Datadog MCP Server

Datadog MCP Server

A Model Context Protocol (MCP) server that provides Claude and other AI assistants with direct access to the Datadog API. Query metrics, search logs, manage monitors, investigate security signals, and track billing — all through natural language.

Features

| Category | Tools | |---|---| | Metrics | Query timeseries data, list active metrics | | Logs | Search and filter logs with full query syntax | | Security Monitoring | Search security signals (SIEM, CWS, CSM) | | Workload Protection | List/manage CSM Threats policies and agent rules | | Monitors | List, create, get, mute, and unmute monitors | | Dashboards | List and retrieve dashboard definitions | | Billing & Usage | Monthly costs, projected costs, usage breakdowns, cost attribution, security-specific usage |

Prerequisites

• Python 3.10+
• A Datadog account with API and Application keys
• Claude Code or any MCP-compatible client

Setup

1. Clone and install

git clone https://github.com/anthropics/datadog-mcp-server.git
cd datadog-mcp-server
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

2. Configure credentials

Copy the example env file and add your Datadog keys:

cp .env.example .env

Edit .env:

DD_API_KEY=your_api_key_here
DD_APP_KEY=your_app_key_here
# DD_SITE=datadoghq.eu  # Optional: for non-US regions

You can create API and Application keys in Datadog Organization Settings.

3. Add to Claude Code

Add the server to your Claude Code settings (~/.claude/settings.json):

{
  "mcpServers": {
    "datadog": {
      "command": "/path/to/datadog-mcp-server/.venv/bin/python",
      "args": ["/path/to/datadog-mcp-server/server.py"],
      "env": {
        "DD_API_KEY": "your_api_key",
        "DD_APP_KEY": "your_app_key"
      }
    }
  }
}

Or for non-US Datadog regions, add "DD_SITE": "datadoghq.eu" to the env block.

Available Tools

Metrics

• query_metrics — Query timeseries data (e.g. avg:system.cpu.user{*})
• list_active_metrics — List all active metric names

Logs

• search_logs — Search logs with Datadog query syntax, time ranges, and limits

Security Monitoring

• search_security_signals — Search SIEM/CWS/CSM signals with filters and time ranges

Workload Protection (CSM Threats)

• list_workload_protection_policies — List all CSM Threats policies
• list_workload_protection_rules — List CWS agent rules (optionally filtered by policy)
• get_workload_protection_rule — Get details for a specific agent rule

Monitors

• list_monitors — List monitors, optionally filtered by tags
• create_monitor — Create a new monitor with thresholds, notifications, and options
• get_monitor — Get details for a specific monitor
• mute_monitor / unmute_monitor — Mute or unmute monitors by scope

Dashboards

• list_dashboards — List all dashboards
• get_dashboard — Get a specific dashboard's full definition

Billing & Usage

• get_monthly_cost — Historical monthly costs broken down by product
• get_estimated_cost — Current month-to-date estimated cost
• get_projected_cost — Projected full-month cost
• get_billing_summary — Billable usage summary with counts and costs per product
• get_monthly_cost_attribution — Costs attributed by tags (team, env, service)
• get_hourly_usage — Hourly usage for specific product families
• get_usage_security — Combined CSPM + CWS + SDS + ASM usage
• get_active_billing_dimensions — List all active billing product categories

Example Usage

Once configured, you can ask Claude things like:

• "What's our Datadog bill for February?"
• "Show me error logs from the payments service in the last hour"
• "Are there any critical security signals from today?"
• "Create a monitor that alerts when CPU usage exceeds 90%"
• "How much are we spending on Datadog security products?"
• "What's the projected cost for this month?"

Required Datadog Permissions

Your Application key needs the following permissions depending on which tools you use:

| Tools | Required Scopes | |---|---| | Metrics | timeseries_query | | Logs | logs_read_data | | Security Signals | security_monitoring_signals_read | | Workload Protection | security_monitoring_rules_read | | Monitors | monitors_read, monitors_write (for create/mute) | | Dashboards | dashboards_read | | Billing & Usage | usage_read |

Datadog Site Configuration

| Region | DD_SITE value | |---|---| | US1 (default) | datadoghq.com | | US3 | us3.datadoghq.com | | US5 | us5.datadoghq.com | | EU | datadoghq.eu | | AP1 | ap1.datadoghq.com |

License

MIT