Datadog

io.github.us-allPublished by GitHub account us-allv1.21.1Updated Oct 24, 2026

Datadog MCP — 165 tools for metrics, monitors, logs, APM, RUM, incidents, CI/CD, fleet

VerifiedSTDIODesktop onlyCloud & InfrastructureSecurity & MonitoringData & Analytics

Overview

AI-generated overview

A self-hosted Datadog MCP server exposing 163 tools so an assistant can query and, when enabled, change metrics, monitors, logs, APM, RUM, SLOs, incidents and

What you can do
Query metrics, hosts, containers, processes, logs, spans and audit logs, and aggregate log and metric data into structured results with field projection to save context tokens. Read and manage monitors, dashboards, notebooks, events and downtimes, including an aggregation tool that summarizes monitor state. Work with SLOs, including creating, updating and deleting them and their corrections, plus a compliance snapshot. Inspect and manage RUM applications, metrics and retention filters, Synthetics tests, security signals, rules and suppressions, CI pipelines and tests, error tracking, DORA, network devices, cases, incidents, teams, on-call schedules and services. Run fleet automation and full
When to use it
Use it when you want an assistant to investigate Datadog incidents, audit monitor noise, check SLO error budgets, analyze RUM or APM error spikes, or manage SLOs, fleet rollouts and status pages from a self-hosted setup, including internal or sovereign Datadog sites.
Requirements
Runs locally over stdio via npx or Docker (Node.js 22+ for source builds). Requires a Datadog API key (DD_API_KEY) and application key (DD_APP_KEY); DD_SITE selects the site, defaulting to US5. Optional HTTP transport needs MCP_HTTP_TOKEN. Network access to the Datadog API.
Before you install
The API and application keys grant access to your Datadog account and are passed as environment variables. Writes are blocked by default; setting DD_ALLOW_WRITE=true enables create, update and delete tools for monitors, dashboards, SLOs, Synthetics, downtimes, cases, teams, security rules and suppressions, fleet and status pages, plus sending logs and events. Optional HTTP mode without MCP_HTTP_SKIP_AUTH needs a bearer token.

Installation

In SourceWeft

  1. Open Datadog in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Datadog MCP Server

The Datadog MCP that answers "why is this happening?" — not just "what's the value?"

Aggregation tools that fold 5–7 sequential API calls into one structured response. Full SLO CRUD. Fleet automation. The widest Datadog API coverage in any MCP — 163 tools built on the @us-all MCP standard.

[npm] [downloads] [tools] [@us-all standard] [Glama MCP server]

What it does that others don't

  • Aggregation tools — analyze-monitor-state and slo-compliance-snapshot collapse 5–7 sequential API calls into one structured response with a caveats array for partial failures. No other Datadog MCP ships this pattern.
  • Full SLO CRUD — create, update, delete SLOs (and their corrections). The official Bits AI MCP and community alternatives are read-only on SLOs.
  • Fleet Automation — 15 tools across deployments and schedules. Only this server.
  • Status Pages — 21 tools for full status-page lifecycle (components, degradations, maintenances). Only this server.
  • Token-efficient by design — extractFields projection, DD_TOOLS/DD_DISABLE 16-category toggles, and a search-tools meta-tool keep LLM context low across 163 tools.
  • Apps SDK card — slo-compliance-snapshot renders as a visual card on ChatGPT clients via _meta["openai/outputTemplate"]. Claude clients receive the same JSON content (non-breaking).
  • stdio + Streamable HTTP — defaults to stdio (Claude Desktop / Code). Set MCP_TRANSPORT=http for ChatGPT Apps SDK or remote clients (Bearer auth via MCP_HTTP_TOKEN).

Try this — 5 prompts

Connect the server to Claude Desktop or Claude Code, then paste any of these:

  1. SLO health — "List my SLOs and their error budget remaining this month. Group by status: compliant, at-risk, breached."
  2. Incident triage — "There's an active incident on checkout-service. Pull the linked monitors, the recent error spikes from APM, and which deployments touched the service in the last 24h."
  3. Monitor noise audit — "Find monitors that alerted more than 10 times in the last 7 days but had MTTR under 5 minutes — these are probably flapping."
  4. RUM error spike — "RUM error rate jumped on the checkout funnel between 14:00 and 14:30 today. Show me the top error groups, affected sessions, and the user actions before the errors."
  5. Fleet rollout — "Schedule the datadog-agent 7.55.0 rollout to the staging cluster, weekends only, starting next Saturday."

When to use this vs Datadog's official MCP

Datadog's official MCP (Bits AI MCP, GA 2026-03-09) is complementary, not a replacement:

Official Datadog MCP@us-all/datadog-mcp (this)
Tool count16+ core toolsets163 tools across full API surface
DeploymentRemote (managed by Datadog)Self-host stdio (npx / Docker / npm)
AuthDatadog SSOAPI + APP key
SitesPublic Datadog sitesAny site, incl. internal/sovereign; US5 default
SLO writes❌✅ create/update/delete SLOs + corrections
Fleet automation❌✅ 15 tools
Status pages❌✅ 21 tools
Aggregation tools❌✅ analyze-monitor-state, slo-compliance-snapshot
MCP Prompts❌✅ 4 (triage-incident, audit-monitor-noise, analyze-rum-error-spike, investigate-slow-trace)
MCP Resources❌✅ dd://service/{serviceName}, dd://team/{teamId}, dd://synthetics/{testId}, etc.

Use the official Bits AI MCP for fast managed onboarding and SSO. Use this when you need full API coverage, SLO/fleet/status-page write parity, or self-hosting (internal sites, isolated networks, dev/CI sandboxes).

Install

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "datadog": {      "command": "npx",      "args": ["-y", "@us-all/datadog-mcp"],      "env": {        "DD_API_KEY": "<your-api-key>",        "DD_APP_KEY": "<your-app-key>",        "DD_SITE": "datadoghq.com"      }    }  }}

Claude Code

bash
claude mcp add datadog -s user \  -e DD_API_KEY=<your-api-key> -e DD_APP_KEY=<your-app-key> -e DD_SITE=datadoghq.com \  -- npx -y @us-all/datadog-mcp

Docker

bash
docker run -e DD_API_KEY=... -e DD_APP_KEY=... -e DD_SITE=datadoghq.com \  ghcr.io/us-all/datadog-mcp-server:latest

Build from source

bash
git clone https://github.com/us-all/datadog-mcp-server.gitcd datadog-mcp-server && pnpm install && pnpm buildnode dist/index.js

Configuration

VariableRequiredDefaultDescription
DD_API_KEY✅—Datadog API key
DD_APP_KEY✅—Datadog Application key
DD_SITE❌us5.datadoghq.comDatadog site (see table below)
DD_ALLOW_WRITE❌falseSet true to enable mutations (create/update/delete)
DD_TOOLS❌—Comma-sep allowlist of categories. Only these load — biggest token saver.
DD_DISABLE❌—Comma-sep denylist. Ignored when DD_TOOLS is set.
MCP_TRANSPORT❌stdiohttp to enable Streamable HTTP transport
MCP_HTTP_TOKENconditional—Bearer token. Required when MCP_TRANSPORT=http
MCP_HTTP_PORT❌3000HTTP listen port
MCP_HTTP_HOST❌127.0.0.1HTTP bind host (DNS rebinding protection auto-enabled for localhost)
MCP_HTTP_SKIP_AUTH❌falseSkip Bearer auth — e.g. behind a reverse proxy that handles it

Categories (16): metrics, monitors, dashboards, logs, apm, rum, incidents, security, synthetics, ci, infra, fleet, status-pages, oncall, teams, account.

When MCP_TRANSPORT=http: POST /mcp (Bearer-auth JSON-RPC) + GET /health (public liveness).

Sites:

SiteValueRegion
US1datadoghq.comUS (Virginia)
US3us3.datadoghq.comUS (Virginia)
US5us5.datadoghq.comUS (Oregon)
EU1datadoghq.euEU (Frankfurt)
AP1ap1.datadoghq.comAsia-Pacific (Tokyo)

Token efficiency

Naive setup loads ~25K tokens of tool schema before any conversation. Three knobs mitigate:

ScenarioToolsSchema tokensvs default
default (all categories)16325,200—
typical (DD_TOOLS=metrics,monitors,logs,apm,dashboards)559,300−63%
narrow (DD_TOOLS=metrics,monitors)243,800−85%
  1. Category toggles — DD_TOOLS=metrics,monitors,logs,apm (biggest win).
  2. extractFields response projection — get-dashboard { dashboardId: "abc", extractFields: "id,title,widgets.*.definition.type" }.
  3. search-tools meta-tool — always enabled; lets the LLM discover tools at runtime instead of preloading all schemas.

Read-only mode

By default, all writes are blocked to prevent accidental mutations by AI agents. The following require DD_ALLOW_WRITE=true:

create-monitor, update-monitor, delete-monitor, mute-monitor, create-dashboard, update-dashboard, delete-dashboard, send-logs, post-event, trigger-synthetics, create-synthetics-test, update-synthetics-test, delete-synthetics-test, create-downtime, cancel-downtime, create-case, update-case-status, send-dora-deployment, send-dora-incident, create-slo, update-slo, delete-slo, plus all fleet/status-page/security writes.

MCP Prompts (4)

Workflow templates the model can invoke directly:

  • triage-incident — given an incident ID, walks linked monitors, recent error spikes, and recent deploys.
  • audit-monitor-noise — flag flapping monitors via alert frequency × MTTR.
  • analyze-rum-error-spike — diff RUM error rates across two windows, attribute to top error groups.
  • investigate-slow-trace — given a slow trace ID, traverse the span tree and surface bottleneck spans.

MCP Resources

Read-only entities by URI: dd://monitor/{id}, dd://dashboard/{id}, dd://slo/{id}, dd://incident/{id}, dd://service/{serviceName}, dd://team/{teamId} (team + members), dd://synthetics/{testId}, dd://host/{name}.

Tool reference

163 tools across 16 categories. Use the search-tools meta-tool to discover at runtime; the full list is collapsed below.

DomainTools
Status Pages21
RUM (events + apps + metrics + retention)27
Metrics, Hosts, SLOs, Downtimes, Containers, Processes19
Fleet Automation15
Synthetics, Logs/Spans Metrics, SLO Corrections16
Monitors, Dashboards, Notebooks, Events16
Incidents, Cases, Error Tracking, Audit13
OnCall, Teams, Users, Services, Bots11
Security signals + rules + suppressions9
APM, CI Visibility, DORA, Network Devices9
+ aggregationsanalyze-monitor-state, slo-compliance-snapshot
+ metasearch-tools
Full tool list (click to expand)

Metrics (5)

query-metrics, get-metrics, get-metric-metadata, list-active-metrics, list-metric-tags

Monitors (7)

get-monitors, get-monitor, create-monitor, update-monitor, delete-monitor, mute-monitor, validate-monitor, analyze-monitor-state (aggregation)

Dashboards (5)

get-dashboards, get-dashboard, create-dashboard, update-dashboard, delete-dashboard

Logs (3)

search-logs, aggregate-logs, send-logs

Events (2)

get-events, post-event

Incidents (6)

get-incidents, get-incident, search-incidents, create-incident, update-incident, delete-incident

APM (1)

search-spans

RUM (17)

search-rum-events, aggregate-rum, list-rum-applications, get-rum-application, create-rum-application, update-rum-application, delete-rum-application, list-rum-metrics, get-rum-metric, create-rum-metric, update-rum-metric, delete-rum-metric, list-rum-retention-filters, get-rum-retention-filter, create-rum-retention-filter, update-rum-retention-filter, delete-rum-retention-filter

SLOs (6)

list-slos, get-slo, get-slo-history, create-slo, update-slo, delete-slo, slo-compliance-snapshot (aggregation), plus 5 SLO-correction tools

Synthetics (6)

list-synthetics, get-synthetics-result, trigger-synthetics, create-synthetics-test, update-synthetics-test, delete-synthetics-test

Hosts / Containers / Processes (4)

list-hosts, get-host-totals, list-containers, list-processes

Downtimes (3)

list-downtimes, create-downtime, cancel-downtime

Security (9)

search-security-signals, get-security-signal, list-security-rules, get-security-rule, delete-security-rule, list-security-suppressions, get-security-suppression, create-security-suppression, delete-security-suppression

CI Visibility (4)

search-ci-pipelines, aggregate-ci-pipelines, search-ci-tests, aggregate-ci-tests

Cases (4)

list-cases, get-case, create-case, update-case-status

Error Tracking (2)

list-error-tracking-issues, get-error-tracking-issue

DORA (2)

send-dora-deployment, send-dora-incident

Network Devices (2)

list-network-devices, get-network-device

Notebooks (2)

list-notebooks, get-notebook

OnCall (2)

get-team-oncall, get-oncall-schedule

Services & Software Catalog (2)

list-services, get-service-definition

Teams (6)

list-teams, get-team, create-team, update-team, delete-team, get-team-members

Account & Users (2)

get-usage-summary, list-users

Logs/Spans/APM Retention metrics (15)

5 each for logs-metrics, spans-metrics, apm-retention-filters (list/get/create/update/delete)

Status Pages (21)

Full lifecycle: pages, components, degradations, maintenances. See src/tools/status-pages.ts.

Fleet Automation (15)

Agents, deployments, schedules. See src/tools/fleet.ts.

Audit (1)

search-audit-logs

Meta (1)

search-tools — query other tools by keyword; always enabled regardless of DD_TOOLS.

Architecture

Claude → MCP stdio → index.ts → tools/*.ts → @datadog/datadog-api-client → Datadog API

Built on @us-all/mcp-toolkit:

  • extractFields — token-efficient response projections
  • aggregate(fetchers, caveats) — fan-out helper for aggregation tools
  • createWrapToolHandler — domain-specific redaction (DD_API_KEY/DD_APP_KEY) + Datadog ApiException error extraction
  • search-tools meta-tool

Tech stack

Node.js 22+ • TypeScript strict ESM • pnpm • @modelcontextprotocol/sdk • @datadog/datadog-api-client (official) • zod • dotenv • vitest + dd-trace.

Contributing

See CONTRIBUTING.md. New shared patterns belong in @us-all/mcp-toolkit — single source of truth for the 7-server suite.

License

MIT

Source: README.md at commit e943fa7

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.21.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts