Datadog MCP

Datadog observability via the official MCP Server — query logs, traces, metrics, monitors, incidents, dashboards, hosts, synthetics, and workflows through Da...

Security Scan

The skill's requirements, instructions, and included files are consistent with a Datadog MCP integration and request only the Datadog keys needed for that purpose.

Purpose & Capability

Name/description (Datadog MCP) match the requested environment variables (DD_API_KEY, DD_APP_KEY), the MCP endpoint URLs (mcp.datadoghq.com / api.${DD_SITE}) and the documented capabilities (logs, traces, metrics, monitors, incidents, dashboards, synthetics, workflows). Nothing requested is unrelated to the stated purpose.

Instruction Scope

SKILL.md only instructs how to connect to Datadog's MCP (remote HTTP or local stdio via community package), how to set env vars, and provides runbooks for expected queries. The included validate.sh checks credential validity and MCP reachability. There are no instructions to read unrelated system files or exfiltrate data to third-party endpoints.

Install Mechanism

No install spec is provided (instruction-only). The only optional local installation suggested is the community npm package (npx datadog-mcp-server) and use of mcporter — both are reasonable and documented. No downloads from untrusted URLs or archive extraction are present.

Credentials

The skill requires only DD_API_KEY and DD_APP_KEY (and an optional DD_SITE). These are the credentials needed to call Datadog APIs/MCP. The number and type of environment variables are proportional to the functionality; names align with Datadog conventions and are justified by the SKILL.md.

Persistence & Privilege

The skill is not always-enabled (always:false) and does not request system-wide persistence or modify other skills. It runs via agent invocation and contains a small validation script; no privileged or persistent system changes are requested.

Assessment

This skill appears to do what it claims: connect your agent to Datadog's MCP server. Before installing, consider: (1) Treat DD_API_KEY and DD_APP_KEY as secrets — store them in a secrets manager and use scoped application keys with minimal read permissions. (2) Prefer the remote MCP endpoint (https://mcp.datadoghq.com) as documented; if you run the local stdio server, you will be making API calls from your machine. (3) The included scripts call Datadog endpoints (curl) to validate keys — that's expected but will transmit the keys over HTTPS to Datadog. (4) Confirm your org's security policies allow an agent to query observability data and that the app key used does not have excessive write permissions. If you want stronger assurance, ask the maintainer for an audit of the community npm package referenced for the local server, or verify the mcporter/claude integrations you plan to use. Installation looks coherent and proportionate; no glaring red flags were found.

Datadog MCP Server

Query Datadog observability data through the official MCP Server.

Requirements

Variable	Required	Description
DD_API_KEY	✅	Datadog API key (Organization Settings → API Keys)
DD_APP_KEY	✅	Datadog Application key (Organization Settings → Application Keys)
DD_SITE	Optional	Datadog site (default: datadoghq.com)

Setup

Option A: Remote MCP Server (Recommended)

Datadog hosts the MCP server — no local install needed.

mcporter add datadog \
  --transport http \
  --url "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp" \
  --header "DD-API-KEY:$DD_API_KEY" \
  --header "DD-APPLICATION-KEY:$DD_APP_KEY"

To select specific toolsets, append ?toolsets=logs,metrics,monitors to the URL.

Option B: Local stdio MCP Server

Use the community datadog-mcp-server npm package:

npx datadog-mcp-server \
  --apiKey "$DD_API_KEY" \
  --appKey "$DD_APP_KEY" \
  --site "$DD_SITE"

Option C: Claude Code / Codex CLI

claude mcp add --transport http datadog-mcp \
  "https://mcp.datadoghq.com/api/unstable/mcp-server/mcp?toolsets=core"

Available Toolsets

Toolset	Tools	Description
core	General platform tools	Default — always included
logs	get_logs	Search and retrieve log entries
traces	list_spans, get_trace	Investigate distributed traces
metrics	list_metrics, get_metrics	Query timeseries metrics data
monitors	get_monitors	Retrieve monitor configs and status
hosts	list_hosts	Infrastructure host information
incidents	list_incidents, get_incident	Incident management
dashboards	list_dashboards	Discover dashboards
synthetics	Synthetic test tools	Synthetic monitoring tests
workflows	Workflow automation tools	List, inspect, execute workflows

Select toolsets via URL query parameter: ?toolsets=logs,metrics,monitors,incidents

Usage Examples

• Error investigation: "Show me error logs from service:api-gateway in the last hour" — uses get_logs with query filters
• Monitor status: "Are there any triggered monitors for the payments service?" — uses get_monitors with service tag filter
• Metrics query: "Show me p99 latency for web-app over the last 4 hours" — uses list_metrics then get_metrics for timeseries
• Incident response: "List active incidents" — uses list_incidents
• Trace investigation: "Find slow spans for service:checkout taking over 5s" — uses list_spans with duration filter

Operational Runbooks

• references/incident-response.md — step-by-step incident triage via MCP
• references/troubleshooting.md — log/trace/metric correlation patterns
• references/api-reference.md — complete tool parameters and response schemas

Multi-Site Support

Region	Site
US1 (default)	datadoghq.com
US3	us3.datadoghq.com
US5	us5.datadoghq.com
EU	datadoghq.eu
AP1	ap1.datadoghq.com
US1-FED	ddog-gov.com

For the remote MCP server, the site is determined by your API key's org. For the local server, pass --site.

Security Notes

• API keys grant read access to your Datadog org — treat them as secrets
• Application keys inherit the permissions of the user who created them
• Use scoped application keys with minimal permissions for production
• The remote MCP server runs on Datadog infrastructure — data does not leave Datadog
• The local stdio server runs on your machine — API calls go directly to Datadog's API