Most tools target a clearly distinct resource+action pair, and the RUM group separates applications, events, grouped counts, performance, and waterfall. Minor overlap exists between get_rum_events and get_rum_grouped_event_count, and get_all_services is a log-derived helper that could be mistaken for a general listing tool.

Names consistently use snake_case with verb_noun ordering (list_*, get_*, mute_host, schedule_downtime). There are minor deviations where 'get' is used for list-like operations (get_monitors, get_logs, get_rum_applications) instead of 'list', but the pattern remains readable.

21 tools cover a broad Datadog surface (incidents, metrics, logs, monitors, dashboards, traces, hosts, downtimes, RUM), so the count is justified by the domain. It sits at the upper end of comfortable scope but each tool maps to a real capability.

The surface covers the key read/monitoring workflows plus some write actions (host mute/unmute, downtime schedule/cancel). Gaps remain in write coverage for incidents, monitors, and dashboards (no create/update/mute), but core observability workflows are workable.