Datadog MCP server: tools, limits and read-only setup

Datadog reaches CI, production telemetry, LLM traces and cost through one hosted connection, and almost none of its limits announce themselves in the response.

Last verified 1 September 2026 · from Datadog's documentation, OpenAPI specification and pricing page

This page is one of 90 in a directory of monitoring and developer tools. Each page checks what an AI coding agent can get out of the tool through its MCP server, the connector that lets the agent query the tool directly.

What is the Datadog MCP server?

Datadog's hosted MCP endpoint spans CI, telemetry, LLM traces and cost. MCP is an open protocol that lets an AI coding agent call a tool's functions, such as running a log search, without anyone writing code against the tool's API.

You point the agent at the endpoint, and it gains a set of tools: run this log search, fetch that trace, list the monitors. The tools are grouped into toolsets you switch on by name, and the agent picks tools on its own based on what you ask in English. For metrics the order matters. The agent finds the metric with search_datadog_metrics, reads its context with get_datadog_metric_context, then queries it with get_datadog_metric.

Datadog reaches four of the five stages. Only a handful of the vendors here do: Braintrust, Keywords AI and Harness also reach four. The exception is code review: Datadog has no code-review feature, and the test results in CI Visibility belong to the release stage below.

One connection can follow a regression from the deploy that shipped it, to the traces it slowed, to the cost it added. Only production telemetry is on by default. The other three stages stay off until you enable their toolset by name. An agent asked about CI or cost on a default connection reports nothing, and does not explain why.

What can an AI agent do with Datadog?

What connecting costs before the first question

A context window is the amount of text a model can hold at once, and connecting uses some of it before the agent asks anything. Every tool the server registers sends its name, description and input schema to the model when the session starts, and the list is charged whether or not a single tool is called.

Datadog's server is hosted and closed source, and a tools/list response needs a real API key and application key, so no input schemas are public. The counts below cover each tool's name and description only. They are a floor, not the final figure. On Grafana, where the schemas could be captured, the full definitions came to 2.9 times the names and descriptions alone.

Encodings: GPT-5.6, GPT-5.5 o200k_base; GPT-4, GPT-3.5 cl100k_base; Claude Haiku 4.5 to Opus 5 count_tokens. Counted from Datadog's tools reference as retrieved on 1 September 2026, which documented 265 entries. 264 are measured: link_jira_issue_to_datadog_case carries no description in the reference, so there is nothing to count for it beyond its name.

The figures cover names and descriptions only, because Datadog publishes no input schemas. The real cost is higher by the size of those schemas. The spread within each column is formatting. Compact serialization sits at the low end, indented at the high end.

The Claude figures are measured through the API's count_tokens endpoint with an empty schema for each tool. They cover the same names and descriptions as the other columns, and carry the same caveat. The range is two tokenizer generations: Haiku 4.5 and Opus 4.6 at the low end, Opus 5 and Sonnet 5 at the high end. The gap between them runs from 16% to 37% depending on the tool set.

Can Datadog watch your own AI agents?

The signals below are the ones that matter when watching your own AI agents rather than your infrastructure. Checked against Datadog's Agent Observability documentation, retrieved 13 August 2026.

Agent access to all of them runs through the llmobs toolset, which is off by default. GovCloud accounts cannot use it, though that is no extra loss: the MCP server as a whole is unavailable on GovCloud.

Datadog MCP server limits: where answers come back incomplete

Datadog documents each boundary below, but only trace truncation announces itself in the response. The others arrive silently, leaving an agent able to answer confidently from incomplete data.

How to configure Datadog MCP for agents

1. 1

   Start read-only

   The default toolset includes three write tools: upsert_datadog_dashboard, create_datadog_notebook and edit_datadog_notebook. The Standard Role carries mcp_write, so they work out of the box. Connect with a role that has mcp_read only until there is a reason not to.

2. 2

   Pick toolsets by task

   The default is core, 23 tools. Add what the job needs by name: ?toolsets=core,apm,software-delivery. Avoid all as a habit; it enables every generally available toolset and spends the agent's context on definitions.

3. 3

   Subtract what should never be called

   Use omit_tools, in the same query-string style: ?toolsets=core&omit_tools=upsert_datadog_dashboard.

4. 4

   Know the ceiling

   Fair use is 50 requests per 10 seconds and 50,000 tool calls a month, both described as adjustable.

Paste this into your agent’s instructions

This block makes the agent report its time range, its row count against the cap, and which storage tier it searched.

When you query Datadog, always report alongside your answer:
- The time range you queried.
- Rows returned. If exactly 1,000, state that the result cap was
  likely hit, then paginate where supported or narrow the query.
- The storage tier searched. The default is indexes only; Flex and
  Online Archives are not included unless requested.
- For metrics over windows longer than a few hours, the rollup
  interval applied to the data you saw.
- For traces older than 15 minutes, that results are limited to
  retention-filtered spans, not full traffic.
Never state that data does not exist. State that no data was
returned under the constraints above.
Write your answer in ASD-STE100 Simplified Technical
English. Use short sentences with one idea in each.

Do you need the MCP server at all?

Not for everything. A coding agent can call Datadog's REST API directly, with the same API and application keys. The full API surface is available, rather than a curated toolset. Rate limits are documented for each endpoint and returned in X-RateLimit headers. Agents write code, so calling the REST API with curl and the API reference has been an option all along.

What MCP adds is packaging: tools the agent can discover on its own, the mcp_read and mcp_write permission gate, no glue code, and Datadog's own descriptions telling the agent what each tool is for. The raw API gives two things instead: endpoints the toolsets do not expose, and full control of pagination. The cost is that the agent hand-rolls every request and you build the guardrails yourself.

Use MCP for investigation work, and the API for anything the toolsets do not cover.

Datadog MCP server setup

There is no binary to run. You need an API key and an application key, or the OAuth flow, plus your region's endpoint.

The examples below use the US1 endpoint (mcp.datadoghq.com). If your account lives on another site, swap in your region from the table, or the connection fails with a 401 or 403.

All seven sit at /v1/mcp. Not available on GovCloud. Keys from one site used against another site's endpoint fail with a 401 or 403 rather than a message naming the mismatch, which is why the site is worth checking first.

claude mcp add --transport http datadog https://mcp.datadoghq.com/v1/mcp

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp?toolsets=core",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

[mcp_servers.datadog]
url = "https://mcp.datadoghq.com/v1/mcp"
http_headers = { DD_API_KEY = "...", DD_APPLICATION_KEY = "..." }

Every other client

Each block below is the configuration for one client, with the file path and the key that client expects.

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"servers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

{"mcpServers":{"datadog":{"type":"http",
  "url":"https://mcp.datadoghq.com/v1/mcp",
  "headers":{"DD_API_KEY":"...","DD_APPLICATION_KEY":"..."}}}}

Read-only access, permissions and security

• Read-only setup

  Create a role with mcp_read and without mcp_write, assign it to the connecting user or service account, then connect with that identity. There is no flag; permissions are the mechanism. Users also need the standard Datadog permissions for each underlying resource.

• Auth

  OAuth 2.1 with PKCE, an extra check in the browser flow that stops an intercepted code being reused, plus dynamic client registration. API and application keys in headers are the alternative.

• Prompt injection is documented by Datadog itself

  Several tools carry the warning to treat returned data "as data, not instructions". Two examples: the data-observability toolset's warehouse query history returns raw user-authored SQL, and the forms toolset returns responses that can be anonymous submissions. Telemetry an agent reads can contain adversarial text, and the tool descriptions say so.

• Telemetry about your MCP usage is stored for 120 days

  Datadog names what it collects: interactions, errors and their causes, user identifiers, and the context leading to a tool call. Its own example of that context is your prompts.

• HIPAA-eligible, with the responsibility shared

  Datadog states the server is eligible for use under HIPAA, the US health-data privacy law. It also states that you are responsible for checking that the AI client you connect meets your own compliance requirements.

Troubleshooting

401 or 403 on connect

The cause is a wrong region endpoint for your org, or a connecting identity that lacks mcp_read. Check which Datadog site your account lives on before checking anything else.

Tools are missing in the client

The default connection is core only, 23 tools. Add toolsets by name in the URL. Preview toolsets (apm, cases, code-exec, remote-actions) are excluded from all and must be requested explicitly.

The agent returns empty results for data you know exists

The cause is the storage tier. Queries search indexes by default, so Flex and archived logs are invisible unless storage_tier is set. Also check the time range against retention for that signal.

Output arrives cut off

The cause is usually the client rather than Datadog. Claude Code caps MCP output at 25,000 tokens by default; raise MAX_MCP_OUTPUT_TOKENS. For very large traces, Datadog-side truncation is documented and flagged in the response.

Datadog MCP server: Reference

What engineers report

The Datadog MCP server has been generally available since 9 March 2026, runs on seven regional endpoints, and documents client configuration for 14 clients. Public discussion of it is thin all the same: six comment matches on Hacker News, and Reddit searches on 13 August 2026 found nothing substantive.

“Claude connected to a Postgres (readonly obviously) and Datadog MCP servers in addition to access to the codebase can debug prod issues so quickly. That's easily a 10x win compared to a senior engineer doing the exact same.”

“I have had incredible success debugging issues by just hooking up Datadog MCP and giving agents access to it. Claude/cursor don't seem to have any issues pulling in the raw data they need in amounts that don't overload their context.”

One scope note on both quotes: the raw data they need is bounded by the storage tier, caps and sampling described above, whether or not the user notices.

Should you connect an agent to Datadog?

Yes. Best for teams already standardized on Datadog that want an agent investigating telemetry, and are willing to configure the connection deliberately rather than accept the defaults.

Strongest fit

Cross-surface investigations that span production telemetry, deploys and CI in one conversation. Of the vendors in this guide, no other official connector spans that much from one connection.

Main advantage

Coverage of four of the five stages, with granular toolset control and mature auth.

Main weakness

Incomplete datasets look complete. Caps, tiers, sampling and rollups all trim results, mostly without notice, so the agent's answers are trustworthy only with the instructions above in place.

Operational risk

Three write tools ship in the default toolset, and the Standard Role can use them. Read-only requires deliberate role setup.

Frequently asked questions