Datadog MCP Server

Instructions

{
  "data": "unknown_type"
}

{
  "errors": [
    "Bad Request"
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

Implementation Reference

• datadog_mcp/server.py:87-124 (registration)

  The route pattern for security monitoring endpoints, including GetSecurityMonitoringSignal, is whitelisted here as a safe read-only GET tool. This registers the tool via FastMCP OpenAPI route mapping.

  safe_endpoints = [
      # Metrics and time-series data
      r"^/api/v2/metrics.*",  # Query metrics data
      r"^/api/v2/query/.*",  # Time-series queries
      # Dashboards and visualizations
      r"^/api/v2/dashboards.*",  # Dashboard configurations
      r"^/api/v2/notebooks.*",  # Notebook data
      # Monitoring and alerts
      r"^/api/v2/monitors.*",  # Monitor configurations
      r"^/api/v2/downtime.*",  # Scheduled downtimes
      r"^/api/v2/synthetics.*",  # Synthetic tests
      # Logs and events
      r"^/api/v2/logs/events/search$",  # Search logs
      r"^/api/v2/logs/events$",  # List log events
      r"^/api/v2/logs/config.*",  # Log pipeline configs
      # APM and traces
      r"^/api/v2/apm/.*",  # APM data
      r"^/api/v2/traces/.*",  # Trace data
      r"^/api/v2/spans/.*",  # Span data
      # Infrastructure
      r"^/api/v2/hosts.*",  # Host information
      r"^/api/v2/tags.*",  # Tag management (read)
      r"^/api/v2/usage.*",  # Usage statistics
      # Service management
      r"^/api/v2/services.*",  # Service catalog
      r"^/api/v2/slos.*",  # Service level objectives
      r"^/api/v2/incidents.*",  # Incident management
      # Security and compliance
      r"^/api/v2/security_monitoring.*",  # Security signals
      r"^/api/v2/cloud_workload_security.*",  # CWS data
      # Teams and organization (read-only)
      r"^/api/v2/users.*",  # User information
      r"^/api/v2/roles.*",  # Role information
      r"^/api/v2/teams.*",  # Team structure
      # API metadata
      r"^/api/v2/api_keys$",  # List API keys (no create/delete)
      r"^/api/v2/application_keys$",  # List app keys (no create/delete)
  ]

• datadog_mcp/server.py:134-141 (registration)

  Creates RouteMap entries that explicitly mark matching security monitoring endpoints (including GetSecurityMonitoringSignal) as MCPType.TOOL, registering them as available tools.

  filters.extend(
      RouteMap(
          pattern=pattern,
          methods=["GET"],
          mcp_type=MCPType.TOOL,
      )
      for pattern in safe_endpoints
  )

• datadog_mcp/server.py:174-178 (registration)

  Initializes the FastMCP server with the OpenAPI spec and security route_maps, which exposes the GetSecurityMonitoringSignal tool (derived from Datadog API operationId) as an MCP tool.

  self.mcp_server = FastMCP.from_openapi(
      openapi_spec=openapi_spec,
      client=auth_client,
      route_maps=route_maps,
  )

• datadog_mcp/patches.py:6-46 (helper)

  Monkey patches FastMCP OpenAPI parser to handle parameter locations correctly, necessary for security monitoring tools (and others) to function properly.

  def patch_fastmcp_parameter_parsing() -> None:
      """Patch FastMCP to handle enum parameter locations correctly.
      
      This fixes an incompatibility where FastMCP expects parameter locations
      as strings (e.g., "path", "query") but receives enum objects from the
      OpenAPI spec parser (e.g., <ParameterLocation.PATH: 'path'>).
      """
      try:
          import fastmcp.utilities.openapi as openapi_utils
          
          # Store original function
          original_convert = getattr(openapi_utils.OpenAPIParser, '_convert_to_parameter_location', None)
          
          def patched_convert_to_parameter_location(self, param_in):
              """Patched parameter location converter that handles enum values."""
              # Convert enum to string if needed
              if hasattr(param_in, 'value'):
                  param_in = param_in.value
              elif hasattr(param_in, 'name'):
                  param_in = param_in.name.lower()
              
              # Call original function with string value
              if original_convert:
                  return original_convert(self, param_in)
              else:
                  # Fallback implementation
                  if param_in in ["path", "query", "header", "cookie"]:
                      return param_in
                  return "query"
          
          # Apply the patch
          if hasattr(openapi_utils, 'OpenAPIParser'):
              openapi_utils.OpenAPIParser._convert_to_parameter_location = patched_convert_to_parameter_location
              
      except ImportError:
          # If we can't import the modules, the patch won't work but we'll continue
          pass
  
  
  # Apply patches when module is imported
  patch_fastmcp_parameter_parsing()