Datadog MCP Server

Instructions

{
  "data": [
    "unknown_type"
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

{
  "errors": [
    "Bad Request"
  ]
}

Implementation Reference

• datadog_mcp/server.py:75-146 (registration)

  Registers the GetUsageApplicationSecurityMonitoring tool by whitelisting the /api/v2/usage.* GET endpoint (line 109) as an MCP TOOL via FastMCP route maps. This is part of the security filter that exposes only safe read-only Datadog API endpoints.

  def _get_route_filters(self) -> list[RouteMap]:
      """Get route filtering rules for safe observability-focused tools.
  
      Security Model:
      1. DENY ALL destructive operations (POST, PUT, PATCH, DELETE)
      2. ALLOW ONLY specific read-only GET endpoints
      3. DEFAULT DENY everything else
  
      This whitelist approach ensures only safe, read-only operations
      are exposed through the MCP interface.
      """
      # Define safe read-only endpoints for observability workflows
      safe_endpoints = [
          # Metrics and time-series data
          r"^/api/v2/metrics.*",  # Query metrics data
          r"^/api/v2/query/.*",  # Time-series queries
          # Dashboards and visualizations
          r"^/api/v2/dashboards.*",  # Dashboard configurations
          r"^/api/v2/notebooks.*",  # Notebook data
          # Monitoring and alerts
          r"^/api/v2/monitors.*",  # Monitor configurations
          r"^/api/v2/downtime.*",  # Scheduled downtimes
          r"^/api/v2/synthetics.*",  # Synthetic tests
          # Logs and events
          r"^/api/v2/logs/events/search$",  # Search logs
          r"^/api/v2/logs/events$",  # List log events
          r"^/api/v2/logs/config.*",  # Log pipeline configs
          # APM and traces
          r"^/api/v2/apm/.*",  # APM data
          r"^/api/v2/traces/.*",  # Trace data
          r"^/api/v2/spans/.*",  # Span data
          # Infrastructure
          r"^/api/v2/hosts.*",  # Host information
          r"^/api/v2/tags.*",  # Tag management (read)
          r"^/api/v2/usage.*",  # Usage statistics
          # Service management
          r"^/api/v2/services.*",  # Service catalog
          r"^/api/v2/slos.*",  # Service level objectives
          r"^/api/v2/incidents.*",  # Incident management
          # Security and compliance
          r"^/api/v2/security_monitoring.*",  # Security signals
          r"^/api/v2/cloud_workload_security.*",  # CWS data
          # Teams and organization (read-only)
          r"^/api/v2/users.*",  # User information
          r"^/api/v2/roles.*",  # Role information
          r"^/api/v2/teams.*",  # Team structure
          # API metadata
          r"^/api/v2/api_keys$",  # List API keys (no create/delete)
          r"^/api/v2/application_keys$",  # List app keys (no create/delete)
      ]
  
      filters = [
          # SECURITY: Block ALL destructive operations first
          RouteMap(
              methods=["POST", "PUT", "PATCH", "DELETE"], mcp_type=MCPType.EXCLUDE
          ),
      ]
  
      # Add whitelisted read-only endpoints
      filters.extend(
          RouteMap(
              pattern=pattern,
              methods=["GET"],
              mcp_type=MCPType.TOOL,
          )
          for pattern in safe_endpoints
      )
  
      # SECURITY: Default deny everything else
      filters.append(RouteMap(pattern=r".*", mcp_type=MCPType.EXCLUDE))
  
      return filters

• datadog_mcp/server.py:174-179 (registration)

  Creates all MCP tools from Datadog OpenAPI spec using FastMCP.from_openapi, applying the security route_maps that include the usage endpoint. The authenticated httpx client proxies requests to Datadog API.

  self.mcp_server = FastMCP.from_openapi(
      openapi_spec=openapi_spec,
      client=auth_client,
      route_maps=route_maps,
  )

• datadog_mcp/patches.py:6-46 (helper)

  Monkey patch for FastMCP OpenAPI parser to ensure proper parameter handling for generated tools like GetUsageApplicationSecurityMonitoring.

  def patch_fastmcp_parameter_parsing() -> None:
      """Patch FastMCP to handle enum parameter locations correctly.
      
      This fixes an incompatibility where FastMCP expects parameter locations
      as strings (e.g., "path", "query") but receives enum objects from the
      OpenAPI spec parser (e.g., <ParameterLocation.PATH: 'path'>).
      """
      try:
          import fastmcp.utilities.openapi as openapi_utils
          
          # Store original function
          original_convert = getattr(openapi_utils.OpenAPIParser, '_convert_to_parameter_location', None)
          
          def patched_convert_to_parameter_location(self, param_in):
              """Patched parameter location converter that handles enum values."""
              # Convert enum to string if needed
              if hasattr(param_in, 'value'):
                  param_in = param_in.value
              elif hasattr(param_in, 'name'):
                  param_in = param_in.name.lower()
              
              # Call original function with string value
              if original_convert:
                  return original_convert(self, param_in)
              else:
                  # Fallback implementation
                  if param_in in ["path", "query", "header", "cookie"]:
                      return param_in
                  return "query"
          
          # Apply the patch
          if hasattr(openapi_utils, 'OpenAPIParser'):
              openapi_utils.OpenAPIParser._convert_to_parameter_location = patched_convert_to_parameter_location
              
      except ImportError:
          # If we can't import the modules, the patch won't work but we'll continue
          pass
  
  
  # Apply patches when module is imported
  patch_fastmcp_parameter_parsing()