Quick Use
npm install -g datadog-mcp-server- Add to claude_desktop_config.json with DD_API_KEY + DD_APP_KEY
- Use a scoped read-only APP key, restart Claude
Intro
The Datadog MCP server exposes Datadog's metrics, logs, traces, monitors, and incidents as MCP tools — your Claude or Cursor agent can ask 'what services have elevated p99 latency right now?' and get a real answer from your live Datadog data. Best for: SRE copilots, on-call triage flows, post-incident retros, anywhere you want an LLM that can read your observability stack. Works with: any MCP host (Claude Desktop, Cursor, Cline, LibreChat, MCP Inspector). Setup time: 10 minutes.
Install (community server, npm-published)
npm install -g datadog-mcp-serverClaude Desktop config
{
"mcpServers": {
"datadog": {
"command": "npx",
"args": ["-y", "datadog-mcp-server"],
"env": {
"DD_API_KEY": "...",
"DD_APP_KEY": "...",
"DD_SITE": "datadoghq.com"
}
}
}
}Drop into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or the equivalent on your OS.
Cursor config
~/.cursor/mcp.json with the same servers block. Restart Cursor and the tools appear in the agent panel.
Tools exposed
| Tool | Purpose |
|---|---|
query_metrics |
Run a Datadog metric query (avg:trace.servlet.request.duration{service:web}) |
search_logs |
Faceted log search with time range |
list_monitors |
List monitors, filter by state (alert/warn/ok) |
get_monitor |
Detail view for one monitor |
list_incidents |
Open and recent Datadog Incident Mgmt entries |
query_traces |
APM trace search with service / operation filter |
Example prompts that work
- "Which services have triggered alert monitors in the last hour?"
- "Plot p99 latency for
checkout-apiover the last 24h" - "Find logs containing
OutOfMemoryErrorfromworker-pod-*in the last 30 min" - "Summarize the open Datadog incident IR-2042 — affected services, suspected cause, current status"
Security & scope
Datadog API + APP keys grant read access to your account data. Use a dedicated app key with restricted scopes (metrics_read, logs_read, monitors_read, traces_read) rather than your personal key. Rotate quarterly.
FAQ
Q: Is this an official Datadog MCP server? A: It's a community-maintained server that wraps the Datadog REST API. Datadog has not announced a first-party MCP at the time of writing. Reads only — no write actions like silencing monitors. Audit the repo before deploying in regulated environments.
Q: Can the agent silence a monitor or close an incident?
A: Not by default — write tools are disabled to prevent accidental actions. Some forks add mute_monitor / update_incident_status behind explicit confirmation. Only enable on isolated dev accounts.
Q: How do I limit which agents can access this? A: Two layers: (1) MCP host config — only add the server to trusted hosts (Claude Desktop, internal Cursor); (2) Datadog APP key scoping — issue a separate restricted-read key per host so you can revoke without affecting the rest.
Source & Thanks
Community-built, MIT-licensed. See github.com/winor30/datadog-mcp-server and similar forks.
Datadog API docs: docs.datadoghq.com/api