TANTIOPE/datadog-mcp-server

> **DISCLAIMER**: This is a community-maintained project and is not officially affiliated with, endorsed by, or supported by Datadog, Inc. This MCP server utilizes the Datadog API but is developed independently.
MCP server providing AI assistants with full Datadog observability access. Features grep-like log search, APM trace filtering with duration/status/error queries, smart sampling modes for token efficiency, and cross-correlation between logs, traces, and metrics. Supports both stdio (local) and http (remote/Kubernetes) transports.
Quick Start
Minimal Claude Desktop / VS Code / Cursor config — just the two required keys:
With optional tuning (EU site, custom default limits, longer log windows):
To run as an HTTP server (e.g. inside a container or Kubernetes pod), add transport variables to the same env block:
Configuration
Required environment variables
Optional environment variables
Optional flags
Transports
| Transport | When to use | Endpoints |
|-----------|-------------|-----------|
| stdio (default) | Local MCP clients — Claude Desktop, Cursor, VS Code | n/a (process stdin/stdout) |
| http | Remote / container / Kubernetes | POST /mcp · GET /mcp (SSE) · DELETE /mcp · GET /health |
Select with --transport=http or MCP_TRANSPORT=http.
Deployment
Docker
Kubernetes
Use environment variables — not container args — for transport configuration:
> **Note:** Kubernetes args: replaces the entire Dockerfile CMD, causing Node.js to receive the flags instead of your application. Environment variables avoid this issue.
Tools
| Tool | Action | Category | Description | Required Scopes |
|------|--------|----------|-------------|-----------------|
| monitors | list | Alerting | List monitors with optional filters | monitors_read |
| monitors | get | Alerting | Get monitor by ID | monitors_read |
| monitors | search | Alerting | Search monitors by query | monitors_read |
| monitors | create | Alerting | Create a new monitor; config is validated against a typed schema covering documented options (notifyNoData, renotifyInterval, thresholds, …) — unknown keys surface in warnings. Pass dry_run: true to validate without creating (uses /api/v1/monitor/validate, allowed in read-only mode). | monitors_write |
| monitors | update | Alerting | Update an existing monitor; same validated schema as create; partial configs accepted; validation errors short-circuit before any HTTP call as EINVALID_MONITOR_CONFIG: | monitors_write |
| monitors | preview | Alerting | Render a monitor template (inline message or by monitor_id/id) with optional context of variables and conditionals. Returns {rendered, variablesUsed, variablesMissing, conditionalsResolved, tagConditionalsResolved}. Supports Datadog Mustache subset: variable substitution + six documented conditionals (is_alert, is_warning, is_no_data, is_recovery, is_alert_to_warning, is_warning_to_alert) + tag conditionals {{#is_match "tag" "val"}}/{{#is_exact_match "tag" "val"}} (and ^ negations); {{#each}}/partials throw EUNSUPPORTED_TEMPLATE_SYNTAX. Read-only. | monitors_read |
| monitors | test_notification | Alerting | **Known limitation**: returns ENOT_SUPPORTED — Datadog has no public REST endpoint for triggering a test notification. Documentation pointer in response. | n/a |
| monitors | delete | Alerting | Delete a monitor | monitors_write |
| monitors | mute | Alerting | Mute a monitor | monitors_write |
| monitors | unmute | Alerting | Unmute a monitor | monitors_write |
| monitors | top | Alerting | Top N monitors by alert frequency with real monitor names and context breakdown. **WARNING:** total_count includes renotifies/re-evaluations (Datadog emits a renotify event every renotify_interval minutes while Alert). For real fires use action=history. | monitors_read |
| monitors | history | Alerting | Count and list real state transitions for one monitor over a time window. Filters by transitionType (default ["alert","alert recovery"] — fires+recoveries, excludes renotifies) and optional group. Returns {transitions: [...], count, meta} where count is the number of real transitions (e.g. for one always-Alert burn-rate monitor over 7d: 98 raw events vs **38 real transitions**). | monitors_read, events_read |