Datadog MCP Server

Query Datadog observability data through the official MCP Server.

Requirements

Variable	Required	Description
INLINECODE0	✅	Datadog API key (Organization Settings → API Keys)
INLINECODE1

✅ | Datadog Application key (Organization Settings → Application Keys) | | DD_SITE | Optional | Datadog site (default: datadoghq.com) |

Setup

Option A: Remote MCP Server (Recommended)

Datadog hosts the MCP server — no local install needed.

CODEBLOCK0

To select specific toolsets, append ?toolsets=logs,metrics,monitors to the URL.

Option B: Local stdio MCP Server

Use the community datadog-mcp-server npm package:

CODEBLOCK1

Option C: Claude Code / Codex CLI

CODEBLOCK2

Available Toolsets

Toolset	Tools	Description
INLINECODE6	General platform tools	Default — always included
INLINECODE7

get_logs | Search and retrieve log entries | | traces | list_spans, get_trace | Investigate distributed traces | | metrics | list_metrics, get_metrics | Query timeseries metrics data | | monitors | get_monitors | Retrieve monitor configs and status | | hosts | list_hosts | Infrastructure host information | | incidents | list_incidents, get_incident | Incident management | | dashboards | list_dashboards | Discover dashboards | | synthetics | Synthetic test tools | Synthetic monitoring tests | | workflows | Workflow automation tools | List, inspect, execute workflows |

Select toolsets via URL query parameter: INLINECODE26

Usage Examples

• - Error investigation: "Show me error logs from service:api-gateway in the last hour" — uses get_logs with query filters
• Monitor status: "Are there any triggered monitors for the payments service?" — uses get_monitors with service tag filter
• Metrics query: "Show me p99 latency for web-app over the last 4 hours" — uses list_metrics then get_metrics for timeseries
• Incident response: "List active incidents" — uses INLINECODE31
• Trace investigation: "Find slow spans for service:checkout taking over 5s" — uses list_spans with duration filter

Operational Runbooks

• - references/incident-response.md — step-by-step incident triage via MCP
• INLINECODE34 — log/trace/metric correlation patterns
• INLINECODE35 — complete tool parameters and response schemas

Multi-Site Support

Region	Site
US1 (default)	INLINECODE36
US3

us3.datadoghq.com | | US5 | us5.datadoghq.com | | EU | datadoghq.eu | | AP1 | ap1.datadoghq.com | | US1-FED | ddog-gov.com |

For the remote MCP server, the site is determined by your API key's org. For the local server, pass --site.

Security Notes

• - API keys grant read access to your Datadog org — treat them as secrets
• Application keys inherit the permissions of the user who created them
• Use scoped application keys with minimal permissions for production
• The remote MCP server runs on Datadog infrastructure — data does not leave Datadog
• The local stdio server runs on your machine — API calls go directly to Datadog's API