Datadog MCP Server: Connect Datadog to Claude, Cursor and VS Code

• Finds log lines that match your filters

  Core toolset. Searches your logs by time, query, service, host and storage tier, and returns the matching log entries.

  Try: “Show me error logs from the nginx service in the last hour.”

  Read · search_datadog_logs

• Counts and totals logs with SQL

  Core toolset. Runs SQL over your logs to count, group and total them, which suits statistics more than reading single lines.

  Try: “Count error logs by service in the last hour.”

  Read · analyze_datadog_logs

• Charts metric values over time

  Core toolset. Queries current or past metric data with custom queries and aggregations, so you can see how a number moved over a period.

  Try: “Show me CPU utilization metrics for all hosts in the last 4 hours.”

  Read · get_datadog_metric

• Shows a metric's tags and details

  Core toolset. Returns a metric's metadata, its available tags and the values of those tags, so you know what you can filter or group by.

  Try: “What tags are available for the system.cpu.user metric?”

  Read · get_datadog_metric_context

• Lists the metrics you have

  Core toolset. Lists the metrics in your account, with options to filter by name or tag and to include metadata.

  Try: “Show me all available Redis metrics.”

  Read · search_datadog_metrics

• Lists monitors and their status

  Core toolset. Retrieves monitors with their current status, thresholds and alert conditions, so you can see what is firing.

  Try: “List all monitors that are currently alerting.”

  Read · search_datadog_monitors

• Lists incidents by state and severity

  Core toolset. Retrieves a list of incidents with their state, severity and other details.

  Try: “Show me all active incidents by severity.”

  Read · search_datadog_incidents

• Shows the details of one incident

  Core toolset. Retrieves detailed information about a single incident. It does not include the incident timeline.

  Try: “What's the status of incident ABC123?”

  Read · get_datadog_incident

• Finds events like deploys and alerts

  Core toolset. Searches events such as monitor alerts, deployments, infrastructure changes, security findings and service status changes.

  Try: “Show me all deployment events from the last 24 hours.”

  Read · search_datadog_events

• Lists your monitored hosts

  Core toolset. Lists and filters the hosts Datadog monitors, for example by tag or by whether they have stopped reporting.

  Try: “List unhealthy hosts that haven't reported in the last hour.”

  Read · search_datadog_hosts

• Finds services, owners and dependencies

  Core toolset. Searches the Datadog Catalog for who owns a service and what sits upstream and downstream of it.

  Try: “What downstream services does the payment API depend on?”

  Read · search_datadog_entities

• Finds traced requests that match filters

  Core toolset. Retrieves spans from APM traces filtered by service, time, resource and similar fields.

  Try: “Show me spans with errors from the checkout service.”

  Read · search_datadog_spans

• Totals trace data like counts and p95

  Core toolset. Computes counts, averages, maxima and percentiles over spans, grouped by fields like service or resource, or as a timeseries.

  Try: “What is the p95 duration by resource for the checkout service over the last hour?”

  Read · aggregate_spans

• Opens one full trace by its ID

  Core toolset. Fetches a complete APM trace from a trace ID. Very large traces may be cut short, and the result says so.

  Try: “Show me all spans for trace abc123 with timing information.”

  Read · get_datadog_trace

• Finds user-session events from your app

  Core and RUM toolset. Searches Real User Monitoring events, such as page loads, errors and user interactions, using advanced query syntax.

  Try: “Find pages that are loading slowly (more than 3 seconds).”

  Read · search_datadog_rum_events

• Totals user-session data like errors by page

  Core and RUM toolset. Computes counts, averages and percentiles over RUM events with grouping. Use it for trends, not for single events.

  Try: “Count JavaScript errors by page in the last 24 hours.”

  Read · aggregate_rum_events

• Lists dashboards you can open

  Core toolset. Lists available dashboards with key details. It does not show widget contents, so open one afterwards to see them.

  Try: “Show me all available dashboards in our account.”

  Read · search_datadog_dashboards

• Shows one dashboard's widgets

  Core and dashboards toolset. Retrieves a dashboard by ID with its title, description, tags and widgets.

  Try: “Get the full details of dashboard ps7-mn3-kwf.”

  Read · get_datadog_dashboard

• Finds notebooks by author, tag or content

  Core toolset. Lists and searches notebooks, filtering by author, tags and content.

  Try: “List notebooks tagged with incident-response.”

  Read · search_datadog_notebooks

• Opens one notebook

  Core toolset. Retrieves a notebook by ID, including its name, status and author.

  Try: “Get details for notebook abc-123-def.”

  Read · get_datadog_notebook

• Creates a new notebook

  Core toolset. Creates a new Datadog notebook, for example to write up an investigation.

  Try: “Create a notebook to document the investigation into the checkout service latency spike.”

  Write · create_datadog_notebook

• Changes an existing notebook

  Core toolset. Edits an existing notebook, so use it with care on notebooks other people rely on.

  Try: “Update the incident response notebook with today's findings.”

  Write · edit_datadog_notebook

• Creates or updates a dashboard

  Core and dashboards toolset. Creates a dashboard, or updates an existing one when you give its ID. Updating changes the live dashboard.

  Try: “Add a timeseries widget for error rate to dashboard abc-123-def.”

  Write · upsert_datadog_dashboard

• Deletes a notebook (recoverable)

  Core and notebooks toolset. Soft-deletes a notebook by its numeric ID. You can restore it within 30 days.

  Try: “Delete notebook 12345678.”

  Delete · delete_datadog_notebook

• Restores a deleted notebook

  Core and notebooks toolset. Restores a soft-deleted notebook by its numeric ID, but only within 30 days of deletion.

  Try: “Restore the notebook with ID 12345678 that I deleted by mistake.”

  Write · recover_datadog_notebook

Watch out for

• Write tools can delete and reconfigure resources

  With the mcp_write permission, the assistant can delete dashboards for good, remove log indexes, pipelines and archives, and change security rules. Give people mcp_read only, or connect with read-only OAuth access. docs.datadoghq.com

• The default tools can change notebooks and dashboards

  Even without extra toolsets, the core set can create, edit and delete notebooks, and create or overwrite dashboards. Deleted notebooks can be recovered for 30 days; drop the write tools with omit_tools if you want reads only. docs.datadoghq.com

• Logs and traces may contain secrets or personal data

  Whatever a tool returns goes to your AI provider under your agreement with them. Limit what people can see with roles, Data Access Control and log restriction queries. docs.datadoghq.com

• Every call is recorded in Audit Trail

  Admins can see the tool name, arguments, user and client for each call, so they can review what an agent did. docs.datadoghq.com

• API keys work as a broad fallback

  API and application keys act with the key owner's permissions. Datadog recommends scoped keys from a service account, and a revoked sign-in keeps working until its token expires. docs.datadoghq.com

Security advisories

In their words