MCP 服务器

Datadog MCP Server

Enables AI assistants to query Datadog metrics, logs, monitors, security signals, and billing data through natural language.

README

Datadog MCP Server

A Model Context Protocol (MCP) server that provides Claude and other AI assistants with direct access to the Datadog API. Query metrics, search logs, manage monitors, investigate security signals, and track billing — all through natural language.

Features

Category	Tools
Metrics	Query timeseries data, list active metrics
Logs	Search and filter logs with full query syntax
Security Monitoring	Search security signals (SIEM, CWS, CSM)
Workload Protection	List/manage CSM Threats policies and agent rules
Monitors	List, create, get, mute, and unmute monitors
Dashboards	List and retrieve dashboard definitions
Billing & Usage	Monthly costs, projected costs, usage breakdowns, cost attribution, security-specific usage

Prerequisites

Python 3.10+
A Datadog account with API and Application keys
Claude Code or any MCP-compatible client

Setup

1. Clone and install

git clone https://github.com/anthropics/datadog-mcp-server.git
cd datadog-mcp-server
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

2. Configure credentials

Copy the example env file and add your Datadog keys:

cp .env.example .env

Edit .env:

DD_API_KEY=your_api_key_here
DD_APP_KEY=your_app_key_here
# DD_SITE=datadoghq.eu  # Optional: for non-US regions

You can create API and Application keys in Datadog Organization Settings.

3. Add to Claude Code

Add the server to your Claude Code settings (~/.claude/settings.json):

{
  "mcpServers": {
    "datadog": {
      "command": "/path/to/datadog-mcp-server/.venv/bin/python",
      "args": ["/path/to/datadog-mcp-server/server.py"],
      "env": {
        "DD_API_KEY": "your_api_key",
        "DD_APP_KEY": "your_app_key"
      }
    }
  }
}

Or for non-US Datadog regions, add "DD_SITE": "datadoghq.eu" to the env block.

Available Tools

Metrics

query_metrics — Query timeseries data (e.g. avg:system.cpu.user{*})
list_active_metrics — List all active metric names

Logs

search_logs — Search logs with Datadog query syntax, time ranges, and limits

Security Monitoring

search_security_signals — Search SIEM/CWS/CSM signals with filters and time ranges

Workload Protection (CSM Threats)

list_workload_protection_policies — List all CSM Threats policies
list_workload_protection_rules — List CWS agent rules (optionally filtered by policy)
get_workload_protection_rule — Get details for a specific agent rule

Monitors

list_monitors — List monitors, optionally filtered by tags
create_monitor — Create a new monitor with thresholds, notifications, and options
get_monitor — Get details for a specific monitor
mute_monitor / unmute_monitor — Mute or unmute monitors by scope

Dashboards

list_dashboards — List all dashboards
get_dashboard — Get a specific dashboard's full definition

Billing & Usage

get_monthly_cost — Historical monthly costs broken down by product
get_estimated_cost — Current month-to-date estimated cost
get_projected_cost — Projected full-month cost
get_billing_summary — Billable usage summary with counts and costs per product
get_monthly_cost_attribution — Costs attributed by tags (team, env, service)
get_hourly_usage — Hourly usage for specific product families
get_usage_security — Combined CSPM + CWS + SDS + ASM usage
get_active_billing_dimensions — List all active billing product categories

Example Usage

Once configured, you can ask Claude things like:

"What's our Datadog bill for February?"
"Show me error logs from the payments service in the last hour"
"Are there any critical security signals from today?"
"Create a monitor that alerts when CPU usage exceeds 90%"
"How much are we spending on Datadog security products?"
"What's the projected cost for this month?"

Required Datadog Permissions

Your Application key needs the following permissions depending on which tools you use:

Tools	Required Scopes
Metrics	`timeseries_query`
Logs	`logs_read_data`
Security Signals	`security_monitoring_signals_read`
Workload Protection	`security_monitoring_rules_read`
Monitors	`monitors_read`, `monitors_write` (for create/mute)
Dashboards	`dashboards_read`
Billing & Usage	`usage_read`