# Datadog MCP Server — Query Metrics and Logs from AI Agents

> Community Datadog MCP server lets Claude / Cursor query metrics, logs, traces, monitors in natural language. SRE copilots, on-call triage.

## Install

Merge the JSON below into your `.mcp.json`:

## Quick Use

1. `npm install -g datadog-mcp-server`
2. Add to claude_desktop_config.json with DD_API_KEY + DD_APP_KEY
3. Use a scoped read-only APP key, restart Claude

---

## Intro

The Datadog MCP server exposes Datadog's metrics, logs, traces, monitors, and incidents as MCP tools — your Claude or Cursor agent can ask 'what services have elevated p99 latency right now?' and get a real answer from your live Datadog data. Best for: SRE copilots, on-call triage flows, post-incident retros, anywhere you want an LLM that can read your observability stack. Works with: any MCP host (Claude Desktop, Cursor, Cline, LibreChat, MCP Inspector). Setup time: 10 minutes.

---

### Install (community server, npm-published)

```bash
npm install -g datadog-mcp-server
```

### Claude Desktop config

```json
{
  "mcpServers": {
    "datadog": {
      "command": "npx",
      "args": ["-y", "datadog-mcp-server"],
      "env": {
        "DD_API_KEY": "...",
        "DD_APP_KEY": "...",
        "DD_SITE": "datadoghq.com"
      }
    }
  }
}
```

Drop into `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or the equivalent on your OS.

### Cursor config

`~/.cursor/mcp.json` with the same servers block. Restart Cursor and the tools appear in the agent panel.

### Tools exposed

| Tool | Purpose |
|---|---|
| `query_metrics` | Run a Datadog metric query (`avg:trace.servlet.request.duration{service:web}`) |
| `search_logs` | Faceted log search with time range |
| `list_monitors` | List monitors, filter by state (alert/warn/ok) |
| `get_monitor` | Detail view for one monitor |
| `list_incidents` | Open and recent Datadog Incident Mgmt entries |
| `query_traces` | APM trace search with service / operation filter |

### Example prompts that work

- "Which services have triggered alert monitors in the last hour?"
- "Plot p99 latency for `checkout-api` over the last 24h"
- "Find logs containing `OutOfMemoryError` from `worker-pod-*` in the last 30 min"
- "Summarize the open Datadog incident IR-2042 — affected services, suspected cause, current status"

### Security & scope

Datadog API + APP keys grant read access to your account data. Use a **dedicated app key with restricted scopes** (`metrics_read`, `logs_read`, `monitors_read`, `traces_read`) rather than your personal key. Rotate quarterly.

---

### FAQ

**Q: Is this an official Datadog MCP server?**
A: It's a community-maintained server that wraps the Datadog REST API. Datadog has not announced a first-party MCP at the time of writing. Reads only — no write actions like silencing monitors. Audit the repo before deploying in regulated environments.

**Q: Can the agent silence a monitor or close an incident?**
A: Not by default — write tools are disabled to prevent accidental actions. Some forks add `mute_monitor` / `update_incident_status` behind explicit confirmation. Only enable on isolated dev accounts.

**Q: How do I limit which agents can access this?**
A: Two layers: (1) MCP host config — only add the server to trusted hosts (Claude Desktop, internal Cursor); (2) Datadog APP key scoping — issue a separate restricted-read key per host so you can revoke without affecting the rest.

---

## Source & Thanks

> Community-built, MIT-licensed. See [github.com/winor30/datadog-mcp-server](https://github.com) and similar forks.
>
> Datadog API docs: [docs.datadoghq.com/api](https://docs.datadoghq.com/api/latest/)

---

<!-- ZH -->

## 快速使用

1. `npm install -g datadog-mcp-server`
2. 加到 claude_desktop_config.json，带 DD_API_KEY + DD_APP_KEY
3. 用范围限定的只读 APP key，重启 Claude

---

## 简介

Datadog MCP server 把 Datadog 的指标、日志、trace、监控、事件暴露成 MCP 工具 —— 你的 Claude 或 Cursor agent 可以问「现在哪些服务 p99 延迟升高？」从 Datadog 实时数据拿真答案。适合 SRE copilot、on-call 分流流程、事件复盘、任何想让 LLM 读你可观测栈的场景。兼容任何 MCP 宿主（Claude Desktop / Cursor / Cline / LibreChat / MCP Inspector）。装机时间 10 分钟。

---

### 安装（社区 server，npm 发布）

```bash
npm install -g datadog-mcp-server
```

### Claude Desktop 配置

```json
{
  "mcpServers": {
    "datadog": {
      "command": "npx",
      "args": ["-y", "datadog-mcp-server"],
      "env": {
        "DD_API_KEY": "...",
        "DD_APP_KEY": "...",
        "DD_SITE": "datadoghq.com"
      }
    }
  }
}
```

放进 `~/Library/Application Support/Claude/claude_desktop_config.json`（macOS）或对应 OS 路径。

### Cursor 配置

`~/.cursor/mcp.json` 用同样的 servers 块。重启 Cursor，工具出现在 agent 面板。

### 暴露的工具

| 工具 | 用途 |
|---|---|
| `query_metrics` | 跑 Datadog 指标查询（`avg:trace.servlet.request.duration{service:web}`）|
| `search_logs` | 带时间范围的分面日志搜索 |
| `list_monitors` | 列监控，按状态筛（alert / warn / ok）|
| `get_monitor` | 单个监控详情 |
| `list_incidents` | 打开和最近的 Datadog 事件管理条目 |
| `query_traces` | APM trace 搜索，按服务 / 操作筛 |

### 实战 prompt 例子

- "过去 1 小时哪些服务触发了 alert 监控？"
- "画 `checkout-api` 过去 24h 的 p99 延迟"
- "找 `worker-pod-*` 过去 30 分钟内含 `OutOfMemoryError` 的日志"
- "总结打开的 Datadog 事件 IR-2042 —— 影响服务、可疑原因、当前状态"

### 安全与权限

Datadog API + APP key 给账号数据读权限。用**只读权限的专用 app key**（`metrics_read` / `logs_read` / `monitors_read` / `traces_read`），别用个人 key。每季度轮换。

---

### FAQ

**Q: 这是 Datadog 官方 MCP server 吗？**
A: 是社区维护的 server，封装 Datadog REST API。截至本文 Datadog 没宣布官方 MCP。只读 —— 没有静音监控这种写动作。在合规环境部署前先审计仓库。

**Q: agent 能静音监控或关事件吗？**
A: 默认不能 —— 写动作禁用以防误操作。有些 fork 在明确确认后加 `mute_monitor` / `update_incident_status`。仅在隔离的 dev 账户开。

**Q: 怎么限制哪些 agent 能访问这个？**
A: 两层：(1) MCP 宿主配置 —— 只加到可信宿主（Claude Desktop / 内部 Cursor）；(2) Datadog APP key 范围 —— 每宿主发一个独立的只读受限 key，能单独 revoke 不影响其他。

---

## 来源与感谢

> Community-built, MIT-licensed. See [github.com/winor30/datadog-mcp-server](https://github.com) and similar forks.
>
> Datadog API docs: [docs.datadoghq.com/api](https://docs.datadoghq.com/api/latest/)


---
Source: https://tokrepo.com/en/workflows/datadog-mcp-server-query-metrics-and-logs-from-ai-agents
Author: Datadog