Secure Datadog access for AI agents
Metrics, logs, traces, dashboards, incidents, monitors, and notebooks via Datadog's official MCP server.
Through Datadog, agents can query metrics, search logs and APM traces, read dashboards, incidents, monitors, and notebooks, and walk your service topology — every call runs through your policies and is logged for audit.
Server URL: https://mcp.datadoghq.com/v1/mcp
Setup
- Navigate to Resources and click Add Resource
- Select Datadog from the catalog
- Choose Per-org dynamic registration, the only mode Datadog offers — picking the card installs the resource with all tools pre-configured
Each user connects their own Datadog account via OAuth when they first use a Datadog tool. Navigate to Connections to manage linked accounts.
Dynamic client registration
This is the mode card labeled Per-org dynamic registration on the Datadog configure page. No app needs creating on Datadog's side and no client ID or secret to enter: the gateway registers an OAuth client with Datadog per organization at install time.
Available tools
All tools are read-only.
| Tool | Description |
|---|---|
aggregate_events | Aggregate events (counts, sums, percentiles) grouped by field/time |
aggregate_rum_events | Aggregate RUM events (sessions, errors, load times) |
aggregate_spans | Aggregate APM spans (request counts, durations, error rates) |
analyze_datadog_logs | Run SQL analysis against a virtual logs table |
get_change_stories | Get change events (deploys, scaling, config) for an APM service |
get_datadog_dashboard | Get a dashboard's title, description, tags, and widgets |
get_datadog_incident | Get incident details, timeline, and follow-ups |
get_datadog_metric | Query metrics data (timeseries or scalar) |
get_datadog_metric_context | Get a metric's metadata, tags, and related assets |
get_datadog_notebook | Get a notebook by ID |
get_datadog_trace | Get an APM trace's spans by trace ID |
list_datadog_skills | List available Datadog skill guides |
load_datadog_skill | Load a Datadog skill guide |
search_datadog_dashboards | Find dashboards by title, widget, team, or author |
search_datadog_events | Search raw events |
search_datadog_hosts | Query the hosts inventory with SQL |
search_datadog_incidents | Search incidents by state, severity, team, or semantic query |
search_datadog_logs | Search raw logs or log patterns |
search_datadog_metrics | List available metrics |
search_datadog_monitors | Find monitors by title, status, team, or tag |
search_datadog_notebooks | Find notebooks by author, type, or content |
search_datadog_rum_events | Search raw RUM events |
search_datadog_service_dependencies | Get upstream/downstream service dependencies |
search_datadog_services | Find services by name or team |
search_datadog_spans | Search raw APM spans |
Policy examples
Rules are evaluated top to bottom and the first match wins. Allow rules on their own restrict nothing — your org starts with a seeded Allow all rule, so any tool your allows don't cover still falls through to it. Narrowing access needs a catch-all deny scoped to this resource, ordered below the allows. New rules are inserted at the top of the list, so create them in reverse order or drag them into place. See Policies.
- Observability triage only. Allow
search_datadog_logs,search_datadog_incidents,get_datadog_incident, andsearch_datadog_monitors, then deny*below them so no other Datadog tool falls through to Allow all. - Keep Datadog out of an agent's reach entirely. Deny
*scoped to this resource and to that agent, above the seeded Allow all rule.
Since every Datadog tool is read-only, these examples limit what an agent can see rather than what it can change.
Next steps
- Create a policy — start from the triage pattern in Policy examples above.
- Policies — how rule order, scoping, and the seeded Allow all rule interact.
- Connections — manage the Datadog accounts your users have linked.