Datadog MCP for AI Agents

Check whether Datadog App and API Protection (AAP) can be enabled for a service via Remote Configuration (RC), with no code changes.

Step-by-step instructions for enabling Datadog App and API Protection (AAP) to monitor and secure your application.

Create records in a dataset.

Aggregate and analyze CI pipeline events to produce statistics, metrics, and grouped analytics.

Aggregate Datadog Test events.

Aggregate DORA events into scalar values or timeseries using composable 'queries' + 'formulas', like get_datadog_metric — delivery-performance analytics across deployments, commits, and pull requests.

Aggregate Datadog events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals.

Aggregate Datadog RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals.

Aggregate Datadog APM spans to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals.

Queries Cloud Network Monitoring (CNM) data to view network/transport level information.

Analyze Datadog Error Tracking error samples with SQL — aggregations, breakdowns by tag/service/version, or raw sample inspection.

Analyze Datadog logs using SQL.

Primary tool for analyzing security findings.

Count, group, or trend security signals using DDSQL — for any aggregate question: 'how many', 'top N', 'by severity', 'over time', or breakdown.

Primary tool for analyzing security findings.

Create a new RUM retention filter, appended at the end of the evaluation order.

Append (add) new rows to an existing reference table.

Archive a single feature flag by ID or key; pair with list-stale-feature-flags to discover candidates.

Archive a saved filter (reversible via unarchive-saved-filter).

Get targeted instructions for building a Datadog widget.

Assign or unassign security findings to a user.

Insert, update, and delete dataset records in one versioned operation.

Step-by-step instructions for adding initial Datadog setup to a frontend browser-based project environment.

Translates a natural-language description into a correct Audit Trail query string.

Cancel a running Datadog Workflow Automation execution instance.

PRIMARY TOOL FOR EXISTING FLAGS!

Clean up a stale feature flag by key — auto-archives if no code references are known, otherwise returns the repos and files where the flag is still referenced plus a Datadog UI link and instructs the user to use Bits dev in the UI to remove those references (archiving stays blocked until they are gone).

Clone an existing Datadog form.

Copy a dataset's current records into a new dataset in the same project.

Configure Datadog Code Coverage for a project by adding coverage report uploads to the CI pipeline.

Lists an organization's Cloud Cost Management (CCM) cost-saving recommendations.

Create a new Datadog form with a name.

Creates a Datadog monitor in DRAFT mode (no notifications sent, priority 5).

Creates a new Datadog notebook.

Creates a published analysis (also called a published dataset) from a notebook cell.

Create a new Cloud SIEM detection rule by POSTing the supplied payload to POST /api/v2/security_monitoring/rules.

Create a security findings automation rule.

Create a case, Jira issue, ServiceNow ticket, or Linear issue for security findings.

Create a new security monitoring suppression rule in Datadog.

Create an unpublished Datadog Workflow Automation workflow from a complete spec.

Create a new Feature Management environment.

Create a new feature flag with a FEATURE_GATE allocation linked to a standard experiment.

PRIMARY TOOL FOR NEW FLAGS in a project that already has Datadog feature flags wired up!

Create a Synthetics global variable.

Create an empty dataset inside a project.

Create a new LLM Observability experiment object in a project.

Create an LLM Observability **experiments project** — the container that owns datasets and experiments.

Create the onboarding proof flag: a predictable boolean flag (disabled=false, enabled=true; default disabled) with a catch-all FEATURE_GATE allocation serving enabled=true in the selected NON-PRODUCTION environment, tagged source:agentic-onboarding.

Create or update an LLM-judge evaluator configuration.

Create a new reference table.

Create a saved filter: a reusable, named set of targeting rules that feature flags can reference.

Get the schema (available fields) for Workload Protection (CWS) agent events.

Generate a Datadog UI link to the DDSQL editor with the given query pre-populated.

Get a compact DDSQL capability spec with supported SQL functions, SQL keywords, and DDSQL-specific deltas from vanilla PostgreSQL.

Read a single saved DDSQL query by its query_id.

Run a DDSQL query and return results.

Get static SQL columns for a DDSQL table from schema metadata.

Search DDSQL datasets across four providers: public tables, reference tables, metrics, and published analyses.

Search and rank fields for an unstructured DDSQL source.

Search and list saved DDSQL queries.

Create or update a saved DDSQL query.

Permanently deletes a Datadog dashboard by ID.

Unpublishes a published analysis by ID.

Delete an AAP (App & API Protection) WAF custom rule by id.

Delete one or more Cloud SIEM detection rules by ID.

Delete a security findings automation rule.

Delete a security monitoring suppression rule in Datadog.

Delete an AAP (App & API Protection) passlist/allowlist entry — also known as a WAF exclusion filter — by exclusion_filter_id.

Permanently delete a Datadog spreadsheet by ID.

Delete a Datadog Workflow Automation workflow by ID.

Delete Data Quality monitor annotations by id.

Delete an LLM-judge evaluator configuration by name.

Delete experiment runs by ID.

Delete a RUM custom metric by ID.

Permanently delete a RUM retention filter by ID.

Get detailed information about a specific Kubernetes resource.

Detach security findings from their linked case (and any downstream Jira issue, ServiceNow ticket, or Linear issue).

Step-by-step instructions for adding initial Datadog RUM SDK to a project environment.

Compare two ndm network device configuration snapshots and return a unified diff.

Installs and configures the Datadog Agent container to collect infrastructure metrics, container telemetry, APM traces, and logs.

do-not-call

Step-by-step instructions for adding initial Datadog Observability setup to ECS applications and configurations.

Edits an existing notebook.

Partially edit a Synthetics global variable by id.

Edit the configuration of a Synthetics test.

Start a new execution instance for a Datadog Workflow Automation workflow by ID.

Load the children of specific spans in a trace, enabling progressive tree exploration.

Explore a call graph to identify hot call relationships for the provided profile type.

Obtain a list of top stacktraces based on their value contribution for the provided profile type.

Analyze timeline activity showing lane groups (threads, GC, etc.

Discover and rank database instances for DBM investigation.

Find all error spans in a trace with propagation context.

Generates a monitor message with What's Happening, Impact, and Links sections from a monitor query.

do-not-call

Get the health status of an autonomous system (AS) using Network Path data.

Get results from completed or in-progress canary experiments for a feature flag.

Retrieve change events for an APM service over a time range.

Return the entity type schema for every platform this org has data in.

Fetch aggregated code coverage summary metrics for a repository branch.

Fetch aggregated code coverage summary metrics for a repository commit.

Fetch per-file code coverage line data for a repository commit, branch, or pull request.

Fetch aggregated code coverage summary metrics for a pull request.

Retrieves a custom or integration Datadog dashboard by ID, returning its title, description, tags, widgets, and template variables.

Identify upstream APM services and resources that call database queries.

Retrieve explain plans for a query signature within a timeframe.

Run database health checks to identify potential issues.

Analyze a specific SQL query's performance — use when investigating slow queries, high database load, or resource-intensive queries.

Retrieve the SQL statement text for a given query signature.

Retrieve live database recommendations for a database, query, table, host, or index.

Fetch schema definitions (columns, indexes, foreign keys, partitions) for one or more database objects.

Get detailed information about a specific Error Tracking Issue from Datadog.

Search for flaky tests from Datadog's Test Optimization API.

Returns the Flaky Tests Management (FTM) policies configured for a repository.

Get a specific Datadog form by its ID, including full metadata and datastore configuration.

Get detailed information about a specific Datadog incident by ID, including status, severity, timeline, associated users, and attachments.

Get the YAML manifest for a specific Kubernetes resource.

Query metrics data from Datadog.

Get metadata (description, type, unit, integration), available tags/dimensions, and optionally related assets for a metric.

Retrieve information about a specific Datadog notebook by ID.

Get the org-wide AAP (App & API Protection, formerly ASM / Application Security Monitoring) blocking configuration.

Get AAP (App & API Protection, formerly ASM / Application Security Monitoring) WAF custom rules — user-authored in-app WAF rules that match request traffic and either monitor it or block it.

List AAP (App & API Protection) denylist entries — IPs, users, user-agents AAP currently BLOCKS or monitors via automated security response.

Get security detection rules.

Return the schema / authoring reference for Datadog Cloud SIEM detection rules.

Call this first before using analyze_datadog_security_findings.

Get ranked project and integration suggestions for creating Jira issues, ServiceNow tickets, or Linear issues.

Retrieve full detail for one IoC indicator by value (score, category, AS info, GeoIP, log sources, services, signal counts, OCSF fields).

Discover filterable fields and their values for IoC Explorer.

Get the full details of a single Datadog security signal by ID.

Get the schema (available fields) for security signals.

Retrieve security monitoring suppressions from Datadog.

List all AAP (App & API Protection) allowlist / passlist entries that exempt specific traces from AAP security analysis and WAF blocking.

Retrieve a Datadog spreadsheet by ID.

Returns the field reference guides for building inputs to upsert_datadog_spreadsheet.

Retrieve paginated data from a table, sheet, or legacy pivot in a Datadog spreadsheet.

DEPRECATED: use get_datadog_spreadsheet_tab_data instead, which provides a unified interface for table tabs.

Returns which Test Optimization features are enabled or disabled for a specific service.

Retrieve a trace by trace ID from Datadog APM.

Retrieve a single Datadog Workflow Automation workflow by ID.

Get the full definition of a Datadog Workflow Automation action by actionId.

Retrieve a Datadog Workflow Automation execution instance.

Get the JSON schema for a Datadog Workflow Automation spec.

Retrieve the execution data for a single step of a Datadog Workflow Automation instance: its inputs, evaluated inputs/outputs, and the execution context the step's expressions were evaluated against.

Fetch full details and attributes for one or more data entities by their entity IDs.

Fetch the containment hierarchy (ancestors and descendants) for one or more entities.

Fetch the live reachable lineage subgraph from one or more anchor entities.

Retrieves data observability metrics for a given monitor ID.

Fetch all Data Quality monitors for this org and resolve each monitor's entity filter to return the full set of entities it is configured to cover.

Query the current alert and warn state of DQ monitor groups from the alerting service.

Gets the full details of a single Data Observability recommendation by id, including its structured body (body_sections) describing the problem, evidence, and proposed change.

List the valid measures, facets, aggregations, and cardinality_fields for aggregate_dora_events, per DORA index (deployment, commit, pull_request, failure).

Get custom user-defined descriptions for data entities by their IDs.

Get custom user-defined tags for data entities.

Gets variants and status in environment for a specific feature flag by ID or key.

Get the JSON Schema used to validate a Datadog form's data_definition and ui_definition.

Get submitted responses for a Datadog form.

Read this org's Synthetics global variables.

Get details for a specific guardrail metric by ID.

Return producer- and/or consumer-side Kafka client configuration for one or more services, as collected by Data Streams Monitoring (DSM).

Get a chronological view of an agent's execution loop, showing each step (LLM calls, tool invocations, decisions) in order.

Walk a dataset's records page by page server-side and return them as shaped previews, with a cursor that always resumes exactly where the walk stopped.

Read dataset records with structured previews + a schema summary.

Get aggregate statistics for a specific evaluator over a time window, optionally filtered by ML application.

Retrieve an LLM-judge evaluator configuration by name.

Get the unique values for a dimension, with counts.

Get full details for a single experiment event, including its input, output, expected_output, all metrics, and dimensions.

Get statistical analysis for a specific evaluation metric, optionally segmented by a dimension.

Get a high-level summary of an experiment with pre-computed statistics for all evaluation metrics.

Fetch up to 3 specific records with **untrimmed** input / expected_output / metadata.

Get the most-recently-modified **Topics Discovery (Patterns)** configuration for the caller's org.

Get a **cursor-paginated page of clustering points** (individual spans) assigned to a single topic.

Get the status and per-activity progress of the **most recent** Topics Discovery run for a config.

Get the **topic hierarchy** discovered by a Topics Discovery run.

Get the topic hierarchy for a run **with the clustering point span IDs inlined** on each leaf (hierarchy-0) topic.

Look up an LLM Observability **experiments project** by ID or name.

Retrieve the actual content of a specific field from a span.

Get detailed metadata for one or more spans within a trace.

Get the full structure of a trace as a span hierarchy tree.

Finds monitoring gaps and coverage for services or hosts.

Retrieves official Datadog monitor templates as starting points for creating monitors.

Get detailed information about a network device by its device_id.

Retrieve the full text of an NDM network device configuration snapshot (running config or startup config) for review, compliance auditing, or troubleshooting.

Search and retrieve Network Path test runs using a query.

Use this FIRST — before create-feature-flag — whenever a user asks to set up, add, or onboard Datadog feature flags in a project that doesn't have them yet: e.

Rank database tables by query activity, broken out by who is querying them.

Discover available fields and facets that can be used for filtering and grouping profiling data.

Get the values for a specific profiling field/facet discovered via get_profiling_fields.

Returns profile types and families that can be used by other profiling tools given a query context.

Returns individual profiled runtime IDs (processes/containers).

Returns insights over the provided time window.

Returns profiled services along with their profiling families that can be queried for profiling data in the given query context.

Discover available tag names (e.

Get the values for a specific tag (e.

Query profiling data as timeseries, aggregated into time buckets.

Retrieves all pull requests for a repository that have a specific head branch.

Retrieve specific rows from a reference table by their primary key values.

Get an AI-generated play-by-play of what a user did during a session replay — what pages they visited, what actions they took, and what happened step by step.

Get a pre-computed performance insight for a specific RUM view.

Returns a performance summary for a RUM application with period-over-period diffs and anomaly windows.

Reconstruct the chronological load timeline for ONE specific RUM view occurrence, web or mobile.

Get a saved filter by id, including its targeting rules.

Retrieves detailed health metrics for a single Spark or Databricks job run.

Retrieves the Spark SQL physical execution plan from a spark.

Return all Kafka Schema Registry versions for a single subject on a given Kafka cluster.

Search and retrieve details about Synthetics tests configured in Datadog.

do-not-call

Fetch recent queries that touched one or more specific entities, in reverse chronological order (most recent first).

Get TypeScript schemas and building instructions for widget types.

Inspect Data Quality monitor data, anomaly bounds, and existing annotations before proposing a change.

Step-by-step instructions for adding initial Datadog Observability setup to Kubernetes applications and configurations.

Installs and configures the Datadog Agent on a Linux host to collect infrastructure metrics, APM traces, and logs.

List every Kafka Schema Registry schema known to Data Streams Monitoring (DSM) for the current org within a time window.

List allocations for a specific feature flag.

List Datadog Audit Trail events over a time window.

Get an overview of autonomous system (AS) health from Network Path data, without needing a specific ASN.

List a database's ready-to-apply, benchmark-validated query optimizations — the same set shown on the Datadog DBM Optimizations page.

List automation rules for security findings.

List available Datadog skill guides.

List the execution instances of a Datadog Workflow Automation workflow.

Find Datadog Workflow Automation workflows and inspect their metadata.

Lists Data Observability cost- and performance-optimization recommendations for data jobs and queries (Spark, Databricks, Snowflake, BigQuery), each with estimated cost and duration savings.

List all flagging environments for the organization.

List all feature flags for the organization.

List all available guardrail metrics for the organization.

List configuration versions for a Kafka broker on a given cluster, as collected by Data Streams Monitoring (DSM).

List configuration versions for a Kafka topic on a given cluster, as collected by Data Streams Monitoring (DSM).

List **experiments datasets** within a project, with optional id or name filter.

List every evaluator configured for the caller's organization, across all ML applications.

List all evaluators configured for an ML application.

List experiment events with minimal summaries, supporting filtering by dimension or metric and sorting by metric value.

List experiment runs in a project or against a dataset, newest first.

List all **Topics Discovery (Patterns)** configurations for the caller's org.

List the **completed** Topics Discovery runs for a config, newest first.

List all LLM Observability **experiments projects** for the org.

Check for existing flags tagged source:agentic-onboarding that qualify for reuse: a non-production environment, currently ENABLED, whose queries already cover the given dd_env under the runtime matcher — the same guarantee create-onboarding-flag itself enforces before writing.

Fetch a page of rows from a reference table in primary-key order.

List and search reference tables in the organization.

List saved filters for the organization.

List stale feature flags in the organization, each enriched with the reason it is stale and a tool_hints array of suggested next-step tools to clean it up.

Returns all Synthetics locations available to this org — managed (aws:, gcp:, azure: prefixes) and private (pl: prefix).

Step-by-step instructions for adding initial Datadog LLM Observability (AKA, 'LLMObs') setup to applications with an LLM or AI agent.

Load a Datadog skill guide before using related Datadog tools.

Add, update, or delete a comment on a Datadog Error Tracking issue.

Searches monitor groups to find which specific groups (e.

Mute or unmute security findings.

Analyze a SQL query for optimization opportunities using deterministic rules plus LLM-assisted analysis.

Publish a specific draft version of a Datadog form, making it the active published version.

Publish a Datadog Workflow Automation workflow.

Rank entities by their transitive lineage connectivity using a pre-built snapshot.

Rank tables by their importance for monitoring, combining lineage impact and query activity into a single composite score.

Read messages from a given Kafka cluster/topic via the Datadog Agent.

Recommends a threshold value for a metric monitor query based on peer-group statistics.

Move a security findings automation rule up or down in the evaluation order.

Set the full evaluation order of a RUM application's retention filters.

Roll a dataset's records back to a previous version.

⚠️ WRITE OPERATION — queues a retry for a failed CI job via Datadog's CI Action backend.

Trigger on-demand runs for one or more existing Synthetics tests by public_id; optionally apply shared locations, headers, body, variables, or start URL overrides.

Search Datadog Audit Trail events using a query string.

Search and retrieve Workload Protection (CWS) agent events from the secruntime event track.

Search and retrieve CI pipeline events from Datadog with full metadata including timing, failure reasons, error messages, and retry history.

List and retrieve information about Datadog dashboards.

Search and retrieve Database Monitoring (DBM) query execution plans from Datadog.

Search and retrieve Database Monitoring (DBM) query samples from Datadog.

Search Error Tracking Issues from Datadog.

Search and retrieve raw Datadog events (deployments, alerts, system activities, infrastructure changes, etc.

Search Datadog forms for the authenticated organization.

Explore Datadog hosts inventory with SQL.

Search Datadog incidents.

Search for Kubernetes resources.

Search and retrieve raw log entries or log patterns.

List available metrics in Datadog with optional filtering by name and tags.

List and retrieve information about Datadog monitors.

Search Datadog notebooks.

Search and retrieve raw Datadog RUM events using advanced query syntax.

Fallback tool for retrieving full security finding details.

List IoC Explorer indicators (IPs, domains, URLs, file hashes) matched against threat intel feeds.

Filter and list security signals from Datadog Security Monitoring matching criteria (status, time range, rule type, severity, service).

Retrieve information about Datadog service dependencies.

List and retrieve information about Datadog services.

Searches Datadog SLOs by name, tags, or type.

Retrieve raw Datadog APM spans matching a query.

Search Datadog spreadsheets by name or owner.

Search and retrieve individual test events from Datadog with full metadata including error messages, stack traces, retry history, and flaky status.

Search the Datadog Workflow Automation action catalog.

Search for data entities in the data catalog.

Search DORA events, or fetch a single deployment or pull request by ID.

Search for LLM Observability spans.

Search SNMP-monitored network devices (routers, switches, firewalls) in Datadog NDM.

Get all network interfaces (e.

Search NDM network device configuration snapshots (running config, startup config) for change tracking, config drift detection, or compliance auditing.

Retrieves issues blocking a pull request to help resolve and fix problems.

Search Datadog Session Replay recordings and return a list of sessions with replay links.

Search RUM applications in the organization.

Search the organization's RUM metrics.

Search RUM retention filters for an application.

Step-by-step instructions for instrumenting serverless workloads with Datadog.

Step-by-step instructions for configuring source map uploads for a project to Datadog.

Step-by-step instructions for adding Datadog Studio to a project.

Submit evaluation-metric events to an existing experiment.

Submit feedback about capabilities provided by this Datadog MCP server only.

Analyze a set of entities to find common attributes and naming patterns, then suggest monitor filter expressions that group subsets of those entities for use in monitor definitions.

Get aggregate statistics about the lineage graph reachable from anchor entities.

Synchronize allocations for a feature flag in a specific environment.

Synchronize allocations that include a FEATURE_GATE allocation linked to a standard experiment.

Use this tool to validate (preview) or create (create) a Synthetics API http test.

Step-by-step instructions for adding Datadog Test Optimization setup this project.

Unarchive a previously archived feature flag, making it visible in the main list again.

Unarchive a previously archived saved filter.

Remove AAP (App & API Protection) denylist entry — stop blocking IP/user/user-agent.

Stop a Datadog Workflow Automation workflow from starting new automatic executions by unpublishing it, while preserving its base spec and any saved draft.

Update an Error Tracking Issue in Datadog.

⚠️ WRITE OPERATION — modifies flaky test states in Datadog Test Optimization.

Create a new draft version of a Datadog form, updating its schema and/or UI layout.

Updates a SINGLE existing Datadog monitor identified by its numeric ID.

Updates a published analysis (also called a published dataset) by re-syncing it with the current notebook cell definitions.

Update an existing Cloud SIEM detection rule by PUTing the supplied payload to PUT /api/v2/security_monitoring/rules/{rule_id}.

Update an existing security findings automation rule.

Set the triage state of an IoC indicator.

Update the triage state and/or assignee of security signals.

Update an existing security monitoring suppression rule in Datadog.

Update an existing Datadog Workflow Automation workflow by ID.

Sets the lifecycle status of a Data Observability recommendation, e.

Set or update the custom user-defined description for a data entity.

Add or remove custom user-defined tags on data entities.

Replace the attributes of an existing Feature Management environment.

Update a feature flag in a specific environment by enabling/disabling it, changing the default variant, setting an override variant, or clearing an override variant.

Update the mutable properties of an existing experiment.

Update an existing RUM retention filter's attributes in place.

Update a saved filter's name, description, and/or targeting rules.

Creates or updates a Datadog ordered-grid dashboard.

Create or update an AAP (App & API Protection) WAF custom rule — a user-authored in-app WAF rule that matches request traffic and monitors or blocks it.

Add/refresh AAP (App & API Protection) denylist entry — block IP/user/user-agent via auto security response.

Create or update an AAP (App & API Protection) passlist/allowlist entry — also known as a WAF exclusion filter — that exempts traces from WAF analysis/blocking.

Create or update a Datadog spreadsheet's tables, sheets, and pivots in a single call.

Create, update, or extend Data Quality monitor annotations.

Insert new rows or update existing rows in a reference table.

Create or update a RUM custom metric.

Validate a widget definition against the dashboard schema.

A read-only check of a complete candidate workflow spec.

Validates a monitor JSON definition.

Verify a client-side onboarding flag through the public Datadog CDN using the user's own client token — the same path browser/mobile client SDKs use.