Connect Datadog MCP to your AI agent

Developer Tools 341 actions available

Investigate Datadog telemetry, incidents, dashboards, and service health.

We set up the connection using your own Datadog MCP account, with keys you control, and keep it running. Your agent picks it up and starts doing the work.

Book a setup call → See pricing

Actions

What your agent can do in Datadog MCP

Each one is a real action the agent can take on its own, the same things a person clicking around Datadog MCP could do. Read-only by default; write actions are confirmed against your policy.

Aap get activation options Check whether Datadog App and API Protection (AAP) can be enabled for a service via Remote Configuration (RC), with no code changes. Use when the user asks to install, set up, enable, or onboard AAP for a service and en…
Aap onboarding Step-by-step instructions for enabling Datadog App and API Protection (AAP) to monitor and secure your application. AAP detects security threats, vulnerabilities, and attacks in real time by using Datadog tracing librar…
Add llmobs dataset records Create records in a dataset. **Two-step**: PREVIEW (`confirmed=false`) → INSERT (`confirmed=true`). - `confirmed=false`: does NOT insert. Validates that the (project_id, dataset_id) pair exists, then returns `AddDataset…
Aggregate datadog ci pipeline events Aggregate and analyze CI pipeline events to produce statistics, metrics, and grouped analytics. Use for answering questions like 'What's the average pipeline duration?' or 'How many failed builds per pipeline?' For indi…
Aggregate datadog test events Aggregate Datadog Test events. aggregation is required — provide one of: count, avg, sum, min, max, pc50, pc75, pc90, pc95, pc99. Quantifies reliability, performance, and execution trends. For individual event details o…
Aggregate dora events Aggregate DORA events into scalar values or timeseries using composable 'queries' + 'formulas', like get_datadog_metric — delivery-performance analytics across deployments, commits, and pull requests. Each entry in 'que…
Aggregate events Aggregate Datadog events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as…
Aggregate rum events Aggregate Datadog RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis of R…
Aggregate spans Aggregate Datadog APM spans to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such…
Analyze cloud network monitoring Queries Cloud Network Monitoring (CNM) data to view network/transport level information. Use to investigate netork latency, packet loss, TCP failed connections, dial timeouts, or spikes in TCP throughput. Each query acc…
Analyze datadog error tracking errors Analyze Datadog Error Tracking error samples with SQL — aggregations, breakdowns by tag/service/version, or raw sample inspection. Runs against a virtual 'errors' table of individual error events (not Issues, which are…
Analyze datadog logs Analyze Datadog logs using SQL. Runs against a virtual 'logs' table filtered by your search query. Good for aggregations, counts, group-bys, or peeking at recent logs with LIMIT. To discover custom attributes for extra_…
Analyze datadog security findings Primary tool for analyzing security findings. Use this for all security findings analysis tasks. REQUIRED: Call get_datadog_security_findings_schema FIRST to get available fields and their types before writing SQL. Quer…
Analyze datadog security signals Count, group, or trend security signals using DDSQL — for any aggregate question: 'how many', 'top N', 'by severity', 'over time', or breakdown. Do NOT use for listing, retrieving, or checking existence of specific sign…
Analyze security findings Primary tool for analyzing security findings. (Also available as analyze_datadog_security_findings.) Use this for all security findings analysis tasks. REQUIRED: Call security_findings_schema FIRST to get available fiel…
Append new rum retention filter Create a new RUM retention filter, appended at the end of the evaluation order. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects billi…
Append reference table rows Append (add) new rows to an existing reference table. Prefer upsert_reference_table_rows when you may need to update existing rows — it handles both inserts and updates. Use this tool only when you are certain all rows…
Archive feature flag Archive a single feature flag by ID or key; pair with list-stale-feature-flags to discover candidates. Provide featureFlagID or featureFlagKey (if both are given, featureFlagID wins).
Archive saved filter Archive a saved filter (reversible via unarchive-saved-filter).
Ask widget expert Get targeted instructions for building a Datadog widget. Returns a concise how-to guide — widget type recommendations, required fields, schema patterns, and an annotated example — that you use to build the widget defini…
Assign datadog security findings Assign or unassign security findings to a user. Assignment cascades to linked cases — assigning a finding auto-assigns its linked case. Use analyze_datadog_security_findings or search_datadog_security_findings to find s…
Batch update llmobs dataset records Insert, update, and delete dataset records in one versioned operation. Use this to edit or remove existing records; **add_llmobs_dataset_records** is the append-only path and is preferable when you are only adding. **Tw…
Browser onboarding Step-by-step instructions for adding initial Datadog setup to a frontend browser-based project environment. You must first review the user's project and this tool's arguments (including nested arguments) and fill out as…
Build audit trail query Translates a natural-language description into a correct Audit Trail query string. Returns query/from/to fields (plus optional visualization hints) that can be used wherever an Audit Trail query is needed — e.g. feed th…
Cancel datadog workflow instance Cancel a running Datadog Workflow Automation execution instance. Invoke only when the user intends to stop the run. The instanceId can come from execute_datadog_workflow or list_datadog_workflow_instances. Cancellation…
Check flag implementation PRIMARY TOOL FOR EXISTING FLAGS! This tool should be used to check how a feature flag should be implemented in codebase. Use this when asked: - Check my flags are used properly? - Use an existing flag to control some fu…
Clean up flag Clean up a stale feature flag by key — auto-archives if no code references are known, otherwise returns the repos and files where the flag is still referenced plus a Datadog UI link and instructs the user to use Bits de…
Clone datadog form Clone an existing Datadog form. Creates a copy of the form with all its current settings and latest version definition. Returns the cloned form's metadata including its new ID and datastore_id.
Clone llmobs dataset Copy a dataset's current records into a new dataset in the same project. The source dataset is left untouched. This is the safe way to try edits against a real dataset: clone it, mutate the clone with **batch_update_llm…
Code coverage onboarding Configure Datadog Code Coverage for a project by adding coverage report uploads to the CI pipeline. Call this tool to set up code coverage, add code coverage, enable code coverage uploads, or integrate Datadog Code Cove…
Cost recommendations Lists an organization's Cloud Cost Management (CCM) cost-saving recommendations. By default, recommendations are ranked by estimated potential savings (highest first); CCM analyzes cloud and SaaS resource usage and surf…
Create datadog form Create a new Datadog form with a name. The form is created in draft state with a linked datastore auto-provisioned. The schema is unique, you must retrieve it using the `get_form_definition_schema` tool before attemptin…
Create datadog monitor Creates a Datadog monitor in DRAFT mode (no notifications sent, priority 5). Must be manually published in the Datadog UI. Use validate_monitor_definition first to check the definition. Use get_monitor_templates for que…
Create datadog notebook Creates a new Datadog notebook. Include key findings, evidence, supporting data, and complete query documentation unless told otherwise. Do not start the first markdown cell with a heading that repeats the notebook name…
Create datadog published analysis Creates a published analysis (also called a published dataset) from a notebook cell. A published analysis is a snapshot of a computational notebook's cells, exposed as a queryable dataset. Use this to publish a notebook…
Create datadog security detection rule Create a new Cloud SIEM detection rule by POSTing the supplied payload to POST /api/v2/security_monitoring/rules. The payload must follow the schema returned by `get_datadog_security_detection_rules_schema` — call that…
Create datadog security findings automation rule Create a security findings automation rule. Specify rule_type to choose the type of rule: mute (suppress findings), due_date (set remediation deadlines), severity_modifier (adjust finding severity), or ticket_creation (…
Create datadog security findings ticket Create a case, Jira issue, ServiceNow ticket, or Linear issue for security findings. Jira/ServiceNow/Linear targets automatically create and link a Case Management case. Title, description, and priority are auto-generat…
Create datadog security suppression Create a new security monitoring suppression rule in Datadog. Suppressions prevent detection rules from generating signals for specific conditions. This operation is destructive: once active, future matching signals wil…
Create datadog workflow Create an unpublished Datadog Workflow Automation workflow from a complete spec. Each step must use a catalog actionId and follow its action contract, and the spec must satisfy trigger and graph invariants. Use publish_…
Create environment Create a new Feature Management environment. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' somet…
Create experiment feature flag Create a new feature flag with a FEATURE_GATE allocation linked to a standard experiment. Use this tool instead of create-feature-flag when an allocation has experiment_id. The allocation schema and environment requirem…
Create feature flag PRIMARY TOOL FOR NEW FLAGS in a project that already has Datadog feature flags wired up! *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canar…
Create global variables Create a Synthetics global variable. name and value are required; value.secure marks the value as hidden after creation, and a secure variable's value is never returned. tags and description are optional. parse_test_opt…
Create llmobs dataset Create an empty dataset inside a project. Populate it afterwards with **add_llmobs_dataset_records**. Name-idempotent within the project: an existing dataset of the same name is returned with `already_existed=true` and…
Create llmobs experiment Create a new LLM Observability experiment object in a project. This records the experiment (so events/metrics can be reported against it) and does NOT run any model inference — it is the create counterpart of **update_l…
Create llmobs project Create an LLM Observability **experiments project** — the container that owns datasets and experiments. Name-idempotent: if a project with this name already exists in the org, it is returned with `already_existed=true`…
Create onboarding flag Create the onboarding proof flag: a predictable boolean flag (disabled=false, enabled=true; default disabled) with a catch-all FEATURE_GATE allocation serving enabled=true in the selected NON-PRODUCTION environment, tag…
Create or update llmobs evaluator Create or update an LLM-judge evaluator configuration. **This is a full replace, not a patch.** The persisted evaluator becomes exactly what you send: any field you omit is reset to its default (or unset), even if the e…
Create reference table Create a new reference table. Supports two modes: (1) LOCAL_FILE — creates an empty table with no cloud backing; rows are added later via upsert_reference_table_rows or append_reference_table_rows. (2) Cloud-backed (S3,…
Create saved filter Create a saved filter: a reusable, named set of targeting rules that feature flags can reference.
Cws agent events schema Get the schema (available fields) for Workload Protection (CWS) agent events. Use this tool to discover what fields can be used to filter or query agent events with search_cws_agent_events. Returns field names, types, a…
Ddsql create link Generate a Datadog UI link to the DDSQL editor with the given query pre-populated.
Ddsql get spec Get a compact DDSQL capability spec with supported SQL functions, SQL keywords, and DDSQL-specific deltas from vanilla PostgreSQL. Start with this tool before composing queries, then use ddsql_schema_search_tables and d…
Ddsql read saved query Read a single saved DDSQL query by its query_id. Returns the full saved query record, including dataset_id, name, SQL text, columns, visibility, description, and author/timestamp metadata.
Ddsql run query Run a DDSQL query and return results. Recommended flow: (1) call ddsql_get_spec, (2) call ddsql_schema_search_tables, (3) for data tables use entries in tables: if searchable=true, call ddsql_schema_search_unstructured_…
Ddsql schema get table columns Get static SQL columns for a DDSQL table from schema metadata. Use this after ddsql_schema_search_tables for entries in tables where searchable=false, or as fallback when ddsql_schema_search_unstructured_fields is unava…
Ddsql schema search tables Search DDSQL datasets across four providers: public tables, reference tables, metrics, and published analyses. Results are returned in three TSV sections: tables (public + reference_tables), metrics, and published_analy…
Ddsql schema search unstructured fields Search and rank fields for an unstructured DDSQL source. Use this after ddsql_schema_search_tables for entries where searchable=true as the primary schema-discovery path; results include both common static and dynamic f…
Ddsql search saved queries Search and list saved DDSQL queries. Use to find existing saved queries by name or description. Results are sorted by most recently modified and include query ID, name, SQL text, columns, visibility, description and aut…
Ddsql upsert saved query Create or update a saved DDSQL query. To create a new query, provide name and query without query_id — if the user has not specified a name, generate a concise descriptive name based on the query content before calling…
Delete datadog dashboard Permanently deletes a Datadog dashboard by ID. This action cannot be undone. Use search_datadog_dashboards first to find dashboard IDs.
Delete datadog published analysis Unpublishes a published analysis by ID. This removes the dataset and makes it no longer queryable.
Delete datadog security aap custom rule Delete an AAP (App & API Protection) WAF custom rule by id. Works for any custom rule (blocking, monitoring, or trace-tagging — one rule space). IRREVERSIBLE: the rule cannot be restored, only re-created. Only call when…
Delete datadog security detection rules Delete one or more Cloud SIEM detection rules by ID. Only custom (non-default) rules can be deleted — default rules return 403. Each rule is authorised individually; rules the caller cannot edit appear in failed_rules w…
Delete datadog security findings automation rule Delete a security findings automation rule. This permanently removes the rule. Use list_datadog_security_findings_automation_rules to find rule IDs first.
Delete datadog security suppression Delete a security monitoring suppression rule in Datadog. This operation is irreversible: the suppression is removed immediately and cannot be restored. Call get_datadog_security_suppressions first to confirm the correc…
Delete datadog security trace passlist Delete an AAP (App & API Protection) passlist/allowlist entry — also known as a WAF exclusion filter — by exclusion_filter_id. IRREVERSIBLE: the entry cannot be restored, only re-created. AAP traces only; unrelated to C…
Delete datadog spreadsheet Permanently delete a Datadog spreadsheet by ID. This action is irreversible.
Delete datadog workflow Delete a Datadog Workflow Automation workflow by ID. On success, the result contains `deleted: true` and the deleted `workflowId`. Always confirm with the user before invoking. Requires `confirm: true`.
Delete data observability monitor annotations Delete Data Quality monitor annotations by id. Monitor IDs are stable request identifiers, but when a monitor name has already been resolved, use the name as the primary user-facing label and put the ID in parentheses.…
Delete llmobs evaluator Delete an LLM-judge evaluator configuration by name. Returns a not-found error if no evaluator with this name exists for the caller's org.
Delete llmobs experiments Delete experiment runs by ID. The runs and their events stop appearing in LLM Observability. **Two-step**: PREVIEW (`confirmed=false`) → DELETE (`confirmed=true`). - `confirmed=false`: deletes nothing. With `project_id`…
Delete rum metric Delete a RUM custom metric by ID. Permanent and cannot be undone. Only custom metrics can be deleted (not OOTB metrics). **Always confirm the deletion with the user before calling. Never delete a metric speculatively.**…
Delete rum retention filter Permanently delete a RUM retention filter by ID. Retention filters control which RUM events are indexed and retained, so deleting one stops its matching events from being retained going forward. **This changes data-rete…
Describe datadog k8s resource Get detailed information about a specific Kubernetes resource. Use this tool instead of kubectl describe. Returns kubectl-style tabular fields plus additional resource-specific details such as CPU/memory requests and li…
Detach datadog security findings ticket Detach security findings from their linked case (and any downstream Jira issue, ServiceNow ticket, or Linear issue). Since Jira/ServiceNow/Linear tickets are always linked via a case, detaching the case also detaches th…
Devices onboarding Step-by-step instructions for adding initial Datadog RUM SDK to a project environment. This contains general instruction on how to enable the Datadog RUM SDK and all the features as session replay, logs or tracing. You…
Diff network device configurations Compare two ndm network device configuration snapshots and return a unified diff. Inputs: - original_config_id (required) - modified_config_id (required) Use config IDs returned by search_network_device_configurations.…
Docker onboarding Installs and configures the Datadog Agent container to collect infrastructure metrics, container telemetry, APM traces, and logs. The agent runs as a Docker container alongside any workload on a Docker-enabled host. You…
Do not call refresh widget do-not-call
Ecs onboarding Step-by-step instructions for adding initial Datadog Observability setup to ECS applications and configurations. You must first review the user's project and this tool's arguments (including any nested arguments) and fi…
Edit datadog notebook Edits an existing notebook. Can edit cells, metadata (name, template_variables, tags), or both. Look up widget reference schemas before constructing graph cells. Cell modes: (1) Full-replace (default) — replaces all cel…
Edit global variables Partially edit a Synthetics global variable by id. Only name, description, tags (full array replace), and value (value + secure) are editable. Omitted fields are left unchanged; only the fields explicitly set in this ca…
Edit synthetics tests Edit the configuration of a Synthetics test. Use this tool to update the configuration of a test.
Execute datadog workflow Start a new execution instance for a Datadog Workflow Automation workflow by ID. The workflow may be published or unpublished, and the selected base or draft spec must have an 'agent' trigger. Each successful call start…
Expand llmobs spans Load the children of specific spans in a trace, enabling progressive tree exploration. Use this when **get_llmobs_trace** returns collapsed nodes you want to expand. Returns expanded_spans[] (recursive tree, each node w…
Explore profiling call graph Explore a call graph to identify hot call relationships for the provided profile type. Best suited for investigating a single service at a time. For cross-service comparisons, use get_profiling_timeseries. Things of not…
Explore profiling flame graph Obtain a list of top stacktraces based on their value contribution for the provided profile type. Best suited for investigating a single service at a time. For cross-service comparisons, use get_profiling_timeseries. Th…
Explore profiling timeline Analyze timeline activity showing lane groups (threads, GC, etc.) and their CPU/I/O activities. Best suited for investigating a single service instance at a time. For cross-service comparisons, use get_profiling_timeser…
Find datadog database instances Discover and rank database instances for DBM investigation. USE THIS TOOL FIRST before calling other DBM tools that require a database_instance parameter. This tool discovers database instances via trace/span correlatio…
Find llmobs error spans Find all error spans in a trace with propagation context. Returns error details, parent context, and whether errors propagated to child spans. Returns errors grouped by span kind, each with span_id, error message/type/s…
Generate monitor message Generates a monitor message with What's Happening, Impact, and Links sections from a monitor query. Only 'metric alert' and 'query alert' monitor types are supported.
Get active feature flags do-not-call
Get autonomous system status Get the health status of an autonomous system (AS) using Network Path data. Calls the Network Path aggregate endpoint to assess whether the AS has detected issues such as packet loss, latency spikes, or lowered visibili…
Get canary results Get results from completed or in-progress canary experiments for a feature flag. This tool retrieves experimental data showing how each variant performed during canary testing, including metric measurements, statistical…
Get change stories Retrieve change events for an APM service over a time range. Use to correlate changes with performance issues, errors or incidents. Tracked Change types: deployment (code/version), feature_flag, traffic_anomaly, watchdo…
Get data catalog schema Return the entity type schema for every platform this org has data in. Takes no arguments. Discovers active platforms by searching for root entities across all supported platform types, then returns the metaschema for e…
Get datadog code coverage branch summary Fetch aggregated code coverage summary metrics for a repository branch. Use this tool to retrieve total coverage, patch coverage, and service/codeowner breakdowns for a specific branch. Common prompts: • Coverage summar…
Get datadog code coverage commit summary Fetch aggregated code coverage summary metrics for a repository commit. Use this tool to retrieve total coverage, patch coverage, and service/codeowner breakdowns for a specific commit. Common prompts: • Coverage summar…
Get datadog code coverage files Fetch per-file code coverage line data for a repository commit, branch, or pull request. Returns executable lines, covered lines, and added lines for each file. Use this tool to inspect which specific lines are covered…
Get datadog code coverage pr summary Fetch aggregated code coverage summary metrics for a pull request. Use this tool to retrieve total coverage, patch coverage, and service/codeowner breakdowns for a specific pull request. Common prompts: • Coverage summa…
Get datadog dashboard Retrieves a custom or integration Datadog dashboard by ID, returning its title, description, tags, widgets, and template variables. Use search_datadog_dashboards first to find dashboard IDs.
Get datadog database calling services Identify upstream APM services and resources that call database queries. Use this tool to correlate database activity with application traces, enabling root cause analysis across the APM-database boundary. Returns the p…
Get datadog database explain plans Retrieve explain plans for a query signature within a timeframe. Returns simplified plan structures optimized for analysis, including operator trees, index usage, estimated costs, and temporal metadata (first seen, last…
Get datadog database health signals Run database health checks to identify potential issues. Returns evidence-based signals about database health including CPU saturation, restarts, query latency, blocking, and more. Compares a regression timeframe (showi…
Get datadog database query performance Analyze a specific SQL query's performance — use when investigating slow queries, high database load, or resource-intensive queries. Returns throughput, average latency, execution time, rows per execution, cache hit rat…
Get datadog database query statement Retrieve the SQL statement text for a given query signature. The query signature is a stable hash fingerprint of the normalized SQL; use this tool to map signatures back to concrete SQL for investigation and reporting.
Get datadog database recommendations Retrieve live database recommendations for a database, query, table, host, or index. Returns the matching recommendations, current status, severity, raw recommendation context, and a normalized scope block that highligh…
Get datadog database schemas Fetch schema definitions (columns, indexes, foreign keys, partitions) for one or more database objects. Accepts a list of database objects with varying levels of specificity — from just a table name to a fully qualified…
Get datadog error tracking issue Get detailed information about a specific Error Tracking Issue from Datadog. Use this tool to retrieve full details for a single Issue by its ID. The Issue ID can be obtained from the search_datadog_error_tracking_issue…
Get datadog flaky tests Search for flaky tests from Datadog's Test Optimization API. Results include everything needed for triage and remediation: failure-rate stats, `flaky_state`, `flaky_category`, ownership context (`codeowners`, `services`…
Get datadog flaky tests management policies Returns the Flaky Tests Management (FTM) policies configured for a repository. Shows quarantine policies (auto-quarantine with window, branch rules, failure rate rules), disable policies (auto-disable, branch rules, fai…
Get datadog form Get a specific Datadog form by its ID, including full metadata and datastore configuration.
Get datadog incident Get detailed information about a specific Datadog incident by ID, including status, severity, timeline, associated users, and attachments.
Get datadog k8s manifest Get the YAML manifest for a specific Kubernetes resource. Use this tool instead of kubectl get -o yaml. Returns the manifest in YAML format. If the manifest exceeds max_tokens, it will be truncated and metadata will ind…
Get datadog metric Query metrics data from Datadog. Use response_format='timeseries' (default) to get time-indexed data points for graphs and trend analysis. Use response_format='scalar' to get a single aggregated value per group, useful…
Get datadog metric context Get metadata (description, type, unit, integration), available tags/dimensions, and optionally related assets for a metric. Useful for exploring metrics before querying them. Set use_cloud_cost=true for Cloud Cost Manag…
Get datadog notebook Retrieve information about a specific Datadog notebook by ID. This tool provides details including name, status, and associated author. The ID can also be extracted from a URL. The ID will be the last component, for exa…
Get datadog security aap blocking config Get the org-wide AAP (App & API Protection, formerly ASM / Application Security Monitoring) blocking configuration. Returns blocking_enabled, which controls default AAP attack blocking, and denylist_enabled, which contr…
Get datadog security aap custom rules Get AAP (App & API Protection, formerly ASM / Application Security Monitoring) WAF custom rules — user-authored in-app WAF rules that match request traffic and either monitor it or block it. Each rule has match conditio…
Get datadog security aap denylist List AAP (App & API Protection) denylist entries — IPs, users, user-agents AAP currently BLOCKS or monitors via automated security response. Each entry = Security Response Entity (aka "ASM Block" / "AAP block"). Store:…
Get datadog security detection rules Get security detection rules. This tool supports two modes based on the arguments provided: 1. Get a single rule by ID: provide rule_id — always returns the full rule object regardless of fields or full_rule. 2. List ru…
Get datadog security detection rules schema Return the schema / authoring reference for Datadog Cloud SIEM detection rules. Includes log_detection plus supported workload_security, application_security, api_security, and ai_guard sections. Customer-authorable det…
Get datadog security findings schema Call this first before using analyze_datadog_security_findings. Returns the schema (available fields and their types) for security findings, which you need to construct correct SQL queries. IMPORTANT: Use exact field na…
Get datadog security findings ticket suggestions Get ranked project and integration suggestions for creating Jira issues, ServiceNow tickets, or Linear issues. Call this when you don't know which project_id to use for create_datadog_security_findings_ticket. Returns a…
Get datadog security ioc indicator Retrieve full detail for one IoC indicator by value (score, category, AS info, GeoIP, log sources, services, signal counts, OCSF fields).
Get datadog security ioc schema Discover filterable fields and their values for IoC Explorer. Call without `filter` first to list all available field names. Then supply `filter` with an exact field name from that list to get `[{value, count}]` for tha…
Get datadog security signal Get the full details of a single Datadog security signal by ID. Returns the complete signal data including attributes, rule information, triage state, tags, and case correlations. IMPORTANT: Before using this tool, call…
Get datadog security signals schema Get the schema (available fields) for security signals. Use this tool to discover what fields can be used to filter or query security signals. Returns field names, types, and optionally descriptions and enum values. Sig…
Get datadog security suppressions Retrieve security monitoring suppressions from Datadog. Suppressions prevent detection rules from generating signals for specific conditions. This tool supports three modes based on the arguments provided: 1. List all s…
Get datadog security trace passlist List all AAP (App & API Protection) allowlist / passlist entries that exempt specific traces from AAP security analysis and WAF blocking. This tool operates on AAP traces only; it is unrelated to Cloud SIEM signal suppr…
Get datadog spreadsheet Retrieve a Datadog spreadsheet by ID. Returns tables (tables[].id), pivots (pivots[].id), and sheets (sheets[].id) with their configurations. Each table includes schema[].label (all column labels), calculated_columns[].…
Get datadog spreadsheet reference Returns the field reference guides for building inputs to upsert_datadog_spreadsheet. Sections: - "table" — field reference: import types, schema, calculated columns, lookups, filters, sort - "pivot" — field reference:…
Get datadog spreadsheet tab data Retrieve paginated data from a table, sheet, or legacy pivot in a Datadog spreadsheet. The tab type is inferred automatically from tab_id; use get_datadog_spreadsheet to discover tab IDs. For tables and legacy pivots: r…
Get datadog spreadsheet table data DEPRECATED: use get_datadog_spreadsheet_tab_data instead, which provides a unified interface for table tabs. Retrieve paginated rows from a table in a Datadog spreadsheet. Time range comes from the table's configured ti…
Get datadog test optimization settings Returns which Test Optimization features are enabled or disabled for a specific service. Shows the state of: Test Impact Analysis (ITR), Early Flake Detection (EFD), Auto Test Retries (ATR), Failed Test Replay, Code Cov…
Get datadog trace Retrieve a trace by trace ID from Datadog APM. This tool fetches all spans within a specific trace by default, providing detailed information about the request flow, timing, and service interactions. For large traces or…
Get datadog workflow Retrieve a single Datadog Workflow Automation workflow by ID. By default, returns the saved draft when one exists, otherwise the base. Set specTarget to select exactly the base or saved draft spec. The response includes…
Get datadog workflow action Get the full definition of a Datadog Workflow Automation action by actionId. Returns resolved input/output JSON schemas, action keywords, action-specific AI instructions, and other metadata needed to construct a workflo…
Get datadog workflow instance Retrieve a Datadog Workflow Automation execution instance. The default response is a lightweight execution summary. Set includeDetails to true for the raw detailed execution record, including workflow definition and sou…
Get datadog workflow spec schema Get the JSON schema for a Datadog Workflow Automation spec. Call this before constructing a spec for create_datadog_workflow, validate_datadog_workflow, or update_datadog_workflow.
Get datadog workflow step data Retrieve the execution data for a single step of a Datadog Workflow Automation instance: its inputs, evaluated inputs/outputs, and the execution context the step's expressions were evaluated against.
Get data entity details Fetch full details and attributes for one or more data entities by their entity IDs. Use this to get the complete attribute set for known data entities: owner, tags, display_name, custom attributes, and all core attribu…
Get data entity hierarchy Fetch the containment hierarchy (ancestors and descendants) for one or more entities. Use this for containment navigation — NOT for data lineage (use get_data_entity_lineage for that). Typical use cases: - "What schema/…
Get data entity lineage Fetch the live reachable lineage subgraph from one or more anchor entities. Checks direct children of the anchor entities for lineage as well. For example, you can pass a table entity id as an anchor, and get back the c…
Get data observability monitor Retrieves data observability metrics for a given monitor ID. This tool fetches data quality metrics timeseries data, including anomaly detection bounds when the monitor has anomaly detection enabled. For anomaly monitor…
Get data observability monitor coverage Fetch all Data Quality monitors for this org and resolve each monitor's entity filter to return the full set of entities it is configured to cover. For each monitor, the filter is evaluated against UGP to return detaile…
Get data observability monitor group statuses Query the current alert and warn state of DQ monitor groups from the alerting service. Coverage is based on actual monitor groups — entities for which the monitor has received real metric data. For each monitor, returns…
Get data observability recommendation Gets the full details of a single Data Observability recommendation by id, including its structured body (body_sections) describing the problem, evidence, and proposed change. Obtain the id from list_data_observability_…
Get dora fields List the valid measures, facets, aggregations, and cardinality_fields for aggregate_dora_events, per DORA index (deployment, commit, pull_request, failure). Call this before aggregate_dora_events to pick a valid 'metric…
Get entity descriptions Get custom user-defined descriptions for data entities by their IDs. Returns a map of entity_id to description with created_at and updated_at timestamps.
Get entity tags Get custom user-defined tags for data entities. Returns entity IDs with their associated key:value tags. These are custom tags distinct from built-in entity attributes.
Get feature flag Gets variants and status in environment for a specific feature flag by ID or key. Provide featureFlagID or featureFlagKey (or both). *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B…
Get form definition schema Get the JSON Schema used to validate a Datadog form's data_definition and ui_definition. Fetch this before constructing or updating a form definition with create_datadog_form or update_datadog_form.
Get form responses Get submitted responses for a Datadog form. Use get_datadog_form to obtain the datastore_id for the form first.
Get global variables Read this org's Synthetics global variables. Each variable is returned in full (id, name, description, tags, creator, editor, timestamps, and more). The plaintext value is included only for non-secure variables; secure…
Get guardrail metric Get details for a specific guardrail metric by ID. Use this to inspect a metric's full details including description and aggregation configuration. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, featur…
Get kafka client configs Return producer- and/or consumer-side Kafka client configuration for one or more services, as collected by Data Streams Monitoring (DSM). Each entry pairs a service name with a config_type of either 'producer' or 'consu…
Get llmobs agent loop Get a chronological view of an agent's execution loop, showing each step (LLM calls, tool invocations, decisions) in order. This provides a narrative of what the agent did and why. **Use cases:** - Understand an agent's…
Get llmobs all dataset records Walk a dataset's records page by page server-side and return them as shaped previews, with a cursor that always resumes exactly where the walk stopped. Use this when you need **complete coverage** of a dataset — exporti…
Get llmobs dataset records Read dataset records with structured previews + a schema summary. Records' `input` / `expected_output` / `metadata` are arbitrary JSON — this tool shapes them so the model sees structured previews (objects keep keys, li…
Get llmobs eval aggregate stats Get aggregate statistics for a specific evaluator over a time window, optionally filtered by ML application. **Use cases:** - Check the overall pass rate for an evaluator - Get score distribution (mean/p50/p90) for a sc…
Get llmobs evaluator Retrieve an LLM-judge evaluator configuration by name. Returns the full config including target (ml_app + sampling + filter), LLM provider, and judge prompt template. Returns a not-found error if no evaluator with this…
Get llmobs experiment dimension values Get the unique values for a dimension, with counts. Use this to discover valid filter values before calling **list_llmobs_experiment_events** or segment values before calling **get_llmobs_experiment_metric_values**. Ret…
Get llmobs experiment event Get full details for a single experiment event, including its input, output, expected_output, all metrics, and dimensions. Use this after **list_llmobs_experiment_events** to inspect a specific event in depth.
Get llmobs experiment metric values Get statistical analysis for a specific evaluation metric, optionally segmented by a dimension. Returns aggregate statistics, not per-event raw values. **Use cases:** - Compare a metric (e.g., accuracy) across dimension…
Get llmobs experiment summary Get a high-level summary of an experiment with pre-computed statistics for all evaluation metrics. Start here before using other experiment tools. Returns pre-computed stats (score/boolean/categorical) grouped by eval t…
Get llmobs full dataset records Fetch up to 3 specific records with **untrimmed** input / expected_output / metadata. Resolve `record_ids` via **get_llmobs_dataset_records** first. Returns `DatasetRecordsFullResult` with full record bodies. On invalid…
Get llmobs pattern config Get the most-recently-modified **Topics Discovery (Patterns)** configuration for the caller's org. Returns a not-found error if the org has no config yet. Use **list_llmobs_pattern_configs** instead when you need to see…
Get llmobs pattern points Get a **cursor-paginated page of clustering points** (individual spans) assigned to a single topic. Each point includes the `span_id`, `session_id`, and a span input preview. Resolve `topic_id` from **get_llmobs_pattern…
Get llmobs pattern run status Get the status and per-activity progress of the **most recent** Topics Discovery run for a config. Use this to tell whether clustering is still running, has completed, or failed before reading topics. Returns the run `i…
Get llmobs patterns Get the **topic hierarchy** discovered by a Topics Discovery run. Topics are organized into levels; each topic has a `name`, `description`, and `point_count`. Provide `config_id` (required). Omit `run_id` to read the mo…
Get llmobs patterns with points Get the topic hierarchy for a run **with the clustering point span IDs inlined** on each leaf (hierarchy-0) topic. Use this when you want both the topics and the spans that back them without a second call per topic. Set…
Get llmobs project Look up an LLM Observability **experiments project** by ID or name. Pass `project_id` (UUID) for a direct lookup or `project_name` to resolve by name. If you only have an `ml_app`, prefer **search_llmobs_spans** to find…
Get llmobs span content Retrieve the actual content of a specific field from a span. Call this after **get_llmobs_span_details** reveals which content fields are available via content_info. Content fields contain the span's I/O, LLM conversati…
Get llmobs span details Get detailed metadata for one or more spans within a trace. Returns everything except the actual content payloads — use **get_llmobs_span_content** to retrieve those. Each span includes identification, timing, error inf…
Get llmobs trace Get the full structure of a trace as a span hierarchy tree. Use this after **search_llmobs_spans** to understand the shape of a trace before drilling into specific spans. Returns trace overview (span counts by kind, err…
Get monitor coverage Finds monitoring gaps and coverage for services or hosts. Returns which signals (error rate, latency, request rate) are covered by monitors and which are missing. Use with create_datadog_monitor to fill gaps. Query exam…
Get monitor templates Retrieves official Datadog monitor templates as starting points for creating monitors. Use with create_datadog_monitor.
Get ndm device Get detailed information about a network device by its device_id. Use this to investigate device health and connectivity (ping status), get hardware details (vendor, model, serial number), check OS info for patching/com…
Get network device configuration Retrieve the full text of an NDM network device configuration snapshot (running config or startup config) for review, compliance auditing, or troubleshooting. Use a config_id from search_network_device_configurations re…
Get network path test runs Search and retrieve Network Path test runs using a query. Network Path tests data contains traceroute runs and hop-by-hop data. **Query Syntax**: Use search syntax to filter test runs. Common query patterns include: - S…
Get onboarding step Use this FIRST — before create-feature-flag — whenever a user asks to set up, add, or onboard Datadog feature flags in a project that doesn't have them yet: e.g. "set up feature flags", "add feature flags to my app", "g…
Get popular warehouse tables by query frequency Rank database tables by query activity, broken out by who is querying them. Returns one signal per user type, each an independently ranked list of the top N tables for that user type sorted by query count: human — real…
Get profiling fields Discover available fields and facets that can be used for filtering and grouping profiling data. Use this to find what groupBy or filter fields are available for get_profiling_timeseries queries. Returned fields only ap…
Get profiling field values Get the values for a specific profiling field/facet discovered via get_profiling_fields. Use this to discover what values a particular field has (e.g. all endpoint values, all function names). Returned field values only…
Get profiling profile types Returns profile types and families that can be used by other profiling tools given a query context. You can either query by tags (queryString + timeFrame) or by trace context. When using trace context, the tool will fin…
Get profiling runtime ids Returns individual profiled runtime IDs (processes/containers). These are exact strings that can't be changed. For family, don't use ebpf.
Get profiling service insights Returns insights over the provided time window. These insights contain: - A high-level summary explaining the issue and why it matters - Contextual insights from profiling data (for example, affected methods, packages,…
Get profiling services Returns profiled services along with their profiling families that can be queried for profiling data in the given query context. Note: results are in no particular order and do not indicate relative importance or activi…
Get profiling tag names Discover available tag names (e.g. service, host, env, version, family, runtime-id) from the profile metadata track. Use this to find what tags are available for filtering profiling data. Common infrastructure tags incl…
Get profiling tag values Get the values for a specific tag (e.g. service, host, env, version, family, runtime-id) from the profile metadata track. Use get_profiling_tag_names first to discover available tags. Returns at most 50 results sorted b…
Get profiling timeseries Query profiling data as timeseries, aggregated into time buckets. Use this to analyze trends, compare services, or identify performance regressions over time. Well suited for cross-service investigations — use groupBy t…
Get prs by head branch Retrieves all pull requests for a repository that have a specific head branch. This is useful for finding active PRs associated with a particular feature branch or development branch.
Get reference table rows Retrieve specific rows from a reference table by their primary key values. Returns the row data in tab-separated format for easy readability. Use list_reference_tables first to discover table IDs.
Get replay summary Get an AI-generated play-by-play of what a user did during a session replay — what pages they visited, what actions they took, and what happened step by step. Use this tool when the user wants to understand the content…
Get rum insight Get a pre-computed performance insight for a specific RUM view. Call this to diagnose a performance problem on a known view. Choose insight_name based on what you want to investigate: 'aggregated_waterfall' to find slow…
Get rum summary Returns a performance summary for a RUM application with period-over-period diffs and anomaly windows. Covers browser metrics (LCP, FCP, CLS, INP, loading time, time spent) and mobile metrics (refresh rate, memory, slow…
Get rum view waterfall Reconstruct the chronological load timeline for ONE specific RUM view occurrence, web or mobile. Returns every resource, long task, error, and user interaction (action) that occurred during that single view, ordered by…
Get saved filter Get a saved filter by id, including its targeting rules.
Get spark job health Retrieves detailed health metrics for a single Spark or Databricks job run. This tool extracts structured health data from Spark/Databricks job traces including: - Target metrics: duration, executor CPU time, allocated…
Get spark sql plan Retrieves the Spark SQL physical execution plan from a spark.stage span. This tool extracts and formats the _dd.spark.sql_plan attribute from a Spark stage span. The execution plan shows: - Node types (Exchange, SortMer…
Get subject kafka schemas Return all Kafka Schema Registry versions for a single subject on a given Kafka cluster. Use this after list_all_kafka_schemas to inspect the full version history (schema body, id, version, references) of a specific sub…
Get synthetics tests Search and retrieve details about Synthetics tests configured in Datadog. Use this tool to either query test configurations, or test results. Supports filtering by endpoint domain and/or path, or public ID for test conf…
Get user config do-not-call
Get warehouse query history Fetch recent queries that touched one or more specific entities, in reverse chronological order (most recent first). Use this when the user wants to understand query activity for a specific table or entity: - Who has be…
Get widget reference Get TypeScript schemas and building instructions for widget types. Call before generating widget JSON. Note: "group" is a container for organizing related widgets — include both "group" and any intended child widget typ…
Inspect data observability monitor annotations Inspect Data Quality monitor data, anomaly bounds, and existing annotations before proposing a change. Monitor IDs are stable request identifiers, but when a monitor name has already been resolved, use the name as the p…
Kubernetes onboarding Step-by-step instructions for adding initial Datadog Observability setup to Kubernetes applications and configurations. You must first review the user's project and this tool's arguments (including any nested arguments)…
Linux onboarding Installs and configures the Datadog Agent on a Linux host to collect infrastructure metrics, APM traces, and logs.
List all kafka schemas List every Kafka Schema Registry schema known to Data Streams Monitoring (DSM) for the current org within a time window. Returns subject, cluster, version, schema type, and compatibility metadata. Use this to discover w…
List allocations for feature flag List allocations for a specific feature flag. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' some…
List audit events List Datadog Audit Trail events over a time window. Audit Trail monitors user activity across the Datadog platform to help maintain compliance, enforce platform governance, and build transparency, capturing audit events…
List autonomous system statuses Get an overview of autonomous system (AS) health from Network Path data, without needing a specific ASN. Calls the Network Path aggregate endpoint with no ASN filter and returns a compact summary of which autonomous sys…
List datadog database optimizations List a database's ready-to-apply, benchmark-validated query optimizations — the same set shown on the Datadog DBM Optimizations page. Each entry carries a MEASURED improvement, so results can be ranked by impact. THIS I…
List datadog security findings automation rules List automation rules for security findings. Returns the ordered list of rules for a given rule type (first-match-wins evaluation order). Rule types: mute (suppress findings), due_date (set remediation deadlines), ticke…
List datadog skills List available Datadog skill guides. Skills document how to use Datadog's tools: the right attributes, query syntax, and common pitfalls. Call this before load_datadog_skill whenever you are not already certain of the e…
List datadog workflow instances List the execution instances of a Datadog Workflow Automation workflow. Use this to see a workflow's execution history — for example to find a recent run, check how many executions succeeded or failed, or locate an inst…
List datadog workflows Find Datadog Workflow Automation workflows and inspect their metadata. Metadata-only output is the default. Each result's meta.hasSavedDraft indicates whether a saved draft exists. Use get_datadog_workflow for the autho…
List data observability recommendations Lists Data Observability cost- and performance-optimization recommendations for data jobs and queries (Spark, Databricks, Snowflake, BigQuery), each with estimated cost and duration savings. Returns lightweight summarie…
List environments List all flagging environments for the organization. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'fla…
List feature flags List all feature flags for the organization. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' somet…
List guardrail metrics List all available guardrail metrics for the organization. Use this tool to discover metric IDs needed for allocation guardrails. Results are paginated to prevent context window overflow. *** FEATURE FLAG DETECTION ***…
List kafka broker configs List configuration versions for a Kafka broker on a given cluster, as collected by Data Streams Monitoring (DSM). Useful for diagnosing broker-level config drift and correlating cluster health changes with config edits.…
List kafka topic configs List configuration versions for a Kafka topic on a given cluster, as collected by Data Streams Monitoring (DSM). Returns the history of topic-level config values (retention, cleanup policy, etc.) for auditing and drift…
List llmobs datasets List **experiments datasets** within a project, with optional id or name filter. Resolve `project_id` first via **get_llmobs_project** if you only have a project name. Returns `datasets` (zero or more matches), paginati…
List llmobs evals List every evaluator configured for the caller's organization, across all ML applications. Returns the eval name, ml_app, and enabled status for each evaluator. Use list_llmobs_evals_by_ml_app to scope to a single ML ap…
List llmobs evals by ml app List all evaluators configured for an ML application. Returns the eval name and enabled status for each evaluator. Use get_llmobs_evaluator to retrieve a single evaluator's full configuration.
List llmobs experiment events List experiment events with minimal summaries, supporting filtering by dimension or metric and sorting by metric value. Does NOT return full content — use **get_llmobs_experiment_event** to inspect a specific event. **U…
List llmobs experiments List experiment runs in a project or against a dataset, newest first. This is the discovery step before **get_llmobs_experiment_summary**, which needs an experiment ID. Scope is required: pass `project_id` or `dataset_i…
List llmobs pattern configs List all **Topics Discovery (Patterns)** configurations for the caller's org. A pattern config defines which LLM Obs spans to cluster (via `evp_query`), how many to sample, and how deep the topic hierarchy goes. Returns…
List llmobs pattern runs List the **completed** Topics Discovery runs for a config, newest first. Each run is a distinct clustering of the config's spans at a point in time. Returns `runs` with each run's `id`, `status`, timestamps, and the `co…
List llmobs projects List all LLM Observability **experiments projects** for the org. Returns projects sorted by creation date, newest first. Returns `projects` (array), `next_cursor` (pass as `cursor` to fetch the next page), and `truncate…
List onboarding flags Check for existing flags tagged source:agentic-onboarding that qualify for reuse: a non-production environment, currently ENABLED, whose queries already cover the given dd_env under the runtime matcher — the same guaran…
List reference table rows Fetch a page of rows from a reference table in primary-key order. Returns rows and a continuation_token for the next page. Pass continuation_token back on the next call to paginate consistently. Use list_reference_table…
List reference tables List and search reference tables in the organization. Reference tables are used to enrich logs and other data with additional context. Use this tool to discover available tables, check their status, and find tables by n…
List saved filters List saved filters for the organization.
List stale feature flags List stale feature flags in the organization, each enriched with the reason it is stale and a tool_hints array of suggested next-step tools to clean it up.
List synthetics locations Returns all Synthetics locations available to this org — managed (aws:, gcp:, azure: prefixes) and private (pl: prefix). When presenting results, include at least the id and name for each location.
Llm observability onboarding Step-by-step instructions for adding initial Datadog LLM Observability (AKA, 'LLMObs') setup to applications with an LLM or AI agent. You must first review the user's project and this tool's arguments (including any nes…
Load datadog skill Load a Datadog skill guide before using related Datadog tools. Skills improve query quality by documenting the right attributes, syntax, and common pitfalls. Skill names depend on the visible toolsets; if you do not alr…
Manage datadog error tracking issue comments Add, update, or delete a comment on a Datadog Error Tracking issue. Use action "add" to post a new comment, "update" to edit an existing comment, or "delete" to remove one. Markdown is supported in comment messages. The…
Monitor groups search Searches monitor groups to find which specific groups (e.g. host:web-1) are alerting across monitors. Use monitor_id to filter groups for a specific monitor, or use the query field with supported facets: group_status (e…
Mute datadog security findings Mute or unmute security findings. Muting suppresses a finding from alerts and dashboards without resolving it. Use analyze_datadog_security_findings or search_datadog_security_findings to find specific finding IDs first…
Optimize datadog database query Analyze a SQL query for optimization opportunities using deterministic rules plus LLM-assisted analysis. Returns actionable recommendations including query rewrites, anti-pattern detection (SELECT *, OFFSET without ORDE…
Publish datadog form Publish a specific draft version of a Datadog form, making it the active published version. Use get_datadog_form with version='latest' to find the current draft version number before publishing. Returns the publication…
Publish datadog workflow Publish a Datadog Workflow Automation workflow. If a saved draft exists, it replaces the base spec and is removed. Otherwise, the existing unpublished base is published.
Rank data entities by lineage degree Rank entities by their transitive lineage connectivity using a pre-built snapshot. Returns parent-level entities (tables, dashboards, jobs, etc.) ranked by how many other entities they connect to. Child nodes such as co…
Rank data observability monitor candidates Rank tables by their importance for monitoring, combining lineage impact and query activity into a single composite score. Use this as the primary entry point for "what should I monitor?" questions — it produces a ranke…
Read kafka messages Read messages from a given Kafka cluster/topic via the Datadog Agent. Dispatches a Remote Config action and polls for the agent's response. REQUIRES the `data_streams_monitoring_capture_messages` permission. Resolving `…
Recommend monitor threshold Recommends a threshold value for a metric monitor query based on peer-group statistics. Returns the recommended threshold, its source, a confidence score, recommendation status, a bounds-validation result, and IDs for c…
Reorder datadog security findings automation rules Move a security findings automation rule up or down in the evaluation order. Automation rules use first-match-wins semantics, so order matters. Use a large positions value (e.g. 1000) to move a rule to the top or bottom…
Reorder rum retention filters Set the full evaluation order of a RUM application's retention filters. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects billing.** Fi…
Restore llmobs dataset version Roll a dataset's records back to a previous version. The dataset's version is bumped and its live records are replaced with that version's records — records added since then stop being part of the dataset. **Two-step**:…
Retry datadog ci job ⚠️ WRITE OPERATION — queues a retry for a failed CI job via Datadog's CI Action backend. Requires explicit user approval before running. Submits an async retry task for a specific job. Safety rails applied server-side:…
Run synthetics tests Trigger on-demand runs for one or more existing Synthetics tests by public_id; optionally apply shared locations, headers, body, variables, or start URL overrides. Triggering is billable; call only after an explicit use…
Search audit events Search Datadog Audit Trail events using a query string. Audit Trail monitors user activity across the Datadog platform to help maintain compliance, enforce platform governance, and build transparency, capturing audit ev…
Search cws agent events Search and retrieve Workload Protection (CWS) agent events from the secruntime event track. Agent events are raw security events detected by the Datadog Agent's runtime security module (eBPF-based). They include process…
Search datadog ci pipeline events Search and retrieve CI pipeline events from Datadog with full metadata including timing, failure reasons, error messages, and retry history. Use this tool when you need to troubleshoot CI pipeline failures, get structur…
Search datadog dashboards List and retrieve information about Datadog dashboards. This tool helps discover available dashboards, their IDs, titles, and underlying queries. Use this tool when you need to find specific dashboards, get an overview…
Search datadog database plans Search and retrieve Database Monitoring (DBM) query execution plans from Datadog. Query execution plans show how the database engine executes queries, including index usage, join strategies, and cost estimates. Use this…
Search datadog database samples Search and retrieve Database Monitoring (DBM) query samples from Datadog. Query samples represent individual query executions with performance metrics, allowing you to analyze database activity patterns, identify slow q…
Search datadog error tracking issues Search Error Tracking Issues from Datadog. Use this tool to search errors across data sources (RUM, Logs, Traces, ...). Returns groups of errors ("Issues"), along with the number of times they occurred within the given…
Search datadog events Search and retrieve raw Datadog events (deployments, alerts, system activities, infrastructure changes, etc.). Do NOT use for counts, aggregations, or grouped analysis — use aggregate_events instead. Best for: inspectin…
Search datadog forms Search Datadog forms for the authenticated organization. Returns form metadata including name, description, active status, and creation time.
Search datadog hosts Explore Datadog hosts inventory with SQL. Queries run against the virtual 'hosts' table backed by "dd.hosts" (Advanced Query API), which exposes hostname, hostname_aliases (text[]; use hostname_aliases[1]), tags (hstore…
Search datadog incidents Search Datadog incidents. Default sort: newest first. Supports filtering by state, severity, title, team, creation time, and more. Use `semantic_query` for natural-language search over AI-generated incident summaries. P…
Search datadog k8s resources Search for Kubernetes resources. Use this tool instead of kubectl to determine the state of Kubernetes resources (for example, Kubernetes deployments or pods). This tool is preferred over kubectl because it does not req…
Search datadog logs Search and retrieve raw log entries or log patterns. Do NOT use for counting or aggregations — use analyze_datadog_logs instead. Best for: viewing raw logs, discovering patterns (use_log_patterns=true), and discovering…
Search datadog metrics List available metrics in Datadog with optional filtering by name and tags. Set use_cloud_cost=true to search Cloud Cost Management metrics.
Search datadog monitors List and retrieve information about Datadog monitors. This tool helps discover monitors, their status, configuration, and alerts. Use this tool when you need to find monitors for investigation, management, or analysis p…
Search datadog notebooks Search Datadog notebooks. Use this tool when you need to find notebooks for investigation or monitoring purposes. Results can be filtered, for example by author, and sorted. This tool returns snippets of the original no…
Search datadog rum events Search and retrieve raw Datadog RUM events using advanced query syntax. Do NOT use for counts, aggregations, or grouped analysis. Best for: inspecting individual RUM events, debugging specific user experience issues, ex…
Search datadog security findings Fallback tool for retrieving full security finding details. Prefer analyze_datadog_security_findings (with get_datadog_security_findings_schema) for most findings analysis tasks. Use this tool ONLY when: 1) analyze_data…
Search datadog security ioc indicators List IoC Explorer indicators (IPs, domains, URLs, file hashes) matched against threat intel feeds. Returns IoC indicators, not security signals; `signal_count` is contextual (signals that referenced the indicator). Defa…
Search datadog security signals Filter and list security signals from Datadog Security Monitoring matching criteria (status, time range, rule type, severity, service). DO NOT use this tool for counts, aggregations, top-N, breakdowns, or trends — use a…
Search datadog service dependencies Retrieve information about Datadog service dependencies. This tool helps discover upstream and downstream service dependencies in your environment as well as services owned by a given team. Use this tool when you need t…
Search datadog services List and retrieve information about Datadog services. This tool helps discover services in your environment, their descriptions, teams, and links. Use this tool when you need to find services for investigation, manageme…
Search datadog slos Searches Datadog SLOs by name, tags, or type. Filter with query syntax like 'service:my-service' or 'team:checkout'.
Search datadog spans Retrieve raw Datadog APM spans matching a query. Do NOT use for counts, aggregations, or grouped analysis — use aggregate_spans instead. Best for: inspecting individual spans, debugging request flows and failures, and d…
Search datadog spreadsheets Search Datadog spreadsheets by name or owner. Returns a paginated list of spreadsheets with their IDs and names.
Search datadog test events Search and retrieve individual test events from Datadog with full metadata including error messages, stack traces, retry history, and flaky status. Use this tool to investigate specific test failures, examine execution…
Search datadog workflow actions Search the Datadog Workflow Automation action catalog. Actions are the building blocks of workflow steps. Each result exposes actionId; pass it to get_datadog_workflow_action and use the same value as the workflow step'…
Search data entities Search for data entities in the data catalog. Parameters: - name: Entity name to search for. Supports wildcards anywhere in the value: prefix (stg_*), suffix (*_raw), and substring/infix (*orders*, fct_*_monthly). - tex…
Search dora events Search DORA events, or fetch a single deployment or pull request by ID. Set 'target' to choose which DORA event type to search: deployments or pull requests. When event_id is set, all other parameters except 'target' ar…
Search llmobs spans Search for LLM Observability spans. Entry point for trace analysis — use it to find spans before drilling in with **get_llmobs_trace**. **Prefer structured parameters** (`ml_app`, `tags`, `span_kind`, `span_name`) over…
Search ndm devices Search SNMP-monitored network devices (routers, switches, firewalls) in Datadog NDM. Use to investigate device health, interface bandwidth saturation, LACP/LAG/port-channel issues, topology neighbors (LLDP/CDP), QoS que…
Search ndm interfaces Get all network interfaces (e.g., GigabitEthernet0/0/1, Vlan100) for a device. Use this to troubleshoot connectivity by checking interface status (up/down/warning), identify problematic interfaces during outages, get IP…
Search network device configurations Search NDM network device configuration snapshots (running config, startup config) for change tracking, config drift detection, or compliance auditing. Returns config metadata and IDs — use get_network_device_configurat…
Search pr insights Retrieves issues blocking a pull request to help resolve and fix problems. Provides insights on failed tests, flaky tests, code quality problems, security vulnerabilities, and failed CI jobs.
Search replays Search Datadog Session Replay recordings and return a list of sessions with replay links. Only returns sessions that have a replay recording available. Two modes: • Session filter mode (default): Filter replays by sessi…
Search rum applications Search RUM applications in the organization. Returns application_id (UUID), name, type, is_active, rum_event_processing_state (ALL/ERROR_FOCUSED_MODE/NONE), product_analytics_retention_state (MAX/NONE), tags, and creato…
Search rum metrics Search the organization's RUM metrics. Two kinds share the same shape: "custom" metrics are user-defined timeseries computed from RUM events, and "ootb" metrics are Datadog-predefined (server-managed). Omit type to retu…
Search rum retention filters Search RUM retention filters for an application. Retention filters control which RUM events are indexed and retained. Provide application_id to list filters for that application, optionally narrowed by name (case-insens…
Serverless onboarding Step-by-step instructions for instrumenting serverless workloads with Datadog. This tool helps configure Datadog metrics, server-side APM tracing, and logs for serverless platforms such as AWS Lambda, Vercel, GCP Cloud…
Source map uploads Step-by-step instructions for configuring source map uploads for a project to Datadog. You must first review the user's project and fill out as many arguments as possible before calling this tool. Only call this tool if…
Studio onboarding Step-by-step instructions for adding Datadog Studio to a project. You must first review the user's project and fill out as many arguments as possible before calling this tool. Check project files and dependencies to det…
Submit llmobs experiment events Submit evaluation-metric events to an existing experiment. Each metric records a judged value and, when a span_id is provided, attaches to that experiment span. **Required per metric:** label, metric_type, and the value…
Submit mcp feedback Submit feedback about capabilities provided by this Datadog MCP server only. Do NOT submit feedback about other MCP servers or plugins (e.g. Atlassian, CodeSandbox, Slack, GitHub). After completing a task, briefly consi…
Suggest data observability monitor filters Analyze a set of entities to find common attributes and naming patterns, then suggest monitor filter expressions that group subsets of those entities for use in monitor definitions. Pass entity IDs from prior tool resul…
Summarize data entity lineage Get aggregate statistics about the lineage graph reachable from anchor entities. Use this BEFORE get_data_entity_lineage when dealing with large or unknown graphs. It returns counts and breakdowns without the full node/…
Sync allocations for feature flag environment Synchronize allocations for a feature flag in a specific environment. This tool supports FEATURE_GATE and CANARY allocations, including exposure schedules and guardrail metrics. If any existing allocation is linked to a…
Sync experiment allocations for feature flag environment Synchronize allocations that include a FEATURE_GATE allocation linked to a standard experiment. Use this tool when the requested or existing full allocation set contains a FEATURE_GATE allocation linked to a standard ex…
Synthetics test wizard Use this tool to validate (preview) or create (create) a Synthetics API http test. Every test must be previewed and validated by the user before being created.
Test optimization onboarding Step-by-step instructions for adding Datadog Test Optimization setup this project. You must first review the user's project and this tool's arguments (including any nested arguments) and fill out as many of them as poss…
Unarchive feature flag Unarchive a previously archived feature flag, making it visible in the main list again. Provide featureFlagID or featureFlagKey (if both are given, featureFlagID wins).
Unarchive saved filter Unarchive a previously archived saved filter.
Unblock datadog security aap denylist Remove AAP (App & API Protection) denylist entry — stop blocking IP/user/user-agent. Mirrors UI "Unblock" button: POST past expiration on Security Response Entity, clears every attached response. Writes ASM_DATA + Remot…
Unpublish datadog workflow Stop a Datadog Workflow Automation workflow from starting new automatic executions by unpublishing it, while preserving its base spec and any saved draft. This does not cancel executions already in progress; use cancel_…
Update datadog error tracking issue Update an Error Tracking Issue in Datadog. Use this tool to change the state of an issue or update its assignee. At least one of state or assignee must be provided. The Issue ID can be obtained from the search_datadog_e…
Update datadog flaky test states ⚠️ WRITE OPERATION — modifies flaky test states in Datadog Test Optimization. Requires explicit user approval before running. Sets the state of one or more flaky tests identified by their IDs. States: • quarantined — te…
Update datadog form Create a new draft version of a Datadog form, updating its schema and/or UI layout. The schema is unique, you must retrieve it using the `get_form_definition_schema` tool before attempting to make an update. The new ver…
Update datadog monitor Updates a SINGLE existing Datadog monitor identified by its numeric ID. Uses PATCH semantics: only the fields you provide are changed; all others are left as-is. This edits exactly ONE monitor per call — NEVER use it to…
Update datadog published analysis Updates a published analysis (also called a published dataset) by re-syncing it with the current notebook cell definitions. A published analysis is a snapshot of a computational notebook's cells, exposed as a queryable…
Update datadog security detection rule Update an existing Cloud SIEM detection rule by PUTing the supplied payload to PUT /api/v2/security_monitoring/rules/{rule_id}. PUT replaces the rule wholesale — call `get_datadog_security_detection_rules` first to fetc…
Update datadog security findings automation rule Update an existing security findings automation rule. Supports partial updates — only the fields you provide will be changed, other fields are preserved. Works for all rule types: mute, due_date, ticket_creation, severi…
Update datadog security ioc indicator triage Set the triage state of an IoC indicator. Each call appends an immutable audit row.
Update datadog security signals triage Update the triage state and/or assignee of security signals. The tool collects all matching signal IDs first, then applies updates in batches. Provide either signal_ids (for a known set of signals) or filter_query (to m…
Update datadog security suppression Update an existing security monitoring suppression rule in Datadog. All fields except suppression_id are optional — only provided fields are changed. Call get_datadog_security_suppressions first to retrieve the current…
Update datadog workflow Update an existing Datadog Workflow Automation workflow by ID. Returns the updated workflow. A successful response confirms that the workflow was saved; it does not establish successful runtime behavior. Top-level field…
Update data observability recommendation status Sets the lifecycle status of a Data Observability recommendation, e.g. to mark it applied (RESOLVED) or dismissed (IGNORED) after acting on it. Obtain the id from list_data_observability_recommendations or get_data_obse…
Update entity description Set or update the custom user-defined description for a data entity.
Update entity tags Add or remove custom user-defined tags on data entities. Tags are key:value strings. Returns updated tags for the specified entities.
Update environment Replace the attributes of an existing Feature Management environment. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say…
Update feature flag environment Update a feature flag in a specific environment by enabling/disabling it, changing the default variant, setting an override variant, or clearing an override variant. *** FEATURE FLAG DETECTION *** If users mention: flag…
Update llmobs experiment Update the mutable properties of an existing experiment. Provide only the fields you want to change; omitted fields are left untouched. At least one updatable field must be provided. Use **status** to track lifecycle: "…
Update rum retention filter Update an existing RUM retention filter's attributes in place. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects billing.** Lowering a…
Update saved filter Update a saved filter's name, description, and/or targeting rules. Only provided fields change. Editing targeting rules propagates to every feature flag that references the filter.
Upsert datadog dashboard Creates or updates a Datadog ordered-grid dashboard. New dashboards are always ordered; widget updates are only supported on ordered dashboards. When updating widgets, prefer diff-style payloads to minimize tokens: send…
Upsert datadog security aap custom rule Create or update an AAP (App & API Protection) WAF custom rule — a user-authored in-app WAF rule that matches request traffic and monitors or blocks it. Use for "block requests that…", "write a WAF rule", "virtual-patch…
Upsert datadog security aap denylist Add/refresh AAP (App & API Protection) denylist entry — block IP/user/user-agent via auto security response. Writes ASM_DATA + Remote Config; seconds-to-minutes propagation. Upsert by (entity_type, value): re-posting ov…
Upsert datadog security trace passlist Create or update an AAP (App & API Protection) passlist/allowlist entry — also known as a WAF exclusion filter — that exempts traces from WAF analysis/blocking. AAP traces only; unrelated to Cloud SIEM signal suppressio…
Upsert datadog spreadsheet Create or update a Datadog spreadsheet's tables, sheets, and pivots in a single call. Always create pivots embedded within a sheet (in sheets[].pivots), not as standalone tabs. To delete the spreadsheet itself, use dele…
Upsert data observability monitor annotations Create, update, or extend Data Quality monitor annotations. Monitor IDs are stable request identifiers, but when a monitor name has already been resolved, use the name as the primary user-facing label and put the ID in…
Upsert reference table rows Insert new rows or update existing rows in a reference table. If a row with the same primary key already exists its values are overwritten; if it does not exist it is created. Composite primary keys are not supported. E…
Upsert rum metric Create or update a RUM custom metric. If the metric does not exist it is created; if it already exists its mutable fields (filter, group_by, include_percentiles) are updated. IMMUTABLE after creation: event_type, aggreg…
Validate dashboard widget Validate a widget definition against the dashboard schema. Call when generating a widget JSON.
Validate datadog workflow A read-only check of a complete candidate workflow spec. It does not create or change a workflow. Semantic invalidity returns isValid: false and validationErrors. Malformed tool arguments can still produce a tool error.…
Validate monitor definition Validates a monitor JSON definition. Always use before create_datadog_monitor.
Verify onboarding flag Verify a client-side onboarding flag through the public Datadog CDN using the user's own client token — the same path browser/mobile client SDKs use. Returns {ok:true, value:true, variation_key:"<served variant>"} only…

Setup

How we connect it

1
Connect your account

You log in with your own Datadog MCP account. We never see your password, and you can revoke access from Datadog MCP at any time.
2
Set the guardrails

Read-only by default. You choose which write actions the agent may take, and anything outside that policy gets confirmed with you first.
3
We keep it running

Health checks on every connection, updates handled for you, and we watch the first week of activity to make sure the work lands.

FAQ

Datadog MCP questions, answered.

How does the agent connect to Datadog MCP?

You sign in with your own Datadog MCP account. Permissions are scoped to the minimum the agent needs, the connection is health-checked, and you can revoke access from Datadog MCP at any time.

What can the agent actually do in Datadog MCP?

The actions Datadog MCP's API allows, the same things a person clicking around the app could do. Connections start read-only by default; write actions are confirmed against the policy you set before the agent takes them.

Is Datadog MCP included in my plan?

Connections are priced per tool on top of the base plan. Some are included, some are premium. See pricing for how connection charges work.

How long until Datadog MCP is ready?

Standard tools are ready inside 7 business days of the setup call. We test the connection end to end, walk you through how the agent uses it, and watch the first week of activity.

Ready to put Datadog MCP to work?

Tell us what your team runs on. We set up the connection, secure it, and your agent takes it from there.

Book a setup call → Browse all connections

All product names, logos, and brands are property of their respective owners; used for identification only. ZeroToClaw is not affiliated with or endorsed by Datadog MCP.

Connect Datadog MCP to your AI agent

What your agent can do in Datadog MCP

How we connect it

Connect your account

Set the guardrails

We keep it running

More Developer Tools tools your agent can use

Datadog MCP questions, answered.

Ready to put Datadog MCP to work?