Datadog MCP

List IoC Explorer indicators (IPs, domains, URLs, file hashes) matched against threat intel feeds. Returns IoC indicators, not security signals; `signal_count` is contextual (signals that referenced the indicator). Default sort is `score` desc, ties broken by `signal_count` then `log_count`. Pair with `get_datadog_sec…

Untrusted display-only summary

Filter and list security signals from Datadog Security Monitoring matching criteria (status, time range, rule type, severity, service). DO NOT use this tool for counts, aggregations, top-N, breakdowns, or trends — use analyze_datadog_security_signals instead. For a single signal by ID — use get_datadog_security_signal…

Untrusted display-only summary

Searches Datadog SLOs by name, tags, or type. Filter with query syntax like 'service:my-service' or 'team:checkout'.

Untrusted display-only summary

Retrieve raw Datadog APM spans matching a query. Do NOT use for counts, aggregations, or grouped analysis — use aggregate_spans instead. Best for: inspecting individual spans, debugging request flows and failures, and discovering span fields/attributes, including via custom_attributes, that you may want to aggregate o…

Untrusted display-only summary

Search Datadog spreadsheets by name or owner. Returns a paginated list of spreadsheets with their IDs and names.

Untrusted display-only summary

Search individual Datadog test events with execution metadata, error messages, stack traces, retry history, and flaky status. Use aggregate_datadog_test_events for counts, rates, and statistics. Keep page_limit small because each event can be large. If unsure whether a facet exists or needs an @ prefix, read the datad…

Untrusted display-only summary

Search the Datadog Workflow Automation action catalog. Actions are the building blocks of workflow steps. Each result exposes actionId; pass it to get_datadog_workflow_action and use the same value as the workflow step's actionId. Use query to search bundle names/integrations, action titles, keywords, and descriptions…

Untrusted display-only summary

Search for data entities in the data catalog. Parameters: - name: Entity name to search for. Supports wildcards anywhere in the value: prefix (stg_*), suffix (*_raw), and substring/infix (*orders*, fct_*_monthly). - text: Full-text search across entity name, type, and all attribute values. All words must match. Use th…

Untrusted display-only summary

Search DORA deployments or merged-and-deployed pull requests, or fetch one event by ID. For DORA trends and aggregates such as deployment frequency, change lead time, failure rate, and recovery time, use aggregate_dora_events instead. Pull-request search is only for deployed PRs; it is not an open-PR or review-status…

Untrusted display-only summary

Search for LLM Observability spans. Entry point for trace analysis — use it to find spans before drilling in with **get_llmobs_trace**. **Prefer structured parameters** (`ml_app`, `tags`, `span_kind`, `span_name`) over the raw `query` string — they handle quoting and escaping automatically. Reach for `query` when you…

Untrusted display-only summary

Search SNMP-monitored network devices (routers, switches, firewalls) in Datadog NDM. Use to investigate device health, interface bandwidth saturation, LACP/LAG/port-channel issues, topology neighbors (LLDP/CDP), QoS queue drops, or discover devices by vendor/location/type. Use search_ndm_devices first to get device_id…

Untrusted display-only summary

Get all network interfaces (e.g., GigabitEthernet0/0/1, Vlan100) for a device. Use this to troubleshoot connectivity by checking interface status (up/down/warning), identify problematic interfaces during outages, get IP address assignments for topology mapping, or audit interface configuration. Workflow: Use search_nd…

Untrusted display-only summary

Search NDM network device configuration snapshots (running config, startup config) for change tracking, config drift detection, or compliance auditing. Returns config metadata and IDs — use get_network_device_configuration to retrieve full config content, or diff_network_device_configurations to compare two snapshots.…

Untrusted display-only summary

Retrieves issues blocking a pull request to help resolve and fix problems. Provides insights on failed tests, flaky tests, code quality problems, security vulnerabilities, and failed CI jobs.

Untrusted display-only summary

Search Datadog Session Replay recordings and return a list of sessions with replay links. Only returns sessions that have a replay recording available. Two modes: • Session filter mode (default): Filter replays by session attributes such as user identity, device, error count, or any RUM facet. Use `filter` with Datado…

Untrusted display-only summary

Search RUM applications in the organization. Returns application_id (UUID), name, type, is_active, rum_event_processing_state (ALL/ERROR_FOCUSED_MODE/NONE), product_analytics_retention_state (MAX/NONE), tags, and creator_email. Use this to discover application_id values required by RUM tools. Filter by name, applicati…

Untrusted display-only summary

Search the organization's RUM metrics. Two kinds share the same shape: "custom" metrics are user-defined timeseries computed from RUM events, and "ootb" metrics are Datadog-predefined (server-managed). Omit type to return both with a source discriminator on each row. Examples: (no params) -> list every metric id in th…

Untrusted display-only summary

Search or list RUM operations in the organization. Discovers all operations (SDK-instrumented and UI-configured) via the rum.measure.operation metric, then enriches with metadata (id, display_name, tags) from configured operations. Operations only observed via the SDK have no id. Returns each operation's id (configure…

Untrusted display-only summary

Search RUM retention filters for an application. Retention filters control which RUM events are indexed and retained. Provide application_id to list filters for that application, optionally narrowed by name (case-insensitive substring), event_type (one of session, view, action, error, resource, long_task, vital, opera…

Untrusted display-only summary

Step-by-step instructions for instrumenting serverless workloads with Datadog. This tool helps configure Datadog metrics, server-side APM tracing, and logs for serverless platforms such as AWS Lambda, Vercel, GCP Cloud Run, GCP Cloud Run functions (Gen 2), and Azure Container Apps. Asking to monitor or instrument any…

Untrusted display-only summary

Step-by-step instructions for configuring source map uploads for a project to Datadog. You must first review the user's project and fill out as many arguments as possible before calling this tool. Only call this tool if the user's project has a supported bundler.

Untrusted display-only summary

Step-by-step instructions for adding Datadog Studio to a project. You must first review the user's project and fill out as many arguments as possible before calling this tool. Check project files and dependencies to determine the argument values, focusing on dependency files, build configuration files, and project str…

Untrusted display-only summary

Submit evaluation-metric events to an existing experiment. Each metric records a judged value and, when a span_id is provided, attaches to that experiment span. **Required per metric:** label, metric_type, and the value field matching the type — categorical_value (categorical), score_value (score), boolean_value (bool…

Untrusted display-only summary

Submit feedback about capabilities provided by this Datadog MCP server only. Do NOT submit feedback about other MCP servers or plugins (e.g. Atlassian, CodeSandbox, Slack, GitHub). After completing a task, briefly consider whether any Datadog MCP capability was notably unhelpful or whether the workflow was harder than…

Untrusted display-only summary

Analyze a set of entities to find common attributes and naming patterns, then suggest monitor filter expressions that group subsets of those entities for use in monitor definitions. Pass entity IDs from prior tool results (rank_data_entities_by_lineage_degree, get_popular_warehouse_tables_by_query_frequency, search_da…

Untrusted display-only summary

Get aggregate statistics about the lineage graph reachable from anchor entities. Use this BEFORE get_data_entity_lineage when dealing with large or unknown graphs. It returns counts and breakdowns without the full node/edge payload, so it works on graphs of any size. Typical workflow: 1. summarize_data_entity_lineage…

Untrusted display-only summary

Synchronize allocations for a feature flag in a specific environment. This tool supports FEATURE_GATE and CANARY allocations, including exposure schedules and guardrail metrics. If any existing allocation is linked to a standard experiment, use sync-experiment-allocations-for-feature-flag-environment even when editing…

Untrusted display-only summary

Synchronize allocations that include a FEATURE_GATE allocation linked to a standard experiment. Use this tool when the requested or existing full allocation set contains a FEATURE_GATE allocation linked to a standard experiment, even if the immediate edit targets a different allocation. WARNING: This replaces ALL exis…

Untrusted display-only summary

Use this tool to validate (preview) or create (create) a Synthetics API http test. Every test must be previewed and validated by the user before being created.

Untrusted display-only summary

Step-by-step instructions for adding Datadog Test Optimization setup this project. You must first review the user's project and this tool's arguments (including any nested arguments) and fill out as many of them as possible before calling this tool. Check project files and dependencies to determine the argument values…

Untrusted display-only summary