# Datadog MCP Server

A [Model Context Protocol (MCP)](https://modelcontextprotocol.io/) server that provides Claude and other AI assistants with direct access to the Datadog API. Query metrics, search logs, manage monitors, investigate security signals, and track billing — all through natural language.

## Features

| Category | Tools |
|---|---|
| **Metrics** | Query timeseries data, list active metrics |
| **Logs** | Search and filter logs with full query syntax |
| **Security Monitoring** | Search security signals (SIEM, CWS, CSM) |
| **Workload Protection** | List/manage CSM Threats policies and agent rules |
| **Monitors** | List, create, get, mute, and unmute monitors |
| **Dashboards** | List and retrieve dashboard definitions |
| **Billing & Usage** | Monthly costs, projected costs, usage breakdowns, cost attribution, security-specific usage |

## Prerequisites

- Python 3.10+
- A Datadog account with API and Application keys
- [Claude Code](https://docs.anthropic.com/en/docs/claude-code) or any MCP-compatible client

## Setup

### 1. Clone and install

```bash
git clone https://github.com/anthropics/datadog-mcp-server.git
cd datadog-mcp-server
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
```

### 2. Configure credentials

Copy the example env file and add your Datadog keys:

```bash
cp .env.example .env
```

Edit `.env`:

```
DD_API_KEY=your_api_key_here
DD_APP_KEY=your_app_key_here
# DD_SITE=datadoghq.eu  # Optional: for non-US regions
```

You can create API and Application keys in [Datadog Organization Settings](https://app.datadoghq.com/organization-settings/api-keys).

### 3. Add to Claude Code

Add the server to your Claude Code settings (`~/.claude/settings.json`):

```json
{
  "mcpServers": {
    "datadog": {
      "command": "/path/to/datadog-mcp-server/.venv/bin/python",
      "args": ["/path/to/datadog-mcp-server/server.py"],
      "env": {
        "DD_API_KEY": "your_api_key",
        "DD_APP_KEY": "your_app_key"
      }
    }
  }
}
```

Or for non-US Datadog regions, add `"DD_SITE": "datadoghq.eu"` to the `env` block.

## Available Tools

### Metrics

- **`query_metrics`** — Query timeseries data (e.g. `avg:system.cpu.user{*}`)
- **`list_active_metrics`** — List all active metric names

### Logs

- **`search_logs`** — Search logs with Datadog query syntax, time ranges, and limits

### Security Monitoring

- **`search_security_signals`** — Search SIEM/CWS/CSM signals with filters and time ranges

### Workload Protection (CSM Threats)

- **`list_workload_protection_policies`** — List all CSM Threats policies
- **`list_workload_protection_rules`** — List CWS agent rules (optionally filtered by policy)
- **`get_workload_protection_rule`** — Get details for a specific agent rule

### Monitors

- **`list_monitors`** — List monitors, optionally filtered by tags
- **`create_monitor`** — Create a new monitor with thresholds, notifications, and options
- **`get_monitor`** — Get details for a specific monitor
- **`mute_monitor`** / **`unmute_monitor`** — Mute or unmute monitors by scope

### Dashboards

- **`list_dashboards`** — List all dashboards
- **`get_dashboard`** — Get a specific dashboard's full definition

### Billing & Usage

- **`get_monthly_cost`** — Historical monthly costs broken down by product
- **`get_estimated_cost`** — Current month-to-date estimated cost
- **`get_projected_cost`** — Projected full-month cost
- **`get_billing_summary`** — Billable usage summary with counts and costs per product
- **`get_monthly_cost_attribution`** — Costs attributed by tags (team, env, service)
- **`get_hourly_usage`** — Hourly usage for specific product families
- **`get_usage_security`** — Combined CSPM + CWS + SDS + ASM usage
- **`get_active_billing_dimensions`** — List all active billing product categories

## Example Usage

Once configured, you can ask Claude things like:

- "What's our Datadog bill for February?"
- "Show me error logs from the payments service in the last hour"
- "Are there any critical security signals from today?"
- "Create a monitor that alerts when CPU usage exceeds 90%"
- "How much are we spending on Datadog security products?"
- "What's the projected cost for this month?"

## Required Datadog Permissions

Your Application key needs the following permissions depending on which tools you use:

| Tools | Required Scopes |
|---|---|
| Metrics | `timeseries_query` |
| Logs | `logs_read_data` |
| Security Signals | `security_monitoring_signals_read` |
| Workload Protection | `security_monitoring_rules_read` |
| Monitors | `monitors_read`, `monitors_write` (for create/mute) |
| Dashboards | `dashboards_read` |
| Billing & Usage | `usage_read` |

## Datadog Site Configuration

| Region | `DD_SITE` value |
|---|---|
| US1 (default) | `datadoghq.com` |
| US3 | `us3.datadoghq.com` |
| US5 | `us5.datadoghq.com` |
| EU | `datadoghq.eu` |
| AP1 | `ap1.datadoghq.com` |

## License

MIT