Datadog MCP

Publish a Datadog Workflow Automation workflow. If a saved draft exists, it replaces the base spec and is removed. Otherwise, the existing unpublished base is published.

Untrusted display-only summary

Rank entities by their transitive lineage connectivity using a pre-built snapshot. Returns parent-level entities (tables, dashboards, jobs, etc.) ranked by how many other entities they connect to. Child nodes such as columns are automatically rolled up to their parent entity — column-level lineage is aggregated to the…

Untrusted display-only summary

Rank tables by their importance for monitoring, combining lineage impact and query activity into a single composite score. Use this as the primary entry point for "what should I monitor?" questions — it produces a ranked list of high-value tables in one call instead of cross-referencing rank_data_entities_by_lineage_d…

Untrusted display-only summary

Read messages from a given Kafka cluster/topic via the Datadog Agent. Dispatches a Remote Config action and polls for the agent's response. REQUIRES the `data_streams_monitoring_capture_messages` permission. Resolving `cluster` and `bootstrap_servers` automatically: if the caller only knows the topic, DO NOT ask the u…

Untrusted display-only summary

Recommends a threshold value for a metric monitor query based on peer-group statistics. Returns the recommended threshold, its source, a confidence score, recommendation status, a bounds-validation result, and IDs for correlating the recommendation with later feedback.

Untrusted display-only summary

Move a security findings automation rule up or down in the evaluation order. Automation rules use first-match-wins semantics, so order matters. Use a large positions value (e.g. 1000) to move a rule to the top or bottom of the list. Returns the new ordered list of rules after the move. Use list_datadog_security_findin…

Untrusted display-only summary

Set the full evaluation order of a RUM application's retention filters. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects billing.** Filters are evaluated top-down (position 0 first) and each event stops at the first matching filter, s…

Untrusted display-only summary

Roll a dataset's records back to a previous version. The dataset's version is bumped and its live records are replaced with that version's records — records added since then stop being part of the dataset. **Two-step**: PREVIEW (`confirmed=false`) → RESTORE (`confirmed=true`). - `confirmed=false`: writes nothing. Reso…

Untrusted display-only summary

⚠️ WRITE OPERATION — queues a retry for a failed CI job via Datadog's CI Action backend. Requires explicit user approval before running. Submits an async retry task for a specific job. Safety rails applied server-side: max 2 retries per workflow run over 7 days, deduplication. IMPORTANT: The response confirms the task…

Untrusted display-only summary

Trigger on-demand runs for one or more existing Synthetics tests by public_id; optionally apply shared locations, headers, body, variables, or start URL overrides. Triggering is billable; call only after an explicit user request. Only send overrides the user explicitly requested. Every override applies to every public…

Untrusted display-only summary

Search Datadog Audit Trail events using a query string. Audit Trail monitors user activity across the Datadog platform to help maintain compliance, enforce platform governance, and build transparency, capturing audit events across configuration, access, and billing assets (monitor edits, API key creation, role changes…

Untrusted display-only summary

Search and retrieve raw Workload Protection agent events — the low-level runtime security events collected by the Datadog Agent (eBPF-based) on hosts and containers. Workload Protection is also known as Cloud Workload Security (CWS) or CSM Threats; the terms "runtime security", "runtime threats", and "agent events" al…

Untrusted display-only summary

Search and retrieve CI pipeline events from Datadog with timing, failure reasons, error messages, and retry history. Use this tool to troubleshoot CI failures, inspect structured failure details, or compare branches. For counts, rates, or statistics, use aggregate_datadog_ci_pipeline_events instead. To investigate a C…

Untrusted display-only summary

List and retrieve information about Datadog dashboards. This tool helps discover available dashboards, their IDs, titles, and underlying queries. Use this tool when you need to find specific dashboards, get an overview of all dashboards in your Datadog account, or find important logs+metrics queries in dashboards.

Untrusted display-only summary

Search and retrieve Database Monitoring (DBM) query execution plans from Datadog. Query execution plans show how the database engine executes queries, including index usage, join strategies, and cost estimates. Use this to analyze query performance and identify optimization opportunities.

Untrusted display-only summary

Search and retrieve Database Monitoring (DBM) query samples from Datadog. Query samples represent individual query executions with performance metrics, allowing you to analyze database activity patterns, identify slow queries, and investigate database performance issues.

Untrusted display-only summary

Search Datadog services through the entity graph, including service ownership and direct upstream or downstream relationships. Prefer this tool over searching telemetry, monitors, dashboards, or other resources when the request is about service identity, catalog ownership, dependencies, or services owned by the curren…

Untrusted display-only summary

Search Error Tracking Issues from Datadog. Use this tool to search errors across data sources (RUM, Logs, Traces, ...). Returns groups of errors ("Issues"), along with the number of times they occurred within the given time range ("total_count"). The Issue's ID ("issue_id") can be used as "issue.id" or "@issue.id" in…

Untrusted display-only summary

Search and retrieve raw Datadog events (deployments, alerts, system activities, infrastructure changes, etc.). Do NOT use for counts, aggregations, or grouped analysis — use aggregate_events instead. Best for: inspecting individual events, reading event titles/messages/tags, and exploring event patterns before decidin…

Untrusted display-only summary

Search Datadog forms for the authenticated organization. Returns form metadata including name, description, active status, and creation time.

Untrusted display-only summary

Explore Datadog hosts inventory with SQL. Queries run against the virtual 'hosts' table backed by "dd.hosts" (Advanced Query API), which exposes hostname, hostname_aliases (text[]; use hostname_aliases[1]), tags (hstore map; use tags->'key'), cloud_provider, resource_type, instance_type, os, os_version, agent_version,…

Untrusted display-only summary

Search Datadog incidents. Default sort: newest first. Supports filtering by state, severity, title, team, creation time, and more. Use `semantic_query` for natural-language search over AI-generated incident summaries. Prefer `query` first; only add `semantic_query` when query by keyword and metadata filters aren't suf…

Untrusted display-only summary

Search for Kubernetes resources. Use this tool instead of kubectl to determine the state of Kubernetes resources (for example, Kubernetes deployments or pods). This tool is preferred over kubectl because it does not require local cluster access, works across all clusters, and returns enriched data with tags.

Untrusted display-only summary

Search and retrieve raw log entries or log patterns. Do NOT use for counting or aggregations — use analyze_datadog_logs instead. Best for: viewing raw logs, discovering patterns (use_log_patterns=true), and discovering custom attributes via extra_fields for use as extra_columns in analyze_datadog_logs. Response shape…

Untrusted display-only summary

List available metrics in Datadog with optional filtering by name and tags. Set use_cloud_cost=true to search Cloud Cost Management metrics.

Untrusted display-only summary

List and retrieve information about Datadog monitors. This tool helps discover monitors, their status, configuration, and alerts. Use this tool when you need to find monitors for investigation, management, or analysis purposes.

Untrusted display-only summary

Search Datadog notebooks. Use this tool when you need to find notebooks for investigation or monitoring purposes. Results can be filtered, for example by author, and sorted. This tool returns snippets of the original notebook. To fetch the entire notebook, use the get_datadog_notebook tool.

Untrusted display-only summary

Search and retrieve raw Datadog RUM events using advanced query syntax. Do NOT use for counts, aggregations, or grouped analysis. Best for: inspecting individual RUM events, debugging specific user experience issues, exploring available event attributes in raw or detailed_output responses before deciding what to aggre…

Untrusted display-only summary

Run JavaScript against the official SDK and code-exec extension catalog available to `execute_code`. The catalog contains only operations available to the current user and sandbox policy. Its data stays inside the sandbox; only the value you return enters the conversation. Quick start: filter the `catalog.operations`…

Untrusted display-only summary

Fallback tool for retrieving full security finding details. Prefer analyze_datadog_security_findings (with get_datadog_security_findings_schema) for most findings analysis tasks. Use this tool ONLY when: 1) analyze_datadog_security_findings fails, or 2) you need complete finding details not available via SQL. Returns…

Untrusted display-only summary