Datadog MCP server

Read from the package source without running it. The installed server may list more.

• add_case_comment

  Add a comment to a case. Comments are attached to the case record and visible to all users with access to that case.

• archive_case

  Archive a case to remove it from active workflow while preserving its data for historical reference. Archived cases can be retrieved but are excluded from standard case listings.

• assign_case

  Assign a case to a specific user. The case will be associated with the assignee and marked as assigned in the system.

• bulk_write_datastore_itemswrite action

  Creates or replaces multiple items in a datastore in a single batch operation. Supports up to 100 items per request with configurable conflict handling for existing keys.

• cancel_deploymentwrite action

  Cancel an active fleet deployment and stop all pending operations on hosts. Already-applied configuration changes and package upgrades are not rolled back.

• configure_aws_scan_options

  Configure agentless scanning options for an AWS account, including Lambda functions, sensitive data detection, and vulnerability scanning for containers and hosts.

• configure_azure_scan_options

  Configure agentless scanning options for an Azure subscription, including vulnerability scanning for containers and hosts.

• create_action_connectionwrite action

  Create a new Action Connection to integrate external services with Datadog actions. Requires a registered application key for authentication.

• create_appwrite action

  Create a new app in the app builder and receive the app ID. Requires a registered application key with appropriate permissions.

• create_casewrite action

  Create a new case with specified type, title, and optional metadata. Cases are used to track and manage investigations or issues within a project.

• create_case_typewrite action

  Create a new case type to categorize and organize cases within your system. Case types help structure case management workflows and reporting.

• create_case_type_custom_attributewrite action

  Create a custom attribute configuration for a specific case type. Custom attributes extend case records with user-defined fields such as text, numbers, URLs, or dropdown selections.

• create_datastorewrite action

  Creates a new datastore with a specified primary key column and optional organization access level. The datastore can be configured to automatically generate primary keys using UUIDs or require manual key assignment.

• create_fleet_upgrade_schedulewrite action

  Create an automated schedule for deploying Datadog Agent upgrades to a fleet of hosts. The schedule defines target hosts via query filter, maintenance windows, and version strategy to automatically trigger deployments on a recurring basis.

• create_projectwrite action

  Create a new project to organize and manage cases. Projects serve as containers for case types and team collaboration.

• create_retention_filterwrite action

  Create a retention filter to index spans in your organization. Retention filters allow you to sample spans based on search queries, controlling which spans are retained for analysis.

• create_spans_metricwrite action

  Create a span-based metric to aggregate data from your ingested spans. The metric can count span occurrences or calculate distributions across specified span attributes.

• delete_action_connectionwrite action

  Delete an existing Action Connection by its ID. Requires a registered application key with appropriate permissions.

• delete_appwrite action

  Permanently delete an app by its ID. Requires a registered application key or appropriate Actions API permissions.

• delete_application_keywrite action

  Permanently delete an application key by its ID. This action cannot be undone and will invalidate any authentication using this key.

• delete_appswrite action

  Delete multiple apps in a single request by providing a list of app IDs. Requires a registered application key or appropriate Actions API permissions.

• delete_aws_scan_optionswrite action

  Remove agentless scanning configuration for a specified AWS account. This disables agentless scanning capabilities for that account.

• delete_azure_scan_optionswrite action

  Remove agentless scanning configuration for a specified Azure subscription. This disables automated vulnerability scanning for the subscription.

• delete_case_typewrite action

  Permanently delete a case type by its UUID. This action cannot be undone and will remove the case type from the system.

• delete_custom_attributewrite action

  Remove a custom attribute configuration from a specific case type. This permanently deletes the attribute definition and its associated settings.

• delete_datastorewrite action

  Permanently deletes a datastore and all associated data by its unique identifier. This action cannot be undone.

• delete_datastore_itemwrite action

  Removes an item from a datastore by its primary key. The item is permanently deleted and cannot be recovered.

• delete_datastore_itemswrite action

  Deletes multiple items from a datastore by their primary keys in a single batch operation. Supports up to 100 items per request.

• delete_gcp_scan_optionswrite action

  Remove agentless scanning configuration for a GCP project. This disables automated vulnerability scanning for the specified project.

• delete_notification_rulewrite action

  Delete a notification rule from a project by its ID. This operation permanently removes the specified notification rule and its associated configurations.

• delete_projectwrite action

  Permanently remove a project by its unique identifier. This action cannot be undone.

• delete_retention_filter_apmwrite action

  Delete a specific retention filter from your organization. Note that default filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor cannot be deleted.

• delete_schedulewrite action

  Permanently delete a fleet schedule. The schedule will no longer create deployments, though any previously created deployments remain unaffected. This action cannot be undone.

• delete_span_metricwrite action

  Delete a span-based metric from your organization. This operation permanently removes the specified metric and its associated configuration.

• deploy_fleet_configurationwrite action

  Deploy configuration changes to a fleet of hosts matching a filter query. Supports merge-patch operations to update configuration files and delete operations to remove them, with multiple operations executed sequentially on each target host.

• enable_aws_scan_options

  Enable agentless scanning options for an AWS account by specifying which scan types to activate, including Lambda functions, sensitive data, container vulnerabilities, and host vulnerabilities.

• enable_azure_agentless_scanning

  Enable agentless scanning options for an Azure subscription, allowing vulnerability scans on containers and/or hosts without requiring agent installation.

• enable_gcp_agentless_scanning

  Enable agentless scanning options for a GCP project, allowing vulnerability detection in containers and/or hosts without requiring agent installation.

• get_action_connection

  Retrieve details of an existing Action Connection by its ID. Requires a registered application key for authentication.

• get_agent_info

  Retrieve comprehensive information about a specific Datadog Agent, including agent metadata, configured integrations organized by status, detected integrations, and configuration files.

• get_app

  Retrieve the complete definition and configuration of an app by its ID. Requires a registered application key or appropriate Actions API permissions.

• get_app_key_registration

  Retrieve the details of an existing app key registration by its ID. Use this to view configuration and status information for a registered application key.

• get_application_key

  Retrieve a specific application key for your organization by its ID. Use this to access details about an existing application key.

• get_aws_ondemand_task

  Retrieve details and status of a specific AWS on-demand scanning task. Use this to check the progress and results of a previously initiated on-demand scan.

• get_aws_scan_options

  Retrieve the agentless scanning configuration options for an activated AWS account. This returns the scan settings and capabilities available for the specified account.

• get_azure_scan_options_subscription

  Retrieves the agentless scanning configuration options available for an activated Azure subscription. Use this to discover what scan settings and capabilities are enabled for a specific subscription.

• get_case

  Retrieve detailed information about a specific case using its UUID or key identifier. Returns all case metadata and current status.

• get_datastore

  Retrieves a specific datastore by its unique identifier. Use this operation to fetch detailed information about a datastore for inspection or configuration purposes.

• get_deployment

  Retrieve detailed information about a specific fleet deployment, including metadata, target hosts, current status, and per-host execution details with package versions.

• get_gcp_scan_options

  Retrieve the agentless scanning configuration options for an activated GCP project. This returns the scan settings and capabilities available for the specified project.

• get_project

  Retrieve detailed information about a specific project using its unique identifier. Returns comprehensive project metadata and configuration.

• get_retention_filter_apm

  Retrieve a specific APM retention filter by its ID. Use this to view the configuration and settings of an existing retention filter.

• get_schedule

  Retrieve detailed information about a specific deployment schedule by its unique identifier. Returns schedule metadata, filter criteria, recurrence rules, version strategy, and current status.

• get_span_metric

  Retrieve a specific span-based metric configuration from your organization. Use this to view the details and settings of a metric used to track APM span data.

• link_incident_to_case

  Associate an incident with a case to establish a relationship between the two resources. This enables tracking of related incidents within a case context.

• list_agent_versions

  Retrieve all available Datadog Agent versions that can be deployed to your fleet. Use these versions when creating deployments or configuring automated Agent upgrade schedules.

• list_agents

  Retrieve a paginated list of all Datadog Agents with optional filtering by tags. Results can be sorted and paginated using page number and size parameters.

• list_apm_retention_filters

  Retrieve all APM retention filters configured in your organization. Retention filters control which APM data is retained based on specified criteria.

• list_app_key_registrations

  Retrieve a paginated list of app key registrations. Use pagination parameters to control the number of results and navigate through pages.

• list_application_keys

  Retrieve all application keys for your organization with optional filtering by creation date and pagination support.

• list_apps

  Retrieve a paginated list of all apps with optional filtering by creator, name, deployment status, tags, favorites, and self-service availability. Only basic app information (ID, name, description) is returned.

• list_audit_logs

  Retrieve a paginated list of audit log events matching your search criteria. Use this endpoint to monitor your organization's latest audit activity with optional filtering by query, time range, and result limit.

• list_aws_ondemand_tasks

  Retrieves the most recent 1000 AWS on-demand scanning tasks. Use this to view the history and status of on-demand vulnerability scans initiated on your AWS infrastructure.

• list_aws_scan_options

  Retrieves the scan options and configurations available for AWS accounts in agentless scanning. Use this to understand what scanning capabilities and settings are available for your AWS environment.

• list_azure_scan_options

  Retrieves the scan options configured for Azure accounts in agentless scanning. Use this to discover available scanning configurations and settings for your Azure environment.

• list_case_types

  Retrieve all available case types in the system. Use this to populate case type selections or understand the case taxonomy.

• list_cases

  Retrieve a paginated list of cases with optional sorting. Use pagination parameters to navigate through results and sorting options to organize cases by creation date, priority, or status.

• list_custom_attributes

  Retrieve all custom attributes available for case types. This returns the complete set of custom attribute definitions that can be applied to cases.

• list_custom_attributes_by_case_type

  Retrieve all custom attribute configurations for a specific case type. Returns the complete set of custom attributes defined for the given case type.

• list_datastore_items

  Retrieve items from a datastore with optional filtering by key or query parameters, supporting server-side pagination for large datasets. Specify either an item key or filter query, but not both.

• list_datastores

  Retrieves all datastores available in the organization. Use this to discover and manage data storage resources.

• list_deployments

  Retrieve a paginated list of all fleet deployments. Use pagination parameters to navigate through results efficiently.

• list_gcp_scan_options

  Retrieves the scan options configured for all GCP projects in your agentless scanning setup. Use this to view available scanning configurations across your GCP environment.

• list_projects

  Retrieve all available projects. Returns a complete list of projects accessible to the authenticated user.

• list_schedules

  Retrieve all fleet deployment schedules. Schedules automate package upgrades by defining maintenance windows and recurrence rules, with each schedule automatically generating deployments based on its configuration.

• list_services

  Retrieve a list of APM services, optionally filtered by environment. Use `*` as the environment filter to return services across all environments.

• list_span_metrics

  Retrieve all configured span-based metrics with their complete definitions. Use this to discover available metrics for APM monitoring and analysis.

• publish_appwrite action

  Publish an app to make it accessible to other users. After publishing, configure a Restriction Policy to control which users can access the app.

• remove_case_commentwrite action

  Remove a comment from a case's timeline. This permanently deletes the specified comment associated with the given case.

• remove_case_custom_attributewrite action

  Remove a custom attribute from a case by its key. This operation permanently deletes the specified custom attribute associated with the case.

• reorder_retention_filterswrite action

  Update the execution order of APM retention filters. The order determines the sequence in which filters are applied during data retention processing.

• scan_aws_resource

  Trigger an on-demand agentless scan of an AWS resource with high priority. Agentless scanning must be activated for the AWS account containing the resource.

• search_audit_logs

  Search and filter audit log events using complex query criteria with paginated results. Use this endpoint to retrieve audit events within a specified time range with customizable result limits.

• start_agent_upgrade

  Initiate an immediate upgrade of the Datadog Agent to a specified version on hosts matching your filter criteria. The deployment is created and automatically begins rolling out to target hosts.

• trigger_schedule

  Manually trigger a schedule to immediately create and start a deployment without waiting for the next scheduled maintenance window. Useful for testing schedules, emergency updates, or ad-hoc deployments using the schedule's configuration.

• unpublish_appwrite action

  Remove the live version of an app, making it unavailable to end users while preserving the ability to update and republish it later. Unpublishing creates a new deployment instance with no associated app version.

• update_action_connectionwrite action

  Update an existing Action Connection with new integration settings or configuration. Requires a registered application key for authentication.

• update_appwrite action

  Update an existing app by modifying its configuration, components, queries, or metadata. This operation creates a new version of the app and requires a registered application key or appropriate API permissions.

• update_application_keywrite action

  Update an application key's configuration, including its assigned scopes and permissions. Changes take effect immediately.

• update_case_attributeswrite action

  Update one or more attributes for a specific case. Attributes are custom fields that store additional case metadata and can be modified independently.

• update_case_custom_attributewrite action

  Update a custom attribute value for a specific case. Custom attributes can store various data types including text, numbers, URLs, and select options.

• update_case_descriptionwrite action

  Update the description text for a specific case. This allows you to modify case details and notes after creation.

• update_case_prioritywrite action

  Update the priority level of a case. Priority levels range from NOT_DEFINED to P1 (highest) through P5 (lowest).

• update_datastorewrite action

  Updates an existing datastore's attributes such as description. Requires the datastore ID and resource type to identify and modify the target datastore.

• update_datastore_itemwrite action

  Partially updates an item in a datastore using its primary key. Supports setting key-value pairs on the specified item.

• update_gcp_scan_optionswrite action

  Update agentless scanning configuration for a GCP project, including vulnerability scanning preferences for containers and hosts.

• update_projectwrite action

  Update project configuration including board columns, case types, automation rules, integrations, and notification settings.

• update_retention_filter_apmwrite action

  Update an APM retention filter configuration for your organization. Note that default filters (spans-errors-sampling-processor and spans-appsec-sampling-processor types) cannot be renamed or removed.

• update_schedulewrite action

  Partially update a fleet deployment schedule by modifying specific attributes such as recurrence days, maintenance window timing, or deployment strategy. Only provided fields are updated; omitted fields remain unchanged.

• update_spans_metricwrite action

  Update a span-based metric configuration for your organization. Returns the updated span-based metric object.

• Code scan5 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitylocal package, no credentials required12/15
• Maintenancelast push 138 days ago8/15
• Maintainer identityregistry namespace matches repository owner7/10

Safety score

80/100

higher than 60% of 48,255 servers

Tools

100

the typical server has 7

Tools that change things

49%

typical: 0%. Fewer write tools means less an agent can break

GitHub stars

31

more than 92% of 28,688 servers

Datadog: common questions

Is Datadog MCP server safe?

Mostly: it is graded B (80/100). Read the Datadog safety report

How do I install Datadog?

It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.

Does Datadog need an API key?

Not as far as the registry entry and our scan can tell: no credentials are declared or required.

Is Datadog maintained?

The last commit was 176 days ago (2026-05-12). The latest release is v1.0.3.

What can I use instead of Datadog?

Servers from other publishers that do the same job: Netdata MCP server.

How does Datadog compare with other MCP servers?

safety score 80/100 (higher than 60% of 48,255 servers); tools 100 (the typical server has 7); tools that change things 49% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.