Datadog MCP Server

A Model Context Protocol (MCP) server that provides Claude and other AI assistants with direct access to the Datadog API. Query metrics, search logs, manage monitors, investigate security signals, and track billing — all through natural language.

Features

Category	Tools
Metrics	Query timeseries data, list active metrics
Logs	Search and filter logs with full query syntax
Security Monitoring	Search security signals (SIEM, CWS, CSM)
Workload Protection	List/manage CSM Threats policies and agent rules
Monitors	List, create, get, mute, and unmute monitors
Dashboards	List and retrieve dashboard definitions
Billing & Usage	Monthly costs, projected costs, usage breakdowns, cost attribution, security-specific usage

Prerequisites

• Python 3.10+
• A Datadog account with API and Application keys
• Claude Code or any MCP-compatible client

Setup

1. Clone and install

git clone https://github.com/anthropics/datadog-mcp-server.git
cd datadog-mcp-server
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

2. Configure credentials

Copy the example env file and add your Datadog keys:

cp .env.example .env

Edit .env:

DD_API_KEY=your_api_key_here
DD_APP_KEY=your_app_key_here
# DD_SITE=datadoghq.eu  # Optional: for non-US regions

You can create API and Application keys in Datadog Organization Settings.

3. Add to Claude Code

Add the server to your Claude Code settings (~/.claude/settings.json):

{
  "mcpServers": {
    "datadog": {
      "command": "/path/to/datadog-mcp-server/.venv/bin/python",
      "args": ["/path/to/datadog-mcp-server/server.py"],
      "env": {
        "DD_API_KEY": "your_api_key",
        "DD_APP_KEY": "your_app_key"
      }
    }
  }
}

Or for non-US Datadog regions, add "DD_SITE": "datadoghq.eu" to the env block.

Available Tools

Metrics

• query_metrics — Query timeseries data (e.g. avg:system.cpu.user{*})
• list_active_metrics — List all active metric names

Logs

• search_logs — Search logs with Datadog query syntax, time ranges, and limits

Security Monitoring

• search_security_signals — Search SIEM/CWS/CSM signals with filters and time ranges

Workload Protection (CSM Threats)

• list_workload_protection_policies — List all CSM Threats policies
• list_workload_protection_rules — List CWS agent rules (optionally filtered by policy)
• get_workload_protection_rule — Get details for a specific agent rule

Monitors

• list_monitors — List monitors, optionally filtered by tags
• create_monitor — Create a new monitor with thresholds, notifications, and options
• get_monitor — Get details for a specific monitor
• mute_monitor / unmute_monitor — Mute or unmute monitors by scope

Dashboards

• list_dashboards — List all dashboards
• get_dashboard — Get a specific dashboard's full definition

Billing & Usage

• get_monthly_cost — Historical monthly costs broken down by product
• get_estimated_cost — Current month-to-date estimated cost
• get_projected_cost — Projected full-month cost
• get_billing_summary — Billable usage summary with counts and costs per product
• get_monthly_cost_attribution — Costs attributed by tags (team, env, service)
• get_hourly_usage — Hourly usage for specific product families
• get_usage_security — Combined CSPM + CWS + SDS + ASM usage
• get_active_billing_dimensions — List all active billing product categories

Example Usage

Once configured, you can ask Claude things like:

• "What's our Datadog bill for February?"
• "Show me error logs from the payments service in the last hour"
• "Are there any critical security signals from today?"
• "Create a monitor that alerts when CPU usage exceeds 90%"
• "How much are we spending on Datadog security products?"
• "What's the projected cost for this month?"

Required Datadog Permissions

Your Application key needs the following permissions depending on which tools you use:

Tools	Required Scopes
Metrics	timeseries_query
Logs	logs_read_data
Security Signals	security_monitoring_signals_read
Workload Protection	security_monitoring_rules_read
Monitors	monitors_read, monitors_write (for create/mute)
Dashboards	dashboards_read
Billing & Usage	usage_read

Datadog Site Configuration

Region	DD_SITE value
US1 (default)	datadoghq.com
US3	us3.datadoghq.com
US5	us5.datadoghq.com
EU	datadoghq.eu
AP1	ap1.datadoghq.com

License

MIT