_KEY": "your-app-key",
        "DD_SITE": "datadoghq.com"
      }
    }
  }
}

Environment Variables

Variable

Required

Description

DD_API_KEY

Yes

Datadog API key

DD_APP_KEY

Yes

Datadog Application key

DD_SITE

No

Datadog site (default: datadoghq.com). Use datadoghq.eu, us3.datadoghq.com, us5.datadoghq.com, etc.

Related MCP server: Datadog Logs MCP Server

Tools

search_logs

Search logs using Datadog log search syntax with time range, sorting, and pagination.

get_log

Get a specific log entry by ID.

aggregate_logs

Aggregate logs with computations (count, avg, sum, min, max, percentiles) and group-by breakdowns.

list_indexes

List all configured log indexes.

License

MIT

Available Tools

3 tools
aggregate_logsA

Aggregate Datadog logs to compute metrics like count, avg, sum, min, max, percentiles. Supports group-by for breakdowns.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd timenow
fromNoStart time (e.g. "now-1h", "now-24h")now-1h
queryYesLog search query (e.g. "service:web-app status:error")
computeYesList of computations to perform
group_byNoGroup results by facets/attributes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It explains the core behavior (computing metrics, supporting group-by) but does not address return format, time-range handling, potential limitations, or edge cases. It adds some value beyond the schema but omits deeper behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no unnecessary words. It front-loads the core action and mentions key capabilities concisely. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate but not thorough. It introduces the tool's purpose and key features, but with no output schema, it does not explain the structure of results (e.g., how timeseries or groups are returned). Given the complexity of aggregation parameters, a bit more context about the return value would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage of all parameters with detailed descriptions, enums, and defaults. The tool description essentially restates what the schema already documents (e.g., aggregations, group-by). It adds no new parameter-level meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's specific function: aggregating Datadog logs to compute metrics like count, avg, sum, min, max, and percentiles. It also distinguishes itself from sibling tools (search_logs, get_log) by focusing on aggregation rather than retrieving individual logs or raw search results.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for when metrics need to be computed from logs, but it does not explicitly state when to use this tool instead of search_logs or get_log. It lacks explicit alternative guidance or exclusion conditions, so usage context is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_logA

Retrieve a specific Datadog log entry by its unique ID. Requires the approximate timestamp of the log to narrow the search.

ParametersJSON Schema
NameRequiredDescriptionDefault
log_idYesThe unique ID of the log to retrieve
timestampYesApproximate timestamp of the log (ISO 8601). Used to narrow the search window.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses an important behavioral nuance: the timestamp is required and used to narrow the search window. However, it does not detail other behavioral traits such as what happens if the log is not found, the return format, or potential performance implications.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that wastes no words. It states the core purpose and the key requirement in a clear, front-loaded manner.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter retrieval tool with no output schema, the description plus schema provide a solid understanding of how to invoke it. The main gap is the lack of detail on the return value or error behavior, but these are not critical for basic invocation. Overall, it is sufficiently complete for an agent to select and use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains both parameters. The description adds slight emphasis on the word 'approximate' for the timestamp, but this is already present in the schema's parameter descriptions. Therefore, no significant additional meaning is conveyed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Retrieve a specific Datadog log entry by its unique ID', which is a specific verb+resource+scope. The word 'specific' distinguishes it from sibling tools like search_logs and aggregate_logs, which handle broader queries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear prerequisite: 'Requires the approximate timestamp of the log to narrow the search.' This sets the context for when to use this tool (when you have the log ID and an approximate timestamp). However, it does not explicitly mention alternatives or when not to use it, like 'for broad searches, use search_logs'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_logsA

Search Datadog logs using the log search syntax. Returns matching log entries with their attributes, timestamps, and metadata.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoEnd time - ISO 8601 datetime or relative like "now"now
fromNoStart time - ISO 8601 datetime or relative like "now-1h", "now-15m"now-15m
sortNoSort order: timestamp (oldest first) or -timestamp (newest first)-timestamp
limitNoMax number of logs to return (1-1000, default 50)
queryYesLog search query using Datadog log search syntax (e.g. "service:web-app status:error")
cursorNoPagination cursor from a previous search result to get next page
indexesNoSpecific log indexes to search. Defaults to all indexes.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the transparency burden. It discloses the return shape (matching log entries with attributes, timestamps, metadata) which is helpful. However, it does not mention pagination behavior, time range default semantics, or potential rate limits. It provides adequate but not rich behavioral insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one concise sentence that front-loads the action and result. No filler or redundancy; every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (7 params, no output schema, no annotations), the description adequately covers the core behavior and return type. It does not detail pagination responses, but the schema defines cursor and limit inputs, which is acceptable. The lack of output schema is mitigated by the description's mention of returned fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add meaning beyond the schema for parameters like query, from, to, or limit. It reinforces the use of log search syntax but that is already stated in the schema's query parameter description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Search') and resource ('Datadog logs'), and clarifies the search syntax usage. It clearly distinguishes from siblings like get_log (single log retrieval) and aggregate_logs (aggregations) by focusing on raw log search results.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: use this tool to search for logs matching a query. However, it does not explicitly mention when to use this versus sibling tools like aggregate_logs or get_log, nor provide exclusions or alternative recommendations. There is clear context but no contrast.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv1.0.4
    • First observedaggregate_logs
    • First observedget_log
    • First observedsearch_logs

TDQS

A4.1/5.0

Scored across 3 tools

Disambiguation5/5

Each tool targets a distinct operation: search_logs filters and returns multiple entries, get_log fetches a single entry by ID, and aggregate_logs computes metrics. There is no meaningful overlap, making tool selection unambiguous.

Naming Consistency5/5

All tool names follow the same verb_noun snake_case pattern (search_logs, get_log, aggregate_logs), which is predictable and consistent across the set.

Tool Count5/5

Three tools is a well-scoped count for a log-focused server. It covers the core operations (search, retrieve, aggregate) without unnecessary bloat or thinness.

Completeness4/5

The set covers the primary log reading and analysis workflow: searching, fetching by ID, and aggregating metrics. Minor gaps like log index listing or log ingestion are absent but not essential for the apparent purpose.

Maintenance

ActivityInactive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    C
    quality
    D
    maintenance
    Enables interaction with Datadog's monitoring platform to search logs, search trace spans, and perform trace span aggregation for analysis.
    3
    688 npm
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    Enables querying OpenTelemetry logs stored in OpenSearch across development and production environments. Provides tools for searching logs by various criteria including free-text Lucene queries, trace IDs, service names, error levels, and specific fields.
    8
    -
  • A
    license
    A
    quality
    C
    maintenance
    Enables AI assistants to search logs, query metrics, manage dashboards, analyze APM traces, and control monitors via Datadog APIs.
    30
    MIT