datadog-mcp

# Datadog MCP Server

Query Datadog observability data through the official MCP Server.

## Requirements

| Variable | Required | Description |
|---|---|---|
| `DD_API_KEY` | ✅ | Datadog API key (Organization Settings → API Keys) |
| `DD_APP_KEY` | ✅ | Datadog Application key (Organization Settings → Application Keys) |
| `DD_SITE` | Optional | Datadog site (default: `datadoghq.com`) |

## Setup

### Option A: Remote MCP Server (Recommended)

Datadog hosts the MCP server — no local install needed.

```bash
mcporter add datadog \
  --transport http \
  --url "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp" \
  --header "DD-API-KEY:$DD_API_KEY" \
  --header "DD-APPLICATION-KEY:$DD_APP_KEY"
```

To select specific toolsets, append `?toolsets=logs,metrics,monitors` to the URL.

### Option B: Local stdio MCP Server

Use the community `datadog-mcp-server` npm package:

```bash
npx datadog-mcp-server \
  --apiKey "$DD_API_KEY" \
  --appKey "$DD_APP_KEY" \
  --site "$DD_SITE"
```

### Option C: Claude Code / Codex CLI

```bash
claude mcp add --transport http datadog-mcp \
  "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core"
```

## Available Toolsets

| Toolset | Tools | Description |
|---|---|---|
| `core` | General platform tools | Default — always included |
| `logs` | `get_logs` | Search and retrieve log entries |
| `traces` | `list_spans`, `get_trace` | Investigate distributed traces |
| `metrics` | `list_metrics`, `get_metrics` | Query timeseries metrics data |
| `monitors` | `get_monitors` | Retrieve monitor configs and status |
| `hosts` | `list_hosts` | Infrastructure host information |
| `incidents` | `list_incidents`, `get_incident` | Incident management |
| `dashboards` | `list_dashboards` | Discover dashboards |
| `synthetics` | Synthetic test tools | Synthetic monitoring tests |
| `workflows` | Workflow automation tools | List, inspect, execute workflows |

Select toolsets via URL query parameter: `?toolsets=logs,metrics,monitors,incidents`

## Usage Examples

- **Error investigation:** *"Show me error logs from service:api-gateway in the last hour"* — uses `get_logs` with query filters
- **Monitor status:** *"Are there any triggered monitors for the payments service?"* — uses `get_monitors` with service tag filter
- **Metrics query:** *"Show me p99 latency for web-app over the last 4 hours"* — uses `list_metrics` then `get_metrics` for timeseries
- **Incident response:** *"List active incidents"* — uses `list_incidents`
- **Trace investigation:** *"Find slow spans for service:checkout taking over 5s"* — uses `list_spans` with duration filter

## Operational Runbooks

- `references/incident-response.md` — step-by-step incident triage via MCP
- `references/troubleshooting.md` — log/trace/metric correlation patterns
- `references/api-reference.md` — complete tool parameters and response schemas

## Multi-Site Support

| Region | Site |
|---|---|
| US1 (default) | `datadoghq.com` |
| US3 | `us3.datadoghq.com` |
| US5 | `us5.datadoghq.com` |
| EU | `datadoghq.eu` |
| AP1 | `ap1.datadoghq.com` |
| US1-FED | `ddog-gov.com` |

For the remote MCP server, the site is determined by your API key's org. For the local server, pass `--site`.

## Security Notes

- API keys grant read access to your Datadog org — treat them as secrets
- Application keys inherit the permissions of the user who created them
- Use scoped application keys with minimal permissions for production
- The remote MCP server runs on Datadog infrastructure — data does not leave Datadog
- The local stdio server runs on your machine — API calls go directly to Datadog's API