Datadog MCP Server

Query Datadog observability data through the official MCP Server.

Requirements

| Variable | Required | Description | |---|---|---| | DD_API_KEY | ✅ | Datadog API key (Organization Settings → API Keys) | | DD_APP_KEY | ✅ | Datadog Application key (Organization Settings → Application Keys) | | DD_SITE | Optional | Datadog site (default: datadoghq.com) |

Setup

Option A: Remote MCP Server (Recommended)

Datadog hosts the MCP server — no local install needed.

mcporter add datadog \
  --transport http \
  --url "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp" \
  --header "DD-API-KEY:$DD_API_KEY" \
  --header "DD-APPLICATION-KEY:$DD_APP_KEY"

To select specific toolsets, append ?toolsets=logs,metrics,monitors to the URL.

Option B: Local stdio MCP Server

Use the community datadog-mcp-server npm package:

npx datadog-mcp-server \
  --apiKey "$DD_API_KEY" \
  --appKey "$DD_APP_KEY" \
  --site "$DD_SITE"

Option C: Claude Code / Codex CLI

claude mcp add --transport http datadog-mcp \
  "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core"

Available Toolsets

| Toolset | Tools | Description | |---|---|---| | core | General platform tools | Default — always included | | logs | get_logs | Search and retrieve log entries | | traces | list_spans, get_trace | Investigate distributed traces | | metrics | list_metrics, get_metrics | Query timeseries metrics data | | monitors | get_monitors | Retrieve monitor configs and status | | hosts | list_hosts | Infrastructure host information | | incidents | list_incidents, get_incident | Incident management | | dashboards | list_dashboards | Discover dashboards | | synthetics | Synthetic test tools | Synthetic monitoring tests | | workflows | Workflow automation tools | List, inspect, execute workflows |

Select toolsets via URL query parameter: ?toolsets=logs,metrics,monitors,incidents

Usage Examples

• Error investigation: "Show me error logs from service:api-gateway in the last hour" — uses get_logs with query filters
• Monitor status: "Are there any triggered monitors for the payments service?" — uses get_monitors with service tag filter
• Metrics query: "Show me p99 latency for web-app over the last 4 hours" — uses list_metrics then get_metrics for timeseries
• Incident response: "List active incidents" — uses list_incidents
• Trace investigation: "Find slow spans for service:checkout taking over 5s" — uses list_spans with duration filter

Operational Runbooks

• references/incident-response.md — step-by-step incident triage via MCP
• references/troubleshooting.md — log/trace/metric correlation patterns
• references/api-reference.md — complete tool parameters and response schemas

Multi-Site Support

| Region | Site | |---|---| | US1 (default) | datadoghq.com | | US3 | us3.datadoghq.com | | US5 | us5.datadoghq.com | | EU | datadoghq.eu | | AP1 | ap1.datadoghq.com | | US1-FED | ddog-gov.com |

For the remote MCP server, the site is determined by your API key's org. For the local server, pass --site.

Security Notes

• API keys grant read access to your Datadog org — treat them as secrets
• Application keys inherit the permissions of the user who created them
• Use scoped application keys with minimal permissions for production
• The remote MCP server runs on Datadog infrastructure — data does not leave Datadog
• The local stdio server runs on your machine — API calls go directly to Datadog's API