Enables querying Cloudflare integration data within Datadog, allowing users to retrieve Cloudflare-related metrics and configurations.
Provides read-only access to Datadog's observability platform, including logs, APM, metrics, monitors, dashboards, SLOs, synthetics, incidents, infrastructure, security, network, cloud integrations, service catalog, CI visibility, and more, with over 117 tools.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@Datadog MCP Server show me the top errors in the last hour"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
The Datadog MCP server your AI deserves. 117 read-only tools. Every observability pillar. Zero writes. Zero regrets.
Look, we get it. You searched "datadog mcp server" and got seven results. You're wondering which one to pick. Let us save you approximately forty-five seconds of reading other READMEs that say "supports monitors and dashboards" like that's supposed to impress someone.
Feature | Us (117 tools) | Project 1 | Project 2 | Project 3 |
Observability Core | ||||
Logs (search + aggregate + pipelines + indexes) | 7 tools | 1 tool | 0-1 tool | 0-1 tool |
APM (traces, spans, services, dependencies) | 7 tools | 1 tool | 0 tools | 0 tools |
Metrics (query, metadata, volumes, tags) | 6 tools | 1 tool | 0-1 tool | 0 tools |
RUM (events, apps, aggregation) | 3 tools | 3 tools | 0 tools | 0 tools |
Alerting & Reliability | ||||
Monitors (list, get, search) | 4 tools | 1 tool | 0-1 tool | 0-1 tool |
Dashboards (get, list, collections) | 3 tools | 1 tool | 0-1 tool | 0-1 tool |
SLOs (list, get, history, search, corrections) | 5 tools | 0 tools | 0-1 tool | 0-1 tool |
Synthetics (tests, results, locations) | 5 tools | 0 tools | 0-1 tool | 0 tools |
Events & Incidents | 7 tools | 2 tools | 0-1 tool | 0 tools |
Downtimes | 2 tools | 1 tool | 0-1 tool | 0 tools |
Infrastructure & Security | ||||
Infrastructure (hosts, tags, containers, processes) | 8 tools | 2 tools | 0-1 tool | 0-1 tool |
Security (findings, posture, signals, rules, scanning) | 10 tools | 0 tools | 0-1 tool | 0 tools |
Network Monitoring | 2 tools | 0 tools | 0 tools | 0 tools |
Cloud Integrations (AWS/GCP/Azure/Cloudflare/Confluent) | 5 tools | 0 tools | 0 tools | 0 tools |
Platform & DevOps | ||||
Service Catalog | 3 tools | 0 tools | 0-1 tool | 0 tools |
CI Visibility (pipelines + tests) | 4 tools | 0 tools | 0-1 tool | 0 tools |
Organization (teams, users, auth) | 5 tools | 0 tools | 0-1 tool | 0 tools |
Error Tracking | 3 tools | 0 tools | 0 tools | 0 tools |
Database Monitoring | 2 tools | 0 tools | 0 tools | 0 tools |
Workflows & Automation | 2 tools | 0 tools | 0 tools | 0 tools |
DORA Metrics | 1 tool | 0 tools | 0 tools | 0 tools |
Governance & Cost | ||||
Audit Trail | 2 tools | 0 tools | 0 tools | 0 tools |
Usage & Billing | 4 tools | 0 tools | 0 tools | 0 tools |
Cloud Cost Management | 1 tool | 0 tools | 0 tools | 0 tools |
Access Control (keys, mappings, policies) | 4 tools | 0 tools | 0 tools | 0 tools |
Notebooks | 3 tools | 0 tools | 0 tools | 0 tools |
Fleet Management | 1 tool | 0 tools | 0 tools | 0 tools |
Webhooks | 1 tool | 0 tools | 0 tools | 0 tools |
Monitor Notifications | 1 tool | 0 tools | 0 tools | 0 tools |
IP Ranges & Config | 1 tool | 0 tools | 0 tools | 0 tools |
Total | 117 | ~20 | ~13 | ~29 |
Accidentally deletes your monitors | No | No | No | No |
Can mute your hosts at 3 AM | No | No | No | Yes |
Test coverage | 90%+ | Unknown | Unknown | Unknown |
We're not saying the other MCP servers are bad. That would be rude, and also legally questionable. They're all built by talented engineers who are contributing to open source and making the ecosystem better. Some of them have features we don't, like the ability to write to your Datadog account from an AI chat window. We chose not to include those. On purpose. You're welcome.
Read everything. Write nothing.
Your AI assistant should be able to see all of Datadog. It should not be able to silence your pager at 3 AM because it decided your alerts were "probably fine." That's not a hypothetical scenario. That's a Tuesday. We have opinions about this, and they are all correct.
Related MCP server: databricks-mcp
npx github:dreamiurg/datadog-mcp --helpThat's it. No installation required. Node.js 20+. Works in 8 seconds. We timed it.
You need two keys from your Datadog Organization Settings:
Credential | Where to Find | Difficulty |
API Key | Organization Settings -> API Keys -> New Key | Easy |
Application Key | Organization Settings -> Application Keys -> New Key | Also easy |
Tip: For least-privilege access, scope your Application Key to only the permissions you need. Or give it everything. We won't judge. (We will judge a little.)
claude mcp add datadog -- npx github:dreamiurg/datadog-mcp \
--apiKey YOUR_API_KEY \
--appKey YOUR_APP_KEY \
--site datadoghq.comOr add to ~/.claude.json:
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["github:dreamiurg/datadog-mcp", "--apiKey", "YOUR_API_KEY", "--appKey", "YOUR_APP_KEY"]
}
}
}Add to your config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%/Claude/claude_desktop_config.json
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["github:dreamiurg/datadog-mcp", "--apiKey", "YOUR_API_KEY", "--appKey", "YOUR_APP_KEY"]
}
}
}Tool | Config File |
Cursor |
|
Windsurf |
|
VS Code | User Settings JSON ( |
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["github:dreamiurg/datadog-mcp", "--apiKey", "YOUR_API_KEY", "--appKey", "YOUR_APP_KEY"]
}
}
}Add to ~/.gemini/settings.json:
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["github:dreamiurg/datadog-mcp", "--apiKey", "YOUR_API_KEY", "--appKey", "YOUR_APP_KEY"]
}
}
}Add to ~/.codex/config.toml:
[mcp_servers.datadog]
command = "npx"
args = ["github:dreamiurg/datadog-mcp", "--apiKey", "YOUR_API_KEY", "--appKey", "YOUR_APP_KEY"]Tool | What It Does | Try Asking |
| Search logs with Datadog query syntax | "Find errors in auth service last hour" |
| Compute counts, averages, group-bys on log data | "Count errors by service in the last 24h" |
| List log pipeline configurations | "How are our logs being processed?" |
| List log indexes and retention settings | "What retention is configured for our logs?" |
| Get log pipeline processing order | "What order do log pipelines execute in?" |
| Get log archive priority order | "Which archives are checked first for rehydration?" |
| List log-based custom metrics | "What metrics are generated from logs?" |
Tool | What It Does | Try Asking |
| Search APM spans with query syntax | "Find slow requests in payment service" |
| Compute APM statistics (p99, error rates) | "Show p99 latency by service" |
| List APM-instrumented services | "What services are being traced?" |
| Get a full distributed trace by ID | "Show all spans for trace abc123" |
| Search raw APM events | "Find APM events with errors in checkout" |
| List currently active APM events | "What APM events are happening right now?" |
| List span-based APM metrics | "What custom span metrics are configured?" |
Tool | What It Does | Try Asking |
| Query timeseries metric data | "Show CPU usage for web hosts last 4 hours" |
| List available metrics | "What metrics are available?" |
| Get metric metadata and descriptions | "Describe the system.cpu.user metric" |
| Search metrics by name with volume data | "Which metrics matching 'aws.' have the highest volume?"* |
| Get tag configuration for a specific metric | "What tags are indexed for system.cpu.user?" |
| List metric tag configurations | "Which metrics have custom tag configurations?" |
Tool | What It Does | Try Asking |
| List monitors (filter by state, tags) | "Show all alerting monitors" |
| Get monitor details by ID | "Get details for monitor 12345" |
| Search monitors by query | "Find monitors related to database" |
| Get monitor configuration policies | "What monitor config policies are enforced?" |
Tool | What It Does | Try Asking |
| List all dashboards | "What dashboards do we have?" |
| Get dashboard details and widgets | "Show the API metrics dashboard" |
| List dashboard collections | "What dashboard lists are organized?" |
Tool | What It Does | Try Asking |
| List Service Level Objectives | "Which SLOs are breaching?" |
| Get SLO details by ID | "Show error budget for SLO xyz" |
| Get historical SLO performance | "How has our API SLO trended this month?" |
| List SLO correction periods | "What SLO corrections have been applied?" |
| Search SLOs with query filters | "Find all SLOs with error budget below 10%" |
Tool | What It Does | Try Asking |
| List synthetic tests | "What synthetic checks do we have?" |
| Get results for a specific test | "Show recent results for the checkout test" |
| List Synthetics global variables | "What global variables are available for tests?" |
| List available Synthetics testing locations | "Where can I run Synthetics tests from?" |
| List Synthetics private locations | "What private locations are configured for testing?" |
Tool | What It Does | Try Asking |
| Search RUM events with filters | "Find RUM errors on the checkout page" |
| List registered RUM applications | "What apps have RUM enabled?" |
| Analytics on RUM data (counts, averages, group-by) | "Average page load time by country" |
Tool | What It Does | Try Asking |
| List infrastructure hosts | "Show all production hosts" |
| Get tags for all hosts | "What tags are on our hosts?" |
| Get total active/up host count | "How many hosts are running?" |
| Get total active and up host counts | "Show me the total host count breakdown" |
| List NDM network devices | "Show network device status" |
| List Datadog agents across fleet | "Which agents are outdated?" |
| List running containers | "Show containers filtered by image" |
| List running processes | "Find java processes across hosts" |
Tool | What It Does | Try Asking |
| List all service definitions | "What services are in the catalog?" |
| Get a single service definition | "Who owns the auth service?" |
| Get service dependency map | "What does the payment service depend on?" |
Tool | What It Does | Try Asking |
| List CI pipeline events | "Show recent CI pipeline runs" |
| Aggregate CI pipeline analytics | "Average pipeline duration by repo" |
| List CI test events | "Show failed tests in the last hour" |
| Search CI test events with filters | "Find flaky tests in the checkout service" |
Tool | What It Does | Try Asking |
| Search Cloud Security findings | "Find high-severity security findings" |
| Get a specific security finding | "Get finding abc123" |
| List compliance/posture findings | "Show failed compliance checks" |
| Search security monitoring signals | "Recent threat detections" |
| Get CSM coverage across cloud accounts | "Which AWS accounts lack security coverage?" |
| List vulnerability findings (SAST, SCA, IAST, Infra) | "Show open SAST vulnerabilities in production" |
| List CSM Threats agent rules | "What workload security rules are enabled?" |
| List security monitoring rules | "What detection rules are active?" |
| List security monitoring detection rules | "What security detection rules are configured?" |
| Get Sensitive Data Scanner configuration | "What sensitive data scanning rules are active?" |
Tool | What It Does | Try Asking |
| Get Datadog organization info | "Show organization details and settings" |
| List Datadog teams | "What teams exist in our org?" |
| List members of a Datadog team | "Who is on the platform team?" |
| List Datadog users | "Who has access to Datadog?" |
| List SAML/OIDC authentication mappings | "How do IdP groups map to Datadog roles?" |
Tool | What It Does | Try Asking |
| Fetch events in a time range | "What events happened today?" |
| List scheduled maintenance | "Any active downtimes?" |
| List scheduled downtimes (v2) | "What downtimes are scheduled?" |
| Get Database Monitoring query samples | "Show slow postgres queries" |
| Get Database Monitoring query metrics | "Which queries have the highest latency?" |
| Get Datadog IP ranges for firewall config | "What IPs should I allowlist for Datadog?" |
Tool | What It Does | Try Asking |
| Search audit trail with filters | "Who changed configs in the last hour?" |
| Get hourly usage metering by product | "Show log ingestion usage trends" |
| Get top custom metrics by hourly average | "Which custom metrics drive cardinality costs?" |
| Get estimated usage cost data | "What's our projected Datadog bill this month?" |
Tool | What It Does | Try Asking |
| List Datadog notebooks with filtering | "Find investigation notebooks" |
| Get a specific notebook by ID | "Show notebook 12345" |
Tool | What It Does | Try Asking |
| List containers with tag filtering | "Show running containers in us-east-1" |
| List processes across hosts | "Find Java processes with high memory" |
Tool | What It Does | Try Asking |
| List NDM network devices | "Show network device status" |
| Aggregate network flow analytics | "Top network flows by bandwidth" |
Tool | What It Does | Try Asking |
| List security monitoring rules | "What detection rules are active?" |
| Search error tracking issues | "Top errors by volume in production" |
| Get error tracking issue details by ID | "Show details for issue abc123" |
| Get CSM coverage across cloud accounts | "Which AWS accounts lack security coverage?" |
| List vulnerability findings (SAST, SCA, IAST, Infra) | "Show open SAST vulnerabilities in production" |
| List CSM Threats agent rules | "What workload security rules are enabled?" |
Tool | What It Does | Try Asking |
| Search incidents with advanced filters | "Find P1 incidents related to database" |
| Get action items for an incident | "What's pending for this P0?" |
| Get timeline events for an incident | "Show the timeline for incident xyz" |
| List incident services | "What services are configured for incident management?" |
Tool | What It Does | Try Asking |
| List integrated AWS accounts | "Which AWS accounts are connected?" |
| List GCP integration accounts | "Which GCP projects are integrated?" |
| List Azure integration accounts | "Which Azure subscriptions are connected?" |
| List Cloudflare accounts | "What Cloudflare accounts are integrated?" |
| List Confluent Cloud accounts | "Which Confluent Cloud accounts are connected?" |
| List webhook integrations | "What webhooks are configured?" |
| List Datadog API keys | "What API keys are active?" |
Tool | What It Does | Try Asking |
| List DORA deployment events | "Show deployment frequency for web service" |
| List workflow automations | "What incident response workflows exist?" |
| List execution instances for a workflow | "Show run history for the incident workflow" |
| List Datadog agents across fleet | "Which agents are outdated?" |
| List monitor notification routing | "Who gets alerted for this monitor?" |
| List cloud cost budgets | "Are any teams over budget?" |
Tool | What It Does | Try Asking |
| Get restriction policy for a resource | "What access restrictions are configured?" |
| List application keys for the current user | "What application keys do I have?" |
| List authentication mappings | "How do SAML groups map to Datadog roles?" |
There are approximately seven thousand Datadog MCP servers on GitHub. We counted. Then we lost count. Then we counted again. Here's how they stack up:
Capability | Us | Project 1 | Project 2 | Project 3 | Project 4 |
Total tools | 117 | ~20 | ~10 | ~13 | ~29 |
Read-only by design | Yes | No | Yes | Yes | No |
Can mute your hosts | No | Yes | No | No | No |
Can delete your dashboards | No | No | No | No | Yes |
Can schedule downtimes | No | Yes | No | No | Yes |
Test suite | 570 tests | - | - | - | - |
Last meaningful update | Today | Recent | Dec 2025 | Jan 2026 | Dec 2025 |
A note on write operations: Some servers let your AI create monitors, delete dashboards, and schedule downtimes. That's a feature. It's also the plot of every "AI gone wrong" movie ever made. We chose the boring path: read everything, touch nothing. Our therapist says this is healthy.
In the interest of full transparency (and because our lawyers said we had to):
Some servers can mute/unmute hosts and schedule downtimes (write operations we intentionally excluded because we enjoy sleeping)
Some servers can CRUD monitors and dashboards (see above re: AI movies, and also re: sleeping)
Some servers have unique metric field exploration tools
We sleep extremely well at night.
Set --site for your Datadog region:
Region | Site Value |
US (default) |
|
EU |
|
US3 (GovCloud) |
|
US5 |
|
AP1 |
|
Alternative to command-line arguments:
DD_API_KEY=your_api_key
DD_APP_KEY=your_app_key
DD_SITE=datadoghq.com # Optional, defaults to datadoghq.com
DD_LOGS_SITE=logs.datadoghq.com # Optional, override for logs API
DD_METRICS_SITE=api.datadoghq.com # Optional, override for metrics APIVariable | Values | Default | Description |
|
|
| Minimum log level |
|
|
| Output format ( |
# Pretty logs for development
LOG_FORMAT=pretty npx github:dreamiurg/datadog-mcp --apiKey ... --appKey ...Create an Application Key with only the scopes you need:
Scope | Tools Unlocked |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Create a scoped key: Organization Settings -> Application Keys -> New Key -> Select scopes
Verify API key and Application key are correct
Check your Application Key has required scopes
Confirm you're using the correct regional endpoint
# Check MCP server status
claude mcp list
# View logs (Claude Desktop - macOS)
tail -f ~/Library/Logs/Claude/mcp*.log
# View logs (Claude Desktop - Windows)
Get-Content "$env:APPDATA\Claude\Logs\mcp*.log" -Tail 20 -WaitLOG_LEVEL=debug LOG_FORMAT=pretty npx github:dreamiurg/datadog-mcp --apiKey ... --appKey ...git clone https://github.com/dreamiurg/datadog-mcp.git
cd datadog-mcp
npm install
npm run build
npm testScript | Description |
| Compile TypeScript |
| Run tests (570 tests in 120 files) |
| Run tests with coverage (90%+ enforced) |
| Run Biome linter |
| Type check |
| Check cyclomatic complexity |
| Run everything (the full gauntlet) |
npx @modelcontextprotocol/inspector node dist/index.js \
--apiKey=YOUR_API_KEY \
--appKey=YOUR_APP_KEYPRs welcome. We have strong opinions about read-only access, 90% test coverage, and cognitive complexity under 15. If that sounds like fun, you'll fit right in.
MIT - Use freely in personal and commercial projects.
In case it wasn't abundantly, blindingly, neon-sign-in-the-desert obvious: the comparison tables above are written with tongue so firmly in cheek it's coming out the other side. This is sarcasm. We are being sarcastic. If you're still not sure, yes, that was also sarcasm.
Every single Datadog MCP server out there was built by engineers who cared enough to ship something real into the world. That's more than most people do on a Saturday. Open source is better when there are options, and the ecosystem is better because all of these projects exist.
If our 117 read-only tools aren't what you need, genuinely and sincerely: go find the one that is. Try them all. Mix and match. Build your own. Fork ours and add write operations if you're feeling brave (and have good backups). The best tool is the one that fits your workflow, not the one with the spiciest README.
Now go build something great. Sleep tight.
Compute statistics and aggregations on logs. Use for 'how many errors per service', 'count logs by status', or 'average response time from logs'. Supports count, avg, sum, min, max, percentiles. Use search-logs to see actual log content instead.
Inputs: filter, compute, groupBy, options.
Aggregate network connection analytics with grouping and filtering
Inputs: filter_from, filter_to, filter_query, group_by, +1 more.
Aggregate RUM events with compute operations (count, avg, sum, min, max, percentile) and group-by facets. Use for 'RUM page load times by country', 'error count by browser', 'average session duration by app version'.
Inputs: compute (required), filter, group_by.
Compute statistics on APM spans. Use for 'p99 latency by service', 'error rate per endpoint', 'request count over time'. Supports count, avg, sum, min, max, percentiles (pc75/90/95/99). Use search-spans to see actual span details.
Inputs: filter, compute, groupBy.
Get total number of active and up hosts. Use for 'how many hosts are running', 'infrastructure host count', 'active host summary'.
Inputs: from.
Search Datadog organization audit events. Use for 'who changed this monitor', 'what config changes happened today', 'audit trail for user X'. Returns timestamped events with actor, action, and affected resource.
Inputs: filter, sort, page, limit.
Aggregate CI pipeline analytics with compute operations. Use for 'average pipeline duration', 'failure rate by pipeline', 'CI performance trends'.
Inputs: compute (required), filter, group_by.
List containers monitored by Datadog. Use for 'show running containers', 'containers for web service', 'container status by image'. Returns container names, images, tags, state, and start time.
Inputs: filterTags, groupBy, sort, pageSize, +1 more.
Get Cloud Security Management coverage across cloud accounts
Inputs: page_size, page_cursor.
Get full dashboard definition by ID. Returns all widgets, queries, and layout. Use after get-dashboards to explore a specific dashboard's contents and understand what metrics/data it displays.
Inputs: dashboardId (required).
List all Datadog dashboards. Use to answer 'what dashboards exist', 'find dashboard for API metrics', or to get dashboard IDs for get-dashboard. Returns dashboard names, IDs, and URLs.
Inputs: limit.
Get Database Monitoring query metrics. Filter by database type, host, query text, and time range.
Inputs: filter_db_type, filter_host, filter_query, filter_from, +3 more.
Get Database Monitoring query samples. Use for 'slow database queries', 'what queries are running on postgres', 'DB performance issues'. Returns query samples with execution time, affected rows, and database context.
Inputs: start, end, source, dbHost, +2 more.
List scheduled maintenance downtimes in Datadog. Use for 'are there any active downtimes', 'what's scheduled for maintenance', 'why is this monitor muted'. Shows scope, schedule, and duration. Critical for on-call to understand muted monitors.
Inputs: currentOnly, include, pageOffset, pageLimit.
Get details of a Datadog error tracking issue (user-facing error/exception) by ID
Inputs: issue_id (required).
Get estimated cost data for your Datadog usage. Filter by date range and view type (sub_org, summary). Useful for cost monitoring and budget planning.
Inputs: view, start_month, end_month, start_date, +1 more.
Query Datadog events within a time range. Events include deployments, alerts, configuration changes, and comments. Use for 'what happened yesterday', 'show deployment events', or correlating incidents with changes. Requires start/end as Unix timestamps.
Inputs: start (required), end (required), priority, sources, +4 more.
List infrastructure hosts reporting to Datadog. Use for 'show production hosts', 'which hosts are muted', 'hosts running agent version X'. Returns host names, IPs, apps, agent info, and mute status. Essential for infrastructure visibility during incidents.
Inputs: filter, sortField, sortDir, start, +4 more.
Get all tags associated with hosts. Use for 'what tags are on my hosts', 'which hosts have team:platform tag', or to understand host groupings. Returns a map of tag names to host lists.
Inputs: host_name (required), source.
Get Datadog hourly usage by product family for cost analysis
Inputs: filter_timestamp_start (required), filter_product_families (required), filter_timestamp_end, page_limit, +1 more.
List Datadog incidents for incident management. Use for 'show active incidents', 'what incidents happened this week', or 'find incidents related to payments'. Includes severity, status, commander, and timeline.
Inputs: pageSize, pageOffset, query, limit.
List incident services used for categorizing and routing incidents. Filter by name and paginate results.
Inputs: page_size, page_offset, filter.
Get timeline events for a Datadog incident. Shows status changes, messages, tasks, notifications.
Inputs: incident_id (required), page_size, page_offset, filter_type.
Get action items/todos for a specific Datadog incident
Inputs: incident_id (required).
Get Datadog IP ranges used by agents, APIs, APM, logs, process collection, synthetics, and webhooks. Useful for firewall/allowlist configuration.
Inputs: no named parameters.
List all log indexes and their configuration. Use for 'where are logs being stored', 'what retention is configured', 'which logs are being excluded'. Returns index names, filters, retention days, daily limits, and exclusion filters.
Inputs: no named parameters.
List all log processing pipelines. Use for 'how are logs being processed', 'which pipelines are active', 'what parsing rules exist'. Returns pipeline names, filters, processors, and enabled status. Essential for understanding log processing configuration.
Inputs: no named parameters.
Get the ordered list of log archive IDs, showing the priority order for log archiving.
Inputs: no named parameters.
Get log archive configurations showing where logs are stored
Inputs: no named parameters.
Get log index configurations including retention and exclusion filters
Inputs: no named parameters.
Get all log-based metric configurations
Inputs: no named parameters.
Get the ordered list of log pipeline IDs, showing the processing order for log pipelines.
Inputs: no named parameters.
Get log processing pipeline configurations
Inputs: no named parameters.
Get metadata for a specific metric name. Returns type (gauge/count/rate), unit, description, and integration. Use when you need to understand what a metric measures, e.g., 'what does system.cpu.user mean'.
Inputs: metricName (required).
Search for available Datadog metrics by name pattern. Use to discover metrics like 'what CPU metrics exist' or 'find metrics for service X'. Parameter q searches metric names (e.g., q='aws.ec2' finds all EC2 metrics).
Inputs: q.
Get tag configuration for a specific metric. Shows which tags are indexed and queryable.
Inputs: metric_name (required).
Get full details for a specific monitor by ID. Use after get-monitors to dive deeper into a specific monitor's configuration, thresholds, query, and current state. Returns complete monitor definition.
Inputs: monitorId (required).
Get monitor configuration policies that enforce tag and setting requirements on monitors across your organization.
Inputs: no named parameters.
List Datadog monitors with filtering. Use for questions like 'show alerting monitors', 'what monitors are in warning state', or 'monitors tagged with team:platform'. Filter by groupStates: 'alert', 'warn', 'no data', 'ok'. Use get-monitor for a single monitor's full details.
Inputs: groupStates, tags, monitorTags, limit.
Get a specific Datadog notebook by ID with all cells and content
Inputs: notebook_id (required).
List Datadog notebooks. Use for 'show investigation notebooks', 'find notebooks by team', or 'recent notebooks about outage'. Notebooks are collaborative documents used during incidents and investigations.
Inputs: authorHandle, excludeAuthorHandle, count, start, +6 more.
Get your Datadog organization info including name, plan, public ID, and settings. Essential for understanding account configuration.
Inputs: no named parameters.
Get reusable dashboard widget templates (Powerpacks)
Inputs: page_limit, page_offset.
Get a legacy CSPM/CIEM finding by ID (posture_management). Note: this endpoint uses the legacy data model. Requires the security_monitoring_findings_read scope.
Inputs: findingId (required).
Get Sensitive Data Scanner configuration including scanning groups and rules for PII/sensitive data detection.
Inputs: no named parameters.
Get a single service definition by name from the Service Catalog. Use for 'show service X details', 'what team owns service Y', 'service definition for Z'.
Inputs: serviceName (required), schemaVersion.
Get service dependency graph for APM services in a given environment
Inputs: env (required).
List all APM-instrumented services. Use to discover traced services, find service names for span queries, or get an overview of your distributed system. Returns service names and their environments.
Inputs: env.
Get detailed SLO information by ID. Returns error budget remaining, burn rate, target vs actual, thresholds, and configured alerts. Use after get-slos to understand a specific SLO's health and history.
Inputs: sloId (required), withConfiguredAlertIds.
List all SLO corrections (status adjustments) across your organization. Shows maintenance windows and planned downtime exclusions that affect SLO calculations.
Inputs: offset, limit.
Get historical SLO data over a time range. Use after get-slo to see 'SLO performance last 30 days', 'error budget consumption over time', or 'SLI trend for checkout service'. Returns SLI values, thresholds, and time range data.
Inputs: sloId (required), fromTs (required), toTs (required), target.
List Service Level Objectives (SLOs). Use for 'show all SLOs', 'SLOs for team platform', 'which SLOs are at risk'. Returns SLO names, targets, and current status. Use get-slo for detailed error budget and history of a specific SLO.
Inputs: ids, query, tagsQuery, metricsQuery, +2 more.
Get all span-based metric configurations from APM
Inputs: no named parameters.
Get execution results for a specific Synthetic test. Use after get-synthetic-tests to see pass/fail history, response times, and probe locations. Returns individual check results with timing data.
Inputs: publicId (required), fromTs, toTs, probeDc.
List Datadog Synthetic tests (API and browser). Use for 'show all synthetic tests', 'what API tests exist', or 'which tests are failing'. Returns test names, types, status, locations, and tags.
Inputs: pageSize, pageNumber, type, locations.
Get top custom metrics by average hourly count for cost and cardinality analysis
Inputs: month, day, names, limit, +1 more.
Get all spans for a specific trace ID. Use after search-spans to see the full request flow across services. Returns all spans in the trace with timing, service, resource, and error information.
Inputs: traceId (required), from, to.
Get hourly usage data by product family. Use for 'how many infra hosts this month', 'log ingestion volume', 'APM usage trends'. Returns usage records with timestamps for billing and capacity planning.
Inputs: startHr (required), endHr, productFamilies, pageLimit, +1 more.
List Datadog API keys for key management and security audit
Inputs: page_size, page_number, filter, sort.
List application keys for the current user. Shows key names, scopes, and creation dates.
Inputs: page_size, page_number, sort, filter_name.
List authentication mappings (SAML/OIDC). Shows how identity provider attributes map to Datadog roles.
Inputs: page_size, page_number, sort, filter_query.
List AWS accounts integrated with Datadog
Inputs: aws_account_id.
List Azure integration accounts connected to Datadog.
Inputs: no named parameters.
List CI pipeline events (pipeline runs/executions). Use for 'recent CI builds', 'failed pipelines', 'CI pipeline status', 'deployment history'.
Inputs: filterQuery, filterFrom, filterTo, pageLimit, +2 more.
List CI test events from Datadog CI Visibility. Filter by query, time range. Use for 'show failed tests', 'test results for service X'.
Inputs: filter_query, filter_from, filter_to, page_limit, +2 more.
List Cloudflare accounts integrated with Datadog for monitoring CDN and edge performance.
Inputs: no named parameters.
List Confluent Cloud accounts integrated with Datadog for monitoring Kafka clusters.
Inputs: no named parameters.
List Datadog-monitored containers with their metadata and health status
Inputs: filter_tags, group_by, sort, page_size, +1 more.
List cloud cost management budgets for tracking team spending
Inputs: page_size, page_offset.
List CSM Threats agent rules for workload security monitoring
Inputs: page_size, page_number.
List all custom dashboard lists. Use for 'what dashboard lists exist', 'organized dashboards', 'dashboard collections'.
Inputs: no named parameters.
List DORA metric deployments for tracking deployment frequency and lead time
Inputs: filter_from, filter_to, filter_service, filter_env, +2 more.
List scheduled downtimes (v2 API). Filter by current/upcoming schedules. Shows muted monitors, scopes, and schedule details.
Inputs: page_limit, page_offset, current_only.
List Datadog fleet agents with version, OS, and status information
Inputs: page_size, page_cursor, filter_query.
List Google Cloud Platform integration accounts connected to Datadog.
Inputs: no named parameters.
Get the total number of active and up hosts in your Datadog account. Quick health check for infrastructure scale.
Inputs: no named parameters.
List all log-based metrics configured for generating custom metrics from log data.
Inputs: no named parameters.
List metric tag configurations. Filter by configured status, tags, activity window.
Inputs: filter_configured, filter_tags_configured, filter_metric, filter_active_within, +3 more.
List monitor notification routing rules showing who gets alerted
Inputs: page_size, page_offset.
List network devices monitored by Datadog NDM with filtering and pagination
Inputs: page_size, page_number, filter_tag, sort.
List Datadog notebooks (investigation documents, runbooks, postmortems)
Inputs: query, count, start, sort_field, +2 more.
List all available permissions in Datadog
Inputs: no named parameters.
List legacy CSPM/CIEM posture management findings (misconfigurations and identity risks). Useful for compliance use-cases. Requires the security_monitoring_findings_read scope.
Inputs: filter, page, snapshotTimestamp, detailedFindings, +1 more.
List running processes with optional filtering by search term or tags. Use for 'what processes are running', 'find java processes', 'process list for host'.
Inputs: search, tags, from, to, +2 more.
Get restriction policy for a specific resource. Shows access control bindings and principals.
Inputs: resource_id (required).
List RBAC roles in your Datadog organization
Inputs: page_size, page_number, filter.
List all RUM applications configured in Datadog. Use to discover which frontend apps are monitored, get application IDs for RUM queries, or see who created them. Companion to search-rum-events.
Inputs: no named parameters.
List scorecard rule evaluation outcomes for services
Inputs: page_size, page_offset, filter_rule_id, filter_service_name.
List service scorecard rules for evaluating service quality
Inputs: page_size, page_offset, filter_rule_id, filter_rule_name.
List security monitoring detection rules with pagination. Shows enabled/disabled rules, names, and types.
Inputs: page_size, page_number.
List Datadog security monitoring detection rules
Inputs: page_size, page_number.
List service definitions from the Datadog Service Catalog. Use for 'what services exist', 'service catalog', 'list all registered services'.
Inputs: pageSize, pageNumber, schemaVersion.
List all span-based metrics (APM custom metrics) configured for generating metrics from APM spans.
Inputs: no named parameters.
List all Synthetics global variables used across synthetic tests for shared configuration like URLs, credentials, and test data.
Inputs: no named parameters.
List available Synthetics testing locations (both managed by Datadog and private). Useful for configuring where synthetic tests run.
Inputs: no named parameters.
List Synthetics private locations for internal testing. Shows private location IDs, names, and tags.
Inputs: no named parameters.
List members of a Datadog team. Shows user roles and membership details.
Inputs: team_id (required), page_size, page_number, sort, +1 more.
List teams in the Datadog organization. Use for 'what teams exist', 'team structure', 'find team by name'.
Inputs: pageNumber, pageSize, sort, filterKeyword.
List users in the Datadog organization. Use for 'who has access', 'list all users', 'find user by email'.
Inputs: pageSize, pageNumber, sort, sortDir, +2 more.
List security vulnerability findings with filtering by tool, type, severity, and status
Inputs: page_token, page_number, filter_type, filter_tool, +13 more.
List all configured webhook integrations. Useful for auditing alert routing and notification channels.
Inputs: no named parameters.
List execution instances for a Datadog workflow. Shows run history, status, and timing.
Inputs: workflow_id (required), page_size, page_number.
List Datadog workflow automations for incident response and remediation
Inputs: page_size, page_number, filter_name.
Query time-series metric data from Datadog. The backbone of observability — use for 'CPU usage over last hour', 'request rate for web service', or any metric query. Query syntax: 'avg:system.cpu.user{host:web-1}'. Returns data points with timestamps.
Inputs: query (required), from (required), to (required).
Search Datadog audit logs for configuration changes, user actions, and API calls
Inputs: filter_query, filter_from, filter_to, page_limit, +2 more.
Search Datadog cases for incident investigation
Inputs: page_size, page_offset, sort_field, filter, +1 more.
Search CI test events with filters. Use for 'find flaky tests', 'test failures in last hour', 'test duration analysis'.
Inputs: filter, sort, page.
Search Error Tracking events across services. Use for 'what errors are happening in production', 'error groups for payment service', 'new errors this week'. Returns error groups with counts, first/last seen, and affected services.
Inputs: filter, sort, page, limit.
Search Datadog error tracking issues for user-facing errors and exceptions
Inputs: filter_query, filter_from, filter_to, page_limit, +2 more.
Search Datadog incidents with advanced filtering by severity, status, and time range
Inputs: query (required), filter_created_start, filter_created_end, page_size, +2 more.
Search and retrieve log entries from Datadog. Use for 'find errors in auth service', 'show logs from last hour', or investigating issues. Query syntax: 'service:web-app status:error', time range: 'now-15m' to 'now'. Returns actual log messages. Use aggregate-logs for counts/stats instead.
Inputs: filter, sort, page, limit.
Search metrics by name pattern with volume and ingestion data. Use for 'find metrics matching pattern', 'metric ingestion volume', 'what metrics are configured'.
Inputs: filterMetric, filterConfigured, filterTagsConfigured, filterActiveWithin, +1 more.
Search Real User Monitoring (RUM) events. Use for 'frontend errors in production', 'slow page loads', 'user session analysis'. Query syntax similar to logs: '@type:error @application.id:abc'. Returns user sessions, views, actions, and errors.
Inputs: filter, sort, page, limit.
List or search Datadog security findings (Cloud Security Management). Use to retrieve findings with a query and optional pagination cursor. Requires security_monitoring_findings_read or appsec_vm_read (OAuth apps still require security_monitoring_findings_read).
Inputs: filter, page, limit.
Search security monitoring signals (threat detections, security alerts). Use for 'recent security alerts', 'threat detections', 'security signal search'.
Inputs: filter, sort, page.
Search and filter SLOs by query string. Supports pagination and faceted search for finding specific SLOs by name, tags, or other attributes.
Inputs: query, page_size, page_number, include_facets.
Search APM spans/traces. Use for 'find slow requests', 'show errors in payment service', or investigating latency. Query syntax: 'service:web status:error @duration:>1s'. Returns individual spans with trace IDs. Use get-trace for full trace context.
Inputs: filter, sort, page, limit.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 117 tools
The tool set contains multiple apparent duplicates, such as get-logs-indexes/get-log-indexes, list_security_rules/list_security_monitoring_rules, and get-downtimes/list_downtime_schedules. The parallel use of dash and underscore names for similar resources (get-containers vs list_containers) further blurs distinctions.
Naming is chaotically mixed: some tools use kebab-case (search-spans, get-containers) while others use snake_case (list_containers, search_incidents), and verbs vary between get/list/search/aggregate without a consistent pattern for resource vs collection operations.
117 tools is an extreme count that creates overwhelming selection overhead for an agent. Even for a broad platform like Datadog, the surface is far too large to navigate efficiently, and many tools overlap or duplicate others.
The set covers a wide range of read operations across many Datadog domains but is heavily biased toward querying and listing. Core management actions like create/update/delete for monitors, dashboards, SLOs, and incidents are missing, leaving significant workflow gaps.
Zero-log MCP server with 49 tools for AI guardrails, secret scanning, MCP linting & EU compliance.
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Query your org's data in natural language — read-only MCP access to SQL, NoSQL, files & warehouses.
The Cortex MCP server provides read-only access to real-time engineering context from the Cortex developer portal, allowing AI coding assistants to answer natural language questions about your organization's catalog (microservices, libraries, domains, teams, infrastructure), scorecards (engineering standards and best practices), initiatives (goals and deadlines), and Engineering Intelligence metrics. It includes tools for querying documentation, tracking personal entities, and accessing AI-assisted insights across the entire Cortex ecosystem.
