Datadog MCP for AI agents

Agents read Datadog MCP at once. Changes and sends are held for a person's approval by default.

Book a discovery call Browse all connectors

About Datadog MCP

Investigate Datadog telemetry, incidents, dashboards, and service health.

What an agent can do in Datadog MCP

Every Datadog MCP action is classed by the platform as a read, a change or a send. Reads run at once. Changes and sends are held for a person by default.

Runs at once (reads)

Looks things up in Datadog MCP without asking first. 245 actions.

Aap get activation optionsCheck whether Datadog App and API Protection (AAP) can be enabled for a service via Remote Configuration (RC), with no code changes. Use when the user asks to install, set up, enable, or onboard AAP f
Aggregate datadog ci pipeline eventsAggregate and analyze CI pipeline events to produce statistics, metrics, and grouped analytics. Use it for questions such as average pipeline duration or failed builds per pipeline. For individual eve
Aggregate datadog test eventsAggregate Datadog test events for reliability, performance, and execution trends. Use search_datadog_test_events for individual event details. aggregation is required and must be one of count, cardina
Aggregate dora eventsAggregate DORA events into scalar values or timeseries using composable queries and formulas. Each query selects a DORA index, optional metric, aggregation, filter, and group_by facets. Use get_dora_f
Aggregate eventsAggregate Datadog events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P98, P99), with optional grouping by fields or time intervals. Use this for aggr
Aggregate rum eventsAggregate Datadog RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P98, P99), with optional grouping by fields or time intervals. Use this for
Aggregate spansAggregate Datadog APM spans to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P98, P99), with optional grouping by fields or time intervals. Use this for a
Analyse datadog k8s rolloutAssemble a Kubernetes Deployment rollout in one call: status, progress, timing (ETA while in progress, duration once finished), the new/previous/old ReplicaSet split by revision, and before/after impa
Analyze datadog error tracking errorsAnalyze Datadog Error Tracking error samples with SQL — aggregations, breakdowns by tag/service/version, or raw sample inspection. Runs against a virtual 'errors' table of individual error events (not
Analyze datadog logsAnalyze Datadog logs using SQL. Runs against a virtual 'logs' table filtered by your search query. Good for aggregations, counts, group-bys, or peeking at recent logs with LIMIT. To discover custom at
Analyze datadog security findingsPrimary tool for analyzing security findings. Use this for all security findings analysis tasks. REQUIRED: Call get_datadog_security_findings_schema FIRST to get available fields and their types befor
Analyze datadog security signalsCount, group, or trend security signals using DDSQL — for any aggregate question: 'how many', 'top N', 'by severity', 'over time', or breakdown. Do NOT use for listing, retrieving, or checking existen

Show all 245

Analyze security findingsPrimary tool for analyzing security findings. (Also available as analyze_datadog_security_findings.) Use this for all security findings analysis tasks. REQUIRED: Call security_findings_schema FIRST to
Ask widget expertGet targeted instructions for building a Datadog widget. Returns a concise how-to guide — widget type recommendations, required fields, schema patterns, and an annotated example — that you use to buil
Build audit trail queryTranslates a natural-language description into a correct Audit Trail query string. Returns query/from/to fields (plus optional visualization hints) that can be used wherever an Audit Trail query is ne
Check-flag-implementationPRIMARY TOOL FOR EXISTING FLAGS! This tool should be used to check how a feature flag should be implemented in codebase. Use this when asked: - Check my flags are used properly? - Use an existing flag
Cost recommendationsLists an organization's Cloud Cost Management (CCM) cost-saving recommendations. By default, recommendations are ranked by estimated potential savings (highest first); CCM analyzes cloud and SaaS reso
Cws agent events schemaGet the schema (available fields) for Workload Protection agent events — the raw runtime security events (process, file, network, and DNS activity) collected by the Datadog Agent. Workload Protection
dd gffdo-not-call
dd gucdo-not-call
dd rfwdo-not-call
Ddsql create linkGenerate a Datadog UI link to the DDSQL editor with the given query pre-populated.
Ddsql get specGet a compact DDSQL capability spec with supported SQL functions, SQL keywords, and DDSQL-specific deltas from vanilla PostgreSQL. Start with this tool before composing queries, then use ddsql_schema_
Ddsql read saved queryRead a single saved DDSQL query by its query_id. Returns the full saved query record, including dataset_id, name, SQL text, columns, visibility, description, and author/timestamp metadata.
Ddsql run queryRun a DDSQL query and return results. Recommended flow: (1) call ddsql_get_spec, (2) call ddsql_schema_search_tables, (3) for data tables use entries in tables: if searchable=true, call ddsql_schema_s
Ddsql schema get table columnsGet static SQL columns for a DDSQL table from schema metadata. Use this after ddsql_schema_search_tables for entries in tables where searchable=false, or as fallback when ddsql_schema_search_unstructu
Ddsql schema search tablesSearch DDSQL datasets across four providers: public tables, reference tables, metrics, and published analyses. Results are returned in three TSV sections: tables (public + reference_tables), metrics,
Ddsql schema search unstructured fieldsSearch and rank fields for an unstructured DDSQL source. Use this after ddsql_schema_search_tables for entries where searchable=true as the primary schema-discovery path; results include both common s
Ddsql search saved queriesSearch and list saved DDSQL queries. Use to find existing saved queries by name or description. Results are sorted by most recently modified and include query ID, name, SQL text, columns, visibility,
Ddsql upsert saved queryCreate or update a saved DDSQL query. To create a new query, provide name and query without query_id — if the user has not specified a name, generate a concise descriptive name based on the query cont
Describe datadog k8s resourceGet detailed information about a specific Kubernetes resource. Use this tool instead of kubectl describe. Returns kubectl-style tabular fields plus additional resource-specific details such as CPU/mem
Diff network device configurationsCompare two ndm network device configuration snapshots and return a unified diff. Inputs: - original_config_id (required) - modified_config_id (required) Use config IDs returned by search_network_devi
Do not call refresh widgetdo-not-call
Expand llmobs spansLoad the children of specific spans in a trace, enabling progressive tree exploration. Use this when **get_llmobs_trace** returns collapsed nodes you want to expand. Returns expanded_spans[] (recursiv
Explore profiling call graphExplore a call graph to identify hot call relationships for the provided profile type. Best suited for investigating a single service at a time. For cross-service comparisons, use get_profiling_timese
Explore profiling flame graphObtain a list of top stacktraces based on their value contribution for the provided profile type. Best suited for investigating a single service at a time. For cross-service comparisons, use get_profi
Explore profiling rum flamegraphReturns a flamegraph for profiles scoped to RUM events matching a given metric and optional filter. Works with any RUM-instrumented platform (browser, mobile, etc.) — use the family and service that m
Explore profiling timelineAnalyze timeline activity showing lane groups (threads, GC, etc.) and their CPU/I/O activities. Best suited for investigating a single service instance at a time. For cross-service comparisons, use ge
Find datadog database instancesDiscover and rank database instances for DBM investigation. USE THIS TOOL FIRST before calling other DBM tools that require a database_instance parameter. This tool discovers database instances via tr
Find llmobs error spansFind all error spans in a trace with propagation context. Returns error details, parent context, and whether errors propagated to child spans. Returns errors grouped by span kind, each with span_id, e
Generate monitor messageGenerates a monitor message with What's Happening, Impact, and Links sections from a monitor query. Only 'metric alert' and 'query alert' monitor types are supported.
Get active feature flagsdo-not-call
Get autonomous system statusGet the health status of an autonomous system (AS) using Network Path data. Calls the Network Path aggregate endpoint to assess whether the AS has detected issues such as packet loss, latency spikes,
Get-canary-resultsGet results from completed or in-progress canary experiments for a feature flag. This tool retrieves experimental data showing how each variant performed during canary testing, including metric measur
Get change storiesRetrieve change events for an APM service over a time range. Use to correlate changes with performance issues, errors or incidents. Tracked Change types: deployment (code/version), feature_flag, traff
Get data catalog schemaReturn the entity type schema for every platform this org has data in. Takes no arguments. Discovers active platforms by searching for root entities across all supported platform types, then returns t
Get datadog code coverage branch summaryFetch aggregated code coverage summary metrics for a repository branch. Use this tool to retrieve total coverage, patch coverage, and service/codeowner breakdowns for a specific branch. Common prompts
Get datadog code coverage commit summaryFetch aggregated code coverage summary metrics for a repository commit. Use this tool to retrieve total coverage, patch coverage, and service/codeowner breakdowns for a specific commit. Common prompts
Get datadog code coverage filesFetch per-file code coverage line data for a repository commit, branch, or pull request. Returns executable lines, covered lines, and added lines for each file. Use this tool to inspect which specific
Get datadog code coverage pr summaryFetch aggregated code coverage summary metrics for a pull request. Use this tool to retrieve total coverage, patch coverage, and service/codeowner breakdowns for a specific pull request. Common prompt
Get datadog dashboardRetrieves a custom or integration Datadog dashboard by ID, returning its title, description, tags, widgets, and template variables. Use search_datadog_dashboards first to find dashboard IDs.
Get datadog database calling servicesIdentify upstream APM services and resources that call database queries. Use this tool to correlate database activity with application traces, enabling root cause analysis across the APM-database boun
Get datadog database explain plansRetrieve explain plans for a query or plan signature within a timeframe. Returns simplified plan structures optimized for analysis, including operator trees, index usage, estimated costs, and temporal
Get datadog database health signalsRun database health checks to identify potential issues. Returns evidence-based signals about database health including CPU saturation, restarts, query latency, blocking, and more. Compares a regressi
Get datadog database query performanceAnalyze a specific SQL query's performance — use when investigating slow queries, high database load, or resource-intensive queries. Returns throughput, average latency, execution time, rows per execu
Get datadog database query statementRetrieve the SQL statement text for a given query signature. The query signature is a stable hash fingerprint of the normalized SQL; use this tool to map signatures back to concrete SQL for investigat
Get datadog database recommendationsRetrieve live database recommendations for a database, query, table, host, or index. Returns the matching recommendations, current status, severity, raw recommendation context, and a normalized scope
Get datadog database schemasFetch schema definitions (columns, indexes, foreign keys, partitions) for one or more database objects. Accepts a list of database objects with varying levels of specificity — from just a table name t
Get datadog error tracking issueGet detailed information about a specific Error Tracking Issue from Datadog. Use this tool to retrieve full details for a single Issue by its ID. The Issue ID can be obtained from the search_datadog_e
Get datadog flaky testsSearch flaky tests from Datadog Test Optimization. Results include failure-rate stats, flaky state and category, ownership context, branch and SHA history, test-run metadata, and CI-pipeline impact. U
Get datadog flaky tests management policiesReturn Flaky Tests Management policies for a repository, including quarantine, disable, and attempt-to-fix settings.
Get datadog formGet a specific Datadog form by its ID, including full metadata and datastore configuration.
Get datadog incidentGet detailed information about a specific Datadog incident by ID, including status, severity, timeline, associated users, and attachments.
Get datadog k8s manifestGet the YAML manifest for a specific Kubernetes resource. Use this tool instead of kubectl get -o yaml. Returns the manifest in YAML format. If the manifest exceeds max_tokens, it will be truncated an
Get datadog metricQuery metrics data from Datadog. Use response_format='timeseries' (default) to get time-indexed data points for graphs and trend analysis. Use response_format='scalar' to get a single aggregated value
Get datadog metric contextGet metadata (description, type, unit, integration), available tags/dimensions, and optionally related assets for a metric. Useful for exploring metrics before querying them. Set use_cloud_cost=true f
Get datadog notebookRetrieve information about a specific Datadog notebook by ID. This tool provides details including name, status, and associated author. The ID can also be extracted from a URL. The ID will be the last
Get datadog security aap blocking configGet the org-wide AAP (App & API Protection, formerly ASM / Application Security Monitoring) blocking configuration. Returns blocking_enabled, which controls default AAP attack blocking, and denylist_e
Get datadog security aap custom rulesGet AAP (App & API Protection, formerly ASM / Application Security Monitoring) WAF custom rules — user-authored in-app WAF rules that match request traffic and either monitor it or block it. Each rule
Get datadog security aap denylistList AAP (App & API Protection) denylist entries — IPs, users, user-agents AAP currently BLOCKS or monitors via automated security response. Each entry = Security Response Entity (aka "ASM Block" / "A
Get datadog security detection rulesGet security detection rules. This tool supports two modes based on the arguments provided: 1. Get a single rule by ID: provide rule_id — always returns the full rule object regardless of fields or fu
Get datadog security detection rules schemaReturn the schema / authoring reference for Datadog Cloud SIEM detection rules. Includes log_detection plus supported workload_security, application_security, api_security, and ai_guard sections. Cust
Get datadog security findings schemaCall this first before using analyze_datadog_security_findings. Returns the schema (available fields and their types) for security findings, which you need to construct correct SQL queries. IMPORTANT:
Get datadog security findings ticket suggestionsGet ranked project and integration suggestions for creating Jira issues, ServiceNow tickets, or Linear issues. Call this when you don't know which project_id to use for create_datadog_security_finding
Get datadog security ioc indicatorRetrieve full detail for one IoC indicator by value (score, category, AS info, GeoIP, log sources, services, signal counts, OCSF fields).
Get datadog security ioc schemaDiscover filterable fields and their values for IoC Explorer. Call without `filter` first to list all available field names. Then supply `filter` with an exact field name from that list to get `[{valu
Get datadog security signalGet the full details of a single Datadog security signal by ID. Returns the complete signal data including attributes, rule information, triage state, tags, and case correlations. IMPORTANT: Before us
Get datadog security signals schemaGet the schema (available fields) for security signals. Use this tool to discover what fields can be used to filter or query security signals. Returns field names, types, and optionally descriptions a
Get datadog security suppressionsRetrieve security monitoring suppressions from Datadog. Suppressions prevent detection rules from generating signals for specific conditions. This tool supports three modes based on the arguments prov
Get datadog security trace passlistList all AAP (App & API Protection) allowlist / passlist entries that exempt specific traces from AAP security analysis and WAF blocking. This tool operates on AAP traces only; it is unrelated to Clou
Get datadog spreadsheetRetrieve a Datadog spreadsheet by ID. Returns tables (tables[].id), pivots (pivots[].id), and sheets (sheets[].id) with their configurations. Each table includes schema[].label (all column labels), ca
Get datadog spreadsheet referenceReturns the field reference guides for building inputs to upsert_datadog_spreadsheet. Sections: - "table" — field reference: import types, schema, calculated columns, lookups, filters, sort - "pivot"
Get datadog spreadsheet tab dataRetrieve paginated data from a table, sheet, or legacy pivot in a Datadog spreadsheet. The tab type is inferred automatically from tab_id; use get_datadog_spreadsheet to discover tab IDs. For tables a
Get datadog spreadsheet table dataDEPRECATED: use get_datadog_spreadsheet_tab_data instead, which provides a unified interface for table tabs. Retrieve paginated rows from a table in a Datadog spreadsheet. Time range comes from the ta
Get datadog test optimization settingsReturn enabled and disabled Test Optimization features for a service: Test Impact Analysis, Early Flake Detection, Auto Test Retries, Failed Test Replay, Code Coverage, and PR Comments. Provide env wh
Get datadog traceRetrieve a trace by trace ID from Datadog APM. This tool fetches all spans within a specific trace by default, providing detailed information about the request flow, timing, and service interactions.
Get datadog workflowRetrieve a single Datadog Workflow Automation workflow by ID. By default, returns the saved draft when one exists, otherwise the base. Set specTarget to select exactly the base or saved draft spec. Th
Get datadog workflow actionGet the full definition of a Datadog Workflow Automation action by actionId. Returns resolved input/output JSON schemas, action keywords, action-specific AI instructions, and other metadata needed to
Get datadog workflow instanceRetrieve a Datadog Workflow Automation execution instance. The default response is a lightweight execution summary. Set includeDetails to true for the raw detailed execution record, including workflow
Get datadog workflow spec schemaGet the JSON schema for a Datadog Workflow Automation spec. Call this before constructing a spec for create_datadog_workflow, validate_datadog_workflow, or update_datadog_workflow.
Get datadog workflow step dataRetrieve the execution data for a single step of a Datadog Workflow Automation instance: its status, error message, inputs, evaluated inputs/outputs, and the execution context the step's expressions w
Get data entity detailsFetch full details and attributes for one or more data entities by their entity IDs. Use this to get the complete attribute set for known data entities: owner, tags, display_name, custom attributes, a
Get data entity hierarchyFetch the containment hierarchy (ancestors and descendants) for one or more entities. Use this for containment navigation — NOT for data lineage (use get_data_entity_lineage for that). Typical use cas
Get data entity lineageFetch the live reachable lineage subgraph from one or more anchor entities. Checks direct children of the anchor entities for lineage as well. For example, you can pass a table entity id as an anchor,
Get data observability monitorRetrieves data observability metrics for a given monitor ID. This tool fetches data quality metrics timeseries data, including anomaly detection bounds when the monitor has anomaly detection enabled.
Get data observability monitor coverageFetch all Data Quality monitors for this org and resolve each monitor's entity filter to return the full set of entities it is configured to cover. For each monitor, the filter is evaluated against UG
Get data observability monitor group statusesQuery the current alert and warn state of DQ monitor groups from the alerting service. Coverage is based on actual monitor groups — entities for which the monitor has received real metric data. For ea
Get data observability recommendationGets the full details of a single Data Observability recommendation by id, including its structured body_sections describing the problem, evidence, and proposed change. Obtain the id from list_data_ob
Get dora fieldsList the valid measures, facets, aggregations, and cardinality_fields for aggregate_dora_events, per DORA index (deployment, commit, pull_request, failure). Call this before aggregate_dora_events to p
Get entity descriptionsGet custom user-defined descriptions for data entities by their IDs. Returns a map of entity_id to description with created_at and updated_at timestamps.
Get entity tagsGet custom user-defined tags for data entities. Returns entity IDs with their associated key:value tags. These are custom tags distinct from built-in entity attributes.
Get-feature-flagGets variants and status in environment for a specific feature flag by ID or key. Provide featureFlagID or featureFlagKey (or both). *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, fe
Get form definition schemaGet the JSON Schema used to validate a Datadog form's data_definition and ui_definition. Fetch this before constructing or updating a form definition with create_datadog_form or update_datadog_form.
Get form responsesGet submitted responses for a Datadog form. Use get_datadog_form to obtain the datastore_id for the form first.
Get global variablesRead this org's Synthetics global variables. Each variable is returned in full (id, name, description, tags, creator, editor, timestamps, and more). The plaintext value is included only for non-secure
Get-guardrail-metricGet details for a specific guardrail metric by ID. Use this to inspect a metric's full details including description and aggregation configuration. *** FEATURE FLAG DETECTION *** If users mention: fla
Get kafka client configsReturn producer- and/or consumer-side Kafka client configuration for one or more services, as collected by Data Streams Monitoring (DSM). Each entry pairs a service name with a config_type of either '
Get llmobs agent loopGet a chronological view of an agent's execution loop, showing each step (LLM calls, tool invocations, decisions) in order. This provides a narrative of what the agent did and why. **Use cases:** - Un
Get llmobs all dataset recordsWalk a dataset's records page by page server-side and return them as shaped previews, with a cursor that always resumes exactly where the walk stopped. Use this when you need **complete coverage** of
Get llmobs annotated interactionsRead what is in an annotation queue: every queued interaction with the annotations recorded on it. Returns `annotated_interactions` (each with its `id`, `content_id`, and `annotations` carrying the la
Get llmobs annotation label schemaRead the label definitions of an annotation queue: what each label is called, what kind of value it accepts, and its server-assigned `id`. Returns `label_schemas` (empty for a queue with no labels def
Get llmobs annotations by content idsLook up, across every annotation queue in the org, whether given traces, sessions, or spans are queued for review, whether anyone has reviewed them, and what the reviewers said. Returns `annotated_int
Get llmobs dataset recordsRead dataset records with structured previews + a schema summary. Records' `input` / `expected_output` / `metadata` are arbitrary JSON — this tool shapes them so the model sees structured previews (ob
Get llmobs eval aggregate statsGet aggregate statistics for a specific evaluator over a time window, optionally filtered by ML application. **Use cases:** - Check the overall pass rate for an evaluator - Get score distribution (mea
Get llmobs evaluatorRetrieve an LLM-judge evaluator configuration by name. Returns the full config including target (ml_app + sampling + filter), LLM provider, and judge prompt template. Returns a not-found error if no e
Get llmobs experiment dimension valuesGet the unique values for a dimension, with counts. Use this to discover valid filter values before calling **list_llmobs_experiment_events** or segment values before calling **get_llmobs_experiment_m
Get llmobs experiment eventGet full details for a single experiment event, including its input, output, expected_output, all metrics, and dimensions. Use this after **list_llmobs_experiment_events** to inspect a specific event
Get llmobs experiment metric valuesGet statistical analysis for a specific evaluation metric, optionally segmented by a dimension. Returns aggregate statistics, not per-event raw values. **Use cases:** - Compare a metric (e.g., accurac
Get llmobs experiment summaryGet a high-level summary of an experiment with pre-computed statistics for all evaluation metrics. Start here before using other experiment tools. Returns pre-computed stats (score/boolean/categorical
Get llmobs full dataset recordsFetch up to 3 specific records with **untrimmed** input / expected_output / metadata. Resolve `record_ids` via **get_llmobs_dataset_records** first. Returns `DatasetRecordsFullResult` with full record
Get llmobs model pricingGet canonical LLM Observability model pricing rate cards. Provide at least one of provider or model. `provider` is an optional hint: when it matches a known provider the search is scoped to it; otherw
Get llmobs pattern configGet the most-recently-modified **Topics Discovery (Patterns)** configuration for the caller's org. Returns a not-found error if the org has no config yet. Use **list_llmobs_pattern_configs** instead w
Get llmobs pattern pointsGet a **cursor-paginated page of clustering points** (individual spans) assigned to a single topic. Each point includes the `span_id`, `session_id`, and a span input preview. Resolve `topic_id` from *
Get llmobs pattern run statusGet the status and per-activity progress of the **most recent** Topics Discovery run for a config. Use this to tell whether clustering is still running, has completed, or failed before reading topics.
Get llmobs patternsGet the **topic hierarchy** discovered by a Topics Discovery run. Topics are organized into levels; each topic has a `name`, `description`, and `point_count`. Provide `config_id` (required). Omit `run
Get llmobs patterns with pointsGet the topic hierarchy for a run **with the clustering point span IDs inlined** on each leaf (hierarchy-0) topic. Use this when you want both the topics and the spans that back them without a second
Get llmobs projectLook up an LLM Observability **experiments project** by ID or name. Pass `project_id` (UUID) for a direct lookup or `project_name` to resolve by name. If you only have an `ml_app`, prefer **search_llm
Get llmobs span contentRetrieve the actual content of a specific field from a span. Call this after **get_llmobs_span_details** reveals which content fields are available via content_info. Content fields contain the span's
Get llmobs span detailsGet detailed metadata for one or more spans within a trace. Returns everything except the actual content payloads — use **get_llmobs_span_content** to retrieve those. Each span includes identification
Get llmobs traceGet the full structure of a trace as a span hierarchy tree. Use this after **search_llmobs_spans** to understand the shape of a trace before drilling into specific spans. Returns trace overview (span
Get monitor coverageFinds monitoring gaps and coverage for services or hosts. Returns which signals (error rate, latency, request rate) are covered by monitors and which are missing. Use with create_datadog_monitor to fi
Get monitor templatesRetrieves official Datadog monitor templates as starting points for creating monitors. Use with create_datadog_monitor.
Get ndm deviceGet detailed information about a network device by its device_id. Use this to investigate device health and connectivity (ping status), get hardware details (vendor, model, serial number), check OS in
Get network device configurationRetrieve the full text of an NDM network device configuration snapshot (running config or startup config) for review, compliance auditing, or troubleshooting. Use a config_id from search_network_devic
Get network path test runsSearch and retrieve Network Path test runs using a query. Network Path tests data contains traceroute runs and hop-by-hop data. **Query Syntax**: Use search syntax to filter test runs. Common query pa
Get-onboarding-stepUse this FIRST — before create-feature-flag — whenever a user asks to set up, add, or onboard Datadog feature flags in a project that doesn't have them yet: e.g. "set up feature flags", "add feature f
Get popular warehouse tables by query frequencyRank database tables by query activity, broken out by who is querying them. Returns one signal per user type, each an independently ranked list of the top N tables for that user type sorted by query c
Get profiling fieldsDiscover available fields and facets that can be used for filtering and grouping profiling data. Use this to find what groupBy or filter fields are available for get_profiling_timeseries queries. Retu
Get profiling field valuesGet the values for a specific profiling field/facet discovered via get_profiling_fields. Use this to discover what values a particular field has (e.g. all endpoint values, all function names). Returne
Get profiling profile typesReturns profile types and families that can be used by other profiling tools given a query context. You can either query by tags (queryString + timeFrame) or by trace context. When using trace context
Get profiling runtime idsReturns individual profiled runtime IDs (processes/containers). These are exact strings that can't be changed. For family, don't use ebpf.
Get profiling service insightsReturns insights over the provided time window. These insights contain: - A high-level summary explaining the issue and why it matters - Contextual insights from profiling data (for example, affected
Get profiling servicesReturns profiled services along with their profiling families that can be queried for profiling data in the given query context. Note: results are in no particular order and do not indicate relative i
Get profiling tag namesDiscover available tag names (e.g. service, host, env, version, family, runtime-id) from the profile metadata track. Use this to find what tags are available for filtering profiling data. Common infra
Get profiling tag valuesGet the values for a specific tag (e.g. service, host, env, version, family, runtime-id) from the profile metadata track. Use get_profiling_tag_names first to discover available tags. Returns at most
Get profiling timeseriesQuery profiling data as timeseries, aggregated into time buckets. Use this to analyze trends, compare services, or identify performance regressions over time. Well suited for cross-service investigati
Get prs by head branchRetrieves all pull requests for a repository that have a specific head branch. This is useful for finding active PRs associated with a particular feature branch or development branch.
Get reference table rowsRetrieve specific rows from a reference table by their primary key values. Returns the row data in tab-separated format for easy readability. Use list_reference_tables first to discover table IDs.
Get replay summaryGet an AI-generated play-by-play of what a user did during a session replay — what pages they visited, what actions they took, and what happened step by step. Use this tool when the user wants to unde
Get rum insightGet a pre-computed performance insight for a specific RUM view. Call this to diagnose a performance problem on a known view. Choose insight_name based on what you want to investigate: 'aggregated_wate
Get rum operation insightsInvestigate why a RUM operation is failing or slow. Accepts either operation_id or operation_name (at least one is required). You MUST call search_rum_operations first to confirm the operation exists
Get rum operation summaryGet a deep-dive health summary for a single RUM operation, identified by operation_id (preferred — skips name resolution) or operation_name (at least one is required). SDK-instrumented operation names
Get rum summaryReturns a performance summary for a RUM application with period-over-period diffs and anomaly windows. Covers browser metrics (LCP, FCP, CLS, INP, loading time, time spent) and mobile metrics (refresh
Get rum view waterfallReconstruct the chronological load timeline for ONE specific RUM view occurrence, web or mobile. Returns every resource, long task, error, and user interaction (action) that occurred during that singl
Get-saved-filterGet a saved filter by id, including its targeting rules.
Get spark job healthRetrieves detailed health metrics for a single Spark or Databricks job run. This tool extracts structured health data from Spark/Databricks job traces including: - Target metrics: duration, executor C
Get spark sql planRetrieves the Spark SQL physical execution plan from a spark.stage span. This tool extracts and formats the _dd.spark.sql_plan attribute from a Spark stage span. The execution plan shows: - Node types
Get subject kafka schemasReturn all Kafka Schema Registry versions for a single subject on a given Kafka cluster. Use this after list_all_kafka_schemas to inspect the full version history (schema body, id, version, references
Get synthetics testsSearch and retrieve details about Synthetics tests configured in Datadog. Use this tool to either query test configurations, or test results. Supports filtering by endpoint domain and/or path, or publ
Get user configdo-not-call
Get warehouse query historyFetch recent queries that touched one or more specific entities, in reverse chronological order (most recent first). Use this when the user wants to understand query activity for a specific table or e
Get widget referenceGet TypeScript schemas and building instructions for widget types. Call before generating widget JSON. Note: "group" is a container for organizing related widgets — include both "group" and any intend
Inspect data observability monitor annotationsInspect Data Quality monitor data, anomaly bounds, and existing annotations before proposing a change. Monitor IDs are stable request identifiers, but when a monitor name has already been resolved, us
List all kafka schemasList every Kafka Schema Registry schema known to Data Streams Monitoring (DSM) for the current org within a time window. Returns subject, cluster, version, schema type, and compatibility metadata. Use
List-allocations-for-feature-flagList allocations for a specific feature flag. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they
List audit eventsList Datadog Audit Trail events over a time window. Audit Trail monitors user activity across the Datadog platform to help maintain compliance, enforce platform governance, and build transparency, cap
List autonomous system statusesGet an overview of autonomous system (AS) health from Network Path data, without needing a specific ASN. Calls the Network Path aggregate endpoint with no ASN filter and returns a compact summary of w
List datadog database optimizationsList a database's ready-to-apply, benchmark-validated query optimizations — the same set shown on the Datadog DBM Optimizations page. Each entry carries a MEASURED improvement, so results can be ranke
List datadog security findings automation rulesList automation rules for security findings. Returns the ordered list of rules for a given rule type (first-match-wins evaluation order). Rule types: mute (suppress findings), due_date (set remediatio
List datadog skillsList available Datadog skill guides. Skills document how to use Datadog's tools: the right attributes, query syntax, and common pitfalls. Call this before load_datadog_skill whenever you are not alrea
List datadog workflow instancesList the execution instances of a Datadog Workflow Automation workflow. Use this to see a workflow's execution history — for example to find a recent run, check how many executions succeeded or failed
List datadog workflowsFind Datadog Workflow Automation workflows and inspect their metadata. Metadata-only output is the default. Each result's meta.hasSavedDraft indicates whether a saved draft exists. Use get_datadog_wor
List data observability recommendationsLists Data Observability cost- and performance-optimization recommendations for data jobs and queries (Spark, Databricks, Snowflake, BigQuery), each with estimated cost and duration savings. Returns l
List-environmentsList all flagging environments for the organization. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or sa
List-feature-flagsList all feature flags for the organization. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they w
List-guardrail-metricsList all available guardrail metrics for the organization. Use this tool to discover metric IDs needed for allocation guardrails. Results are paginated to prevent context window overflow. *** FEATURE
List kafka broker configsList configuration versions for a Kafka broker on a given cluster, as collected by Data Streams Monitoring (DSM). Useful for diagnosing broker-level config drift and correlating cluster health changes
List kafka topic configsList configuration versions for a Kafka topic on a given cluster, as collected by Data Streams Monitoring (DSM). Returns the history of topic-level config values (retention, cleanup policy, etc.) for
List llmobs annotation queuesList Agent Observability **annotation queues** — the review lists where humans (or agents) grade traces, sessions, and spans against a defined set of labels. Returns `queues` (each with `queue_id`, `n
List llmobs datasetsList **experiments datasets** within a project, with optional id or name filter. Resolve `project_id` first via **get_llmobs_project** if you only have a project name. Returns `datasets` (zero or more
List llmobs evalsList every evaluator configured for the caller's organization, across all ML applications. Returns the eval name, ml_app, and enabled status for each evaluator. Use list_llmobs_evals_by_ml_app to scop
List llmobs evals by ml appList all evaluators configured for an ML application. Returns the eval name and enabled status for each evaluator. Use get_llmobs_evaluator to retrieve a single evaluator's full configuration.
List llmobs experiment eventsList experiment events with minimal summaries, supporting filtering by dimension or metric and sorting by metric value. Does NOT return full content — use **get_llmobs_experiment_event** to inspect a
List llmobs experimentsList experiment runs in a project or against a dataset, newest first. This is the discovery step before **get_llmobs_experiment_summary**, which needs an experiment ID. Scope is required: pass `projec
List llmobs pattern configsList all **Topics Discovery (Patterns)** configurations for the caller's org. A pattern config defines which LLM Obs spans to cluster (via `evp_query`), how many to sample, and how deep the topic hier
List llmobs pattern runsList the **completed** Topics Discovery runs for a config, newest first. Each run is a distinct clustering of the config's spans at a point in time. Returns `runs` with each run's `id`, `status`, time
List llmobs projectsList all LLM Observability **experiments projects** for the org. Returns projects sorted by creation date, newest first. Returns `projects` (array), `next_cursor` (pass as `cursor` to fetch the next p
List-onboarding-flagsCheck for existing flags tagged source:agentic-onboarding that qualify for reuse: a non-production environment, currently ENABLED, whose queries already cover the given dd_env under the runtime matche
List reference table rowsFetch a page of rows from a reference table in primary-key order. Returns rows and a continuation_token for the next page. Pass continuation_token back on the next call to paginate consistently. Use l
List reference tablesList and search reference tables in the organization. Reference tables are used to enrich logs and other data with additional context. Use this tool to discover available tables, check their status, a
List-saved-filtersList saved filters for the organization.
List-stale-feature-flagsList stale feature flags in the organization, each enriched with the reason it is stale and a tool_hints array of suggested next-step tools to clean it up.
List synthetics locationsReturns all Synthetics locations available to this org — managed (aws:, gcp:, azure: prefixes) and private (pl: prefix). When presenting results, include at least the id and name for each location.
Load datadog skillLoad a Datadog skill guide before using related Datadog tools. Skills improve query quality by documenting the right attributes, syntax, and common pitfalls. Skill names depend on the visible toolsets
Monitor groups searchSearches monitor groups to find which specific groups (e.g. host:web-1) are alerting across monitors. Use monitor_id to filter groups for a specific monitor, or use the query field with supported face
Optimize datadog database queryAnalyze a SQL query for optimization opportunities using deterministic rules plus LLM-assisted analysis. Returns actionable recommendations including query rewrites, anti-pattern detection (SELECT *,
Rank data entities by lineage degreeRank entities by their transitive lineage connectivity using a pre-built snapshot. Returns parent-level entities (tables, dashboards, jobs, etc.) ranked by how many other entities they connect to. Chi
Rank data observability monitor candidatesRank tables by their importance for monitoring, combining lineage impact and query activity into a single composite score. Use this as the primary entry point for "what should I monitor?" questions —
Read kafka messagesRead messages from a given Kafka cluster/topic via the Datadog Agent. Dispatches a Remote Config action and polls for the agent's response. REQUIRES the `data_streams_monitoring_capture_messages` perm
Recommend monitor thresholdRecommends a threshold value for a metric monitor query based on peer-group statistics. Returns the recommended threshold, its source, a confidence score, recommendation status, a bounds-validation re
Search audit eventsSearch Datadog Audit Trail events using a query string. Audit Trail monitors user activity across the Datadog platform to help maintain compliance, enforce platform governance, and build transparency,
Search cws agent eventsSearch and retrieve raw Workload Protection agent events — the low-level runtime security events collected by the Datadog Agent (eBPF-based) on hosts and containers. Workload Protection is also known
Search datadog ci pipeline eventsSearch and retrieve CI pipeline events from Datadog with timing, failure reasons, error messages, and retry history. Use this tool to troubleshoot CI failures, inspect structured failure details, or c
Search datadog dashboardsList and retrieve information about Datadog dashboards. This tool helps discover available dashboards, their IDs, titles, and underlying queries. Use this tool when you need to find specific dashboard
Search datadog database plansSearch and retrieve Database Monitoring (DBM) query execution plans from Datadog. Query execution plans show how the database engine executes queries, including index usage, join strategies, and cost
Search datadog database samplesSearch and retrieve Database Monitoring (DBM) query samples from Datadog. Query samples represent individual query executions with performance metrics, allowing you to analyze database activity patter
Search datadog entitiesSearch Datadog services through the entity graph, including service ownership and direct upstream or downstream relationships. Prefer this tool over searching telemetry, monitors, dashboards, or other
Search datadog error tracking issuesSearch Error Tracking Issues from Datadog. Use this tool to search errors across data sources (RUM, Logs, Traces, ...). Returns groups of errors ("Issues"), along with the number of times they occurre
Search datadog eventsSearch and retrieve raw Datadog events (deployments, alerts, system activities, infrastructure changes, etc.). Do NOT use for counts, aggregations, or grouped analysis — use aggregate_events instead.
Search datadog formsSearch Datadog forms for the authenticated organization. Returns form metadata including name, description, active status, and creation time.
Search datadog hostsExplore Datadog hosts inventory with SQL. Queries run against the virtual 'hosts' table backed by "dd.hosts" (Advanced Query API), which exposes hostname, hostname_aliases (text[]; use hostname_aliase
Search datadog incidentsSearch Datadog incidents. Default sort: newest first. Supports filtering by state, severity, title, team, creation time, and more. Use `semantic_query` for natural-language search over AI-generated in
Search datadog k8s resourcesSearch for Kubernetes resources. Use this tool instead of kubectl to determine the state of Kubernetes resources (for example, Kubernetes deployments or pods). This tool is preferred over kubectl beca
Search datadog logsSearch and retrieve raw log entries or log patterns. Do NOT use for counting or aggregations — use analyze_datadog_logs instead. Best for: viewing raw logs, discovering patterns (use_log_patterns=true
Search datadog metricsList available metrics in Datadog with optional filtering by name and tags. Set use_cloud_cost=true to search Cloud Cost Management metrics.
Search datadog monitorsList and retrieve information about Datadog monitors. This tool helps discover monitors, their status, configuration, and alerts. Use this tool when you need to find monitors for investigation, manage
Search datadog notebooksSearch Datadog notebooks. Use this tool when you need to find notebooks for investigation or monitoring purposes. Results can be filtered, for example by author, and sorted. This tool returns snippets
Search datadog rum eventsSearch and retrieve raw Datadog RUM events using advanced query syntax. Do NOT use for counts, aggregations, or grouped analysis. Best for: inspecting individual RUM events, debugging specific user ex
Search datadog sdkRun JavaScript against the official SDK and code-exec extension catalog available to `execute_code`. The catalog contains only operations available to the current user and sandbox policy. Its data sta
Search datadog security findingsFallback tool for retrieving full security finding details. Prefer analyze_datadog_security_findings (with get_datadog_security_findings_schema) for most findings analysis tasks. Use this tool ONLY wh
Search datadog security ioc indicatorsList IoC Explorer indicators (IPs, domains, URLs, file hashes) matched against threat intel feeds. Returns IoC indicators, not security signals; `signal_count` is contextual (signals that referenced t
Search datadog security signalsFilter and list security signals from Datadog Security Monitoring matching criteria (status, time range, rule type, severity, service). DO NOT use this tool for counts, aggregations, top-N, breakdowns
Search datadog slosSearches Datadog SLOs by name, tags, or type. Filter with query syntax like 'service:my-service' or 'team:checkout'.
Search datadog spansRetrieve raw Datadog APM spans matching a query. Do NOT use for counts, aggregations, or grouped analysis — use aggregate_spans instead. Best for: inspecting individual spans, debugging request flows
Search datadog spreadsheetsSearch Datadog spreadsheets by name or owner. Returns a paginated list of spreadsheets with their IDs and names.
Search datadog test eventsSearch individual Datadog test events with execution metadata, error messages, stack traces, retry history, and flaky status. Use aggregate_datadog_test_events for counts, rates, and statistics. Keep
Search datadog workflow actionsSearch the Datadog Workflow Automation action catalog. Actions are the building blocks of workflow steps. Each result exposes actionId; pass it to get_datadog_workflow_action and use the same value as
Search data entitiesSearch for data entities in the data catalog. Parameters: - name: Entity name to search for. Supports wildcards anywhere in the value: prefix (stg_*), suffix (*_raw), and substring/infix (*orders*, fc
Search dora eventsSearch DORA deployments or merged-and-deployed pull requests, or fetch one event by ID. For DORA trends and aggregates such as deployment frequency, change lead time, failure rate, and recovery time,
Search llmobs spansSearch for LLM Observability spans. Entry point for trace analysis — use it to find spans before drilling in with **get_llmobs_trace**. **Prefer structured parameters** (`ml_app`, `tags`, `span_kind`,
Search ndm devicesSearch SNMP-monitored network devices (routers, switches, firewalls) in Datadog NDM. Use to investigate device health, interface bandwidth saturation, LACP/LAG/port-channel issues, topology neighbors
Search ndm interfacesGet all network interfaces (e.g., GigabitEthernet0/0/1, Vlan100) for a device. Use this to troubleshoot connectivity by checking interface status (up/down/warning), identify problematic interfaces dur
Search network device configurationsSearch NDM network device configuration snapshots (running config, startup config) for change tracking, config drift detection, or compliance auditing. Returns config metadata and IDs — use get_networ
Search pr insightsRetrieves issues blocking a pull request to help resolve and fix problems. Provides insights on failed tests, flaky tests, code quality problems, security vulnerabilities, and failed CI jobs.
Search replaysSearch Datadog Session Replay recordings and return a list of sessions with replay links. Only returns sessions that have a replay recording available. Two modes: • Session filter mode (default): Filt
Search rum applicationsSearch RUM applications in the organization. Returns application_id (UUID), name, type, is_active, rum_event_processing_state (ALL/ERROR_FOCUSED_MODE/NONE), product_analytics_retention_state (MAX/NONE
Search rum metricsSearch the organization's RUM metrics. Two kinds share the same shape: "custom" metrics are user-defined timeseries computed from RUM events, and "ootb" metrics are Datadog-predefined (server-managed)
Search rum operationsSearch or list RUM operations in the organization. Discovers all operations (SDK-instrumented and UI-configured) via the rum.measure.operation metric, then enriches with metadata (id, display_name, ta
Search rum retention filtersSearch RUM retention filters for an application. Retention filters control which RUM events are indexed and retained. Provide application_id to list filters for that application, optionally narrowed b
Suggest data observability monitor filtersAnalyze a set of entities to find common attributes and naming patterns, then suggest monitor filter expressions that group subsets of those entities for use in monitor definitions. Pass entity IDs fr
Summarize data entity lineageGet aggregate statistics about the lineage graph reachable from anchor entities. Use this BEFORE get_data_entity_lineage when dealing with large or unknown graphs. It returns counts and breakdowns wit
Validate dashboard widgetValidate a widget definition against the dashboard schema. Call when generating a widget JSON.
Validate datadog workflowA read-only check of a complete candidate workflow spec. It does not create or change a workflow. Semantic invalidity returns isValid: false and validationErrors. Malformed tool arguments can still pr
Validate monitor definitionValidates a monitor JSON definition. Always use before create_datadog_monitor.
Verify-onboarding-flagVerify a client-side onboarding flag through the public Datadog CDN using the user's own client token — the same path browser/mobile client SDKs use. Returns {ok:true, value:true, variation_key:"<serv

Held for approval by default (changes and sends)

Held for a person's approval by default. The approval is recorded and the action is sent once, never twice, with 10 seconds to undo. 123 actions.

Aap onboardingStep-by-step instructions for enabling Datadog App and API Protection (AAP) to monitor and secure your application. AAP detects security threats, vulnerabilities, and attacks in real time by using Dat
Add llmobs annotation queue interactionsQueue traces, sessions, or spans for human review in an annotation queue. This is how findings become review work: use **search_llmobs_spans** or **find_llmobs_error_spans** to identify the traces wor
Add llmobs dataset recordsCreate records in a dataset. **Two-step**: PREVIEW (`confirmed=false`) → INSERT (`confirmed=true`). - `confirmed=false`: does NOT insert. Validates that the (project_id, dataset_id) pair exists, then
Append new rum retention filterCreate a new RUM retention filter, appended at the end of the evaluation order. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and dir
Append reference table rowsAppend (add) new rows to an existing reference table. Prefer upsert_reference_table_rows when you may need to update existing rows — it handles both inserts and updates. Use this tool only when you ar
Archive-feature-flagArchive a single feature flag by ID or key; pair with list-stale-feature-flags to discover candidates. Provide featureFlagID or featureFlagKey (if both are given, featureFlagID wins).
Archive-saved-filterArchive a saved filter (reversible via unarchive-saved-filter).
Assign datadog security findingsAssign or unassign security findings to a user. Assignment cascades to linked cases — assigning a finding auto-assigns its linked case. Use analyze_datadog_security_findings or search_datadog_security
Batch update llmobs dataset recordsInsert, update, and delete dataset records in one versioned operation. Use this to edit or remove existing records; **add_llmobs_dataset_records** is the append-only path and is preferable when you ar
Browser onboardingStep-by-step instructions for adding initial Datadog setup to a frontend browser-based project environment. You must first review the user's project and this tool's arguments (including nested argumen
Cancel datadog workflow instanceCancel a running Datadog Workflow Automation execution instance. Invoke only when the user intends to stop the run. The instanceId can come from execute_datadog_workflow or list_datadog_workflow_insta
Clean-up-flagClean up a stale feature flag by key — auto-archives if no code references are known, otherwise returns the repos and files where the flag is still referenced plus a Datadog UI link and instructs the

Show all 123

Clone datadog formClone an existing Datadog form. Creates a copy of the form with all its current settings and latest version definition. Returns the cloned form's metadata including its new ID and datastore_id.
Clone llmobs datasetCopy a dataset's current records into a new dataset in the same project. The source dataset is left untouched. This is the safe way to try edits against a real dataset: clone it, mutate the clone with
Code coverage onboardingConfigure Datadog Code Coverage for a project by adding coverage report uploads to the CI pipeline. Call this tool to set up code coverage, add code coverage, enable code coverage uploads, or integrat
Create datadog formCreate a new Datadog form with a name. The form is created in draft state with a linked datastore auto-provisioned. The schema is unique, you must retrieve it using the `get_form_definition_schema` to
Create datadog notebookCreates a new Datadog notebook. Include key findings, evidence, supporting data, and complete query documentation unless told otherwise. Do not start the first markdown cell with a heading that repeat
Create datadog published analysisCreates a published analysis (also called a published dataset) from a notebook cell. A published analysis is a snapshot of a computational notebook's cells, exposed as a queryable dataset. Use this to
Create datadog security detection ruleCreate a new Cloud SIEM detection rule by POSTing the supplied payload to POST /api/v2/security_monitoring/rules. The payload must follow the schema returned by `get_datadog_security_detection_rules_s
Create datadog security findings automation ruleCreate a security findings automation rule. Specify rule_type to choose the type of rule: mute (suppress findings), due_date (set remediation deadlines), severity_modifier (adjust finding severity), o
Create datadog security findings ticketCreate a case, Jira issue, ServiceNow ticket, or Linear issue for security findings. Jira/ServiceNow/Linear targets automatically create and link a Case Management case. Title, description, and priori
Create datadog security suppressionCreate a new security monitoring suppression rule in Datadog. Suppressions prevent detection rules from generating signals for specific conditions. This operation is destructive: once active, future m
Create datadog skillCreate a new library skill in your organization's Skills Library — a separate, user-authored set of task guides, distinct from any built-in "Skills" your own agent tooling may already have. This libra
Create datadog workflowCreate an unpublished Datadog Workflow Automation workflow from a complete spec. Each step must use a catalog actionId and follow its action contract, and the spec must satisfy trigger and graph invar
Create-environmentCreate a new Feature Management environment. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they w
Create-experiment-feature-flagCreate a new feature flag with a FEATURE_GATE allocation linked to a standard experiment. Use this tool instead of create-feature-flag when an allocation has experiment_id. The allocation schema and e
Create-feature-flagPRIMARY TOOL FOR NEW FLAGS in a project that already has Datadog feature flags wired up! *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, grad
Create global variablesCreate a Synthetics global variable. name and value are required; value.secure marks the value as hidden after creation, and a secure variable's value is never returned. tags and description are optio
Create llmobs annotation queueCreate an Agent Observability **annotation queue** and, optionally, its label schema in the same call. Returns `queue` with the `queue_id` every other annotation tool needs, plus the schema with serve
Create llmobs datasetCreate an empty dataset inside a project. Populate it afterwards with **add_llmobs_dataset_records**. Name-idempotent within the project: an existing dataset of the same name is returned with `already
Create llmobs experimentCreate a new LLM Observability experiment object in a project. This records the experiment (so events/metrics can be reported against it) and does NOT run any model inference — it is the create counte
Create llmobs projectCreate an LLM Observability **experiments project** — the container that owns datasets and experiments. Name-idempotent: if a project with this name already exists in the org, it is returned with `alr
Create-onboarding-flagCreate the onboarding proof flag: a predictable boolean flag (disabled=false, enabled=true; default disabled) with a catch-all FEATURE_GATE allocation serving enabled=true in the selected NON-PRODUCTI
Create or update llmobs evaluatorCreate or update an LLM-judge evaluator configuration. **This is a full replace, not a patch.** The persisted evaluator becomes exactly what you send: any field you omit is reset to its default (or un
Create reference tableCreate a new reference table. Supports two modes: (1) LOCAL_FILE — creates an empty table with no cloud backing; rows are added later via upsert_reference_table_rows or append_reference_table_rows. (2
Create rum operationCreate a web-UI-configured RUM operation: the same object created by clicking "Create Operation" in the RUM Operations UI. An operation tracks a user journey (e.g. checkout) between a start event and
Create-saved-filterCreate a saved filter: a reusable, named set of targeting rules that feature flags can reference.
Delete datadog dashboardPermanently deletes a Datadog dashboard by ID. This action cannot be undone. Use search_datadog_dashboards first to find dashboard IDs.
Delete datadog published analysisUnpublishes a published analysis by ID. This removes the dataset and makes it no longer queryable.
Delete datadog security aap custom ruleDelete an AAP (App & API Protection) WAF custom rule by id. Works for any custom rule (blocking, monitoring, or trace-tagging — one rule space). IRREVERSIBLE: the rule cannot be restored, only re-crea
Delete datadog security detection rulesDelete one or more Cloud SIEM detection rules by ID. Only custom (non-default) rules can be deleted — default rules return 403. Each rule is authorised individually; rules the caller cannot edit appea
Delete datadog security findings automation ruleDelete a security findings automation rule. This permanently removes the rule. Use list_datadog_security_findings_automation_rules to find rule IDs first.
Delete datadog security suppressionDelete a security monitoring suppression rule in Datadog. This operation is irreversible: the suppression is removed immediately and cannot be restored. Call get_datadog_security_suppressions first to
Delete datadog security trace passlistDelete an AAP (App & API Protection) passlist/allowlist entry — also known as a WAF exclusion filter — by exclusion_filter_id. IRREVERSIBLE: the entry cannot be restored, only re-created. AAP traces o
Delete datadog skillDelete one of your own library skills from your organization's Skills Library — a separate, user-authored set of task guides, distinct from any built-in "Skills" your own agent tooling may already hav
Delete datadog spreadsheetPermanently delete a Datadog spreadsheet by ID. This action is irreversible.
Delete datadog workflowDelete a Datadog Workflow Automation workflow by ID. On success, the result contains `deleted: true` and the deleted `workflowId`. Always confirm with the user before invoking. Requires `confirm: true
Delete data observability monitor annotationsDelete Data Quality monitor annotations by id. Monitor IDs are stable request identifiers, but when a monitor name has already been resolved, use the name as the primary user-facing label and put the
Delete llmobs annotation queuePermanently delete an annotation queue **and everything in it** — its queued interactions and all human review labels recorded on them. Automations that feed the queue are detached. This cannot be und
Delete llmobs annotation queue interactionsRemove interactions from an annotation queue. **The annotations recorded on them are deleted too** — this discards review work, not just the queue entry. The underlying traces and spans are untouched.
Delete llmobs annotationsDelete annotations from a queue, discarding those review labels. The interactions stay queued and can be re-annotated. Best-effort per id: returns `deleted_annotation_ids` for what was removed and `er
Delete llmobs evaluatorDelete an LLM-judge evaluator configuration by name. Returns a not-found error if no evaluator with this name exists for the caller's org.
Delete llmobs experimentsDelete experiment runs by ID. The runs and their events stop appearing in LLM Observability. **Two-step**: PREVIEW (`confirmed=false`) → DELETE (`confirmed=true`). - `confirmed=false`: deletes nothing
Delete rum metricDelete a RUM custom metric by ID. Permanent and cannot be undone. Only custom metrics can be deleted (not OOTB metrics). **Always confirm the deletion with the user before calling. Never delete a metr
Delete rum operationPermanently delete a web-UI-configured RUM operation: the same object deleted by removing an operation in the RUM Operations UI. Identify it by operation_id (preferred) or name. This tool does NOT aff
Delete rum retention filterPermanently delete a RUM retention filter by ID. Retention filters control which RUM events are indexed and retained, so deleting one stops its matching events from being retained going forward. **Thi
Deployment gates onboardingConfigure a Datadog Deployment Gate for a project so a bad deployment is halted automatically. Call this tool to set up deployment gates, gate a deploy on monitors, block bad deploys, or add Datadog g
Detach datadog security findings ticketDetach security findings from their linked case (and any downstream Jira issue, ServiceNow ticket, or Linear issue). Since Jira/ServiceNow/Linear tickets are always linked via a case, detaching the ca
Devices onboardingStep-by-step instructions for adding initial Datadog RUM SDK to a project environment. This contains general instruction on how to enable the Datadog RUM SDK and all the features as session replay, lo
Docker onboardingInstalls and configures the Datadog Agent container to collect infrastructure metrics, container telemetry, APM traces, and logs. The agent runs as a Docker container alongside any workload on a Docke
Ecs onboardingStep-by-step instructions for adding initial Datadog Observability setup to ECS applications and configurations. You must first review the user's project and this tool's arguments (including any neste
Edit datadog notebookEdits an existing notebook. Can edit cells, metadata (name, template_variables, tags), or both. Look up widget reference schemas before constructing graph cells. Cell modes: (1) Full-replace (default)
Edit global variablesPartially edit a Synthetics global variable by id. Only name, description, tags (full array replace), and value (value + secure) are editable. Omitted fields are left unchanged; only the fields explic
Edit synthetics testsEdit the configuration of a Synthetics test. Use this tool to update the configuration of a test.
Execute codeExecute JavaScript in a sandbox with access to Datadog through the official TypeScript-SDK-shaped API and explicitly enabled code-exec extensions. Quick start: ```javascript import { client, v1 } from
Execute datadog workflowStart a new execution instance for a Datadog Workflow Automation workflow by ID. The workflow may be published or unpublished, and the selected base or draft spec must have an 'agent' trigger. Each su
Kubernetes onboardingStep-by-step instructions for adding initial Datadog Observability setup to Kubernetes applications and configurations. You must first review the user's project and this tool's arguments (including an
Linux onboardingInstalls and configures the Datadog Agent on a Linux host to collect infrastructure metrics, APM traces, and logs.
Llm observability onboardingStep-by-step instructions for adding initial Datadog LLM Observability (AKA, 'LLMObs') setup to applications with an LLM or AI agent. You must first review the user's project and this tool's arguments
Manage datadog error tracking issue commentsAdd, update, or delete a comment on a Datadog Error Tracking issue. Use action "add" to post a new comment, "update" to edit an existing comment, or "delete" to remove one. Markdown is supported in co
Mute datadog security findingsMute or unmute security findings. Muting suppresses a finding from alerts and dashboards without resolving it. Use analyze_datadog_security_findings or search_datadog_security_findings to find specifi
Publish datadog formPublish a specific draft version of a Datadog form, making it the active published version. Use get_datadog_form with version='latest' to find the current draft version number before publishing. Retur
Publish datadog workflowPublish a Datadog Workflow Automation workflow. If a saved draft exists, it replaces the base spec and is removed. Otherwise, the existing unpublished base is published.
Reorder datadog security findings automation rulesMove a security findings automation rule up or down in the evaluation order. Automation rules use first-match-wins semantics, so order matters. Use a large positions value (e.g. 1000) to move a rule t
Reorder rum retention filtersSet the full evaluation order of a RUM application's retention filters. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly af
Restore llmobs dataset versionRoll a dataset's records back to a previous version. The dataset's version is bumped and its live records are replaced with that version's records — records added since then stop being part of the dat
Retry datadog ci job⚠️ WRITE OPERATION — queues a retry for a failed CI job via Datadog's CI Action backend. Requires explicit user approval before running. Submits an async retry task for a specific job. Safety rails ap
Run synthetics testsTrigger on-demand runs for one or more existing Synthetics tests by public_id; optionally apply shared locations, headers, body, variables, or start URL overrides. Triggering is billable; call only af
Serverless onboardingStep-by-step instructions for instrumenting serverless workloads with Datadog. This tool helps configure Datadog metrics, server-side APM tracing, and logs for serverless platforms such as AWS Lambda,
Source map uploadsStep-by-step instructions for configuring source map uploads for a project to Datadog. You must first review the user's project and fill out as many arguments as possible before calling this tool. Onl
Studio onboardingStep-by-step instructions for adding Datadog Studio to a project. You must first review the user's project and fill out as many arguments as possible before calling this tool. Check project files and
Submit llmobs experiment eventsSubmit evaluation-metric events to an existing experiment. Each metric records a judged value and, when a span_id is provided, attaches to that experiment span. **Required per metric:** label, metric_
Submit mcp feedbackSubmit feedback about capabilities provided by this Datadog MCP server only. Do NOT submit feedback about other MCP servers or plugins (e.g. Atlassian, CodeSandbox, Slack, GitHub). After completing a
Sync-allocations-for-feature-flag-environmentSynchronize allocations for a feature flag in a specific environment. This tool supports FEATURE_GATE and CANARY allocations, including exposure schedules and guardrail metrics. If any existing alloca
Sync-experiment-allocations-for-feature-flag-environmentSynchronize allocations that include a FEATURE_GATE allocation linked to a standard experiment. Use this tool when the requested or existing full allocation set contains a FEATURE_GATE allocation link
Synthetics test wizardUse this tool to validate (preview) or create (create) a Synthetics API http test. Every test must be previewed and validated by the user before being created.
Test optimization onboardingStep-by-step instructions for adding Datadog Test Optimization setup this project. You must first review the user's project and this tool's arguments (including any nested arguments) and fill out as m
Unarchive-feature-flagUnarchive a previously archived feature flag, making it visible in the main list again. Provide featureFlagID or featureFlagKey (if both are given, featureFlagID wins).
Unarchive-saved-filterUnarchive a previously archived saved filter.
Unblock datadog security aap denylistRemove AAP (App & API Protection) denylist entry — stop blocking IP/user/user-agent. Mirrors UI "Unblock" button: POST past expiration on Security Response Entity, clears every attached response. Writ
Unpublish datadog workflowStop a Datadog Workflow Automation workflow from starting new automatic executions by unpublishing it, while preserving its base spec and any saved draft. This does not cancel executions already in pr
Update datadog error tracking issueUpdate an Error Tracking Issue in Datadog. Use this tool to change the state of an issue or update its assignee. At least one of state or assignee must be provided. The Issue ID can be obtained from t
Update datadog flaky test statesWrite operation: update the state of one or more flaky tests. Requires explicit user approval. States are quarantined (suppress failures), disabled (skip), fixed (mark resolved), and active (restore n
Update datadog formCreate a new draft version of a Datadog form, updating its schema and/or UI layout. The schema is unique, you must retrieve it using the `get_form_definition_schema` tool before attempting to make an
Update datadog monitorUpdates a SINGLE existing Datadog monitor identified by its numeric ID. Uses PATCH semantics: only the fields you provide are changed; all others are left as-is. This edits exactly ONE monitor per cal
Update datadog published analysisUpdates a published analysis (also called a published dataset) by re-syncing it with the current notebook cell definitions. A published analysis is a snapshot of a computational notebook's cells, expo
Update datadog security detection ruleUpdate an existing Cloud SIEM detection rule by PUTing the supplied payload to PUT /api/v2/security_monitoring/rules/{rule_id}. PUT replaces the rule wholesale — call `get_datadog_security_detection_r
Update datadog security findings automation ruleUpdate an existing security findings automation rule. Supports partial updates — only the fields you provide will be changed, other fields are preserved. Works for all rule types: mute, due_date, tick
Update datadog security ioc indicator triageSet the triage state of an IoC indicator. Each call appends an immutable audit row.
Update datadog security signals triageUpdate the triage state and/or assignee of security signals. The tool collects all matching signal IDs first, then applies updates in batches. Provide either signal_ids (for a known set of signals) or
Update datadog security suppressionUpdate an existing security monitoring suppression rule in Datadog. All fields except suppression_id are optional — only provided fields are changed. Call get_datadog_security_suppressions first to re
Update datadog skillUpdate one of your own library skills in your organization's Skills Library — a separate, user-authored set of task guides, distinct from any built-in "Skills" your own agent tooling may already have,
Update datadog workflowUpdate an existing Datadog Workflow Automation workflow by ID. Returns the updated workflow. A successful response confirms that the workflow was saved; it does not establish successful runtime behavi
Update data observability recommendation statusSets the lifecycle status of a Data Observability recommendation, e.g. to mark it applied (RESOLVED) or dismissed (IGNORED) after acting on it. Obtain the id from list_data_observability_recommendatio
Update entity descriptionSet or update the custom user-defined description for a data entity.
Update entity tagsAdd or remove custom user-defined tags on data entities. Tags are key:value strings. Returns updated tags for the specified entities.
Update-environmentReplace the attributes of an existing Feature Management environment. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canar
Update-feature-flag-environmentUpdate a feature flag in a specific environment by enabling/disabling it, changing the default variant, setting an override variant, or clearing an override variant. *** FEATURE FLAG DETECTION *** If
Update llmobs annotation label schemaReplace an annotation queue's label schema. **This is a full replacement, not a merge.** Read the current schema with **get_llmobs_annotation_label_schema**, apply your edits to that list, and send th
Update llmobs annotation queueEdit an annotation queue's name, description, or reviewer access. Only the fields you pass change; the rest keep their stored values. Returns the full updated `queue`. This tool cannot change labels —
Update llmobs experimentUpdate the mutable properties of an existing experiment. Provide only the fields you want to change; omitted fields are left untouched. At least one updatable field must be provided. Use **status** to
Update rum operationUpdate a web-UI-configured RUM operation in place: the same object edited by the RUM Operations UI's operation editor. Every field is optional except the identifier — only the fields you pass are chan
Update rum retention filterUpdate an existing RUM retention filter's attributes in place. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects bil
Update-saved-filterUpdate a saved filter's name, description, and/or targeting rules. Only provided fields change. Editing targeting rules propagates to every feature flag that references the filter.
Upsert datadog dashboardCreates or updates a Datadog ordered-grid dashboard. New dashboards are always ordered; widget updates are only supported on ordered dashboards. When updating widgets, prefer diff-style payloads to mi
Upsert datadog security aap custom ruleCreate or update an AAP (App & API Protection) WAF custom rule — a user-authored in-app WAF rule that matches request traffic and monitors or blocks it. Use for "block requests that…", "write a WAF ru
Upsert datadog security aap denylistAdd/refresh AAP (App & API Protection) denylist entry — block IP/user/user-agent via auto security response. Writes ASM_DATA + Remote Config; seconds-to-minutes propagation. Upsert by (entity_type, va
Upsert datadog security trace passlistCreate or update an AAP (App & API Protection) passlist/allowlist entry — also known as a WAF exclusion filter — that exempts traces from WAF analysis/blocking. AAP traces only; unrelated to Cloud SIE
Upsert datadog spreadsheetCreate or update a Datadog spreadsheet's tables, sheets, and pivots in a single call. Always create pivots embedded within a sheet (in sheets[].pivots), not as standalone tabs. To delete the spreadshe
Upsert data observability monitor annotationsCreate, update, or extend Data Quality monitor annotations. Monitor IDs are stable request identifiers, but when a monitor name has already been resolved, use the name as the primary user-facing label
Upsert llmobs annotationsWrite label values onto interactions queued in an annotation queue — the graded judgement itself. Read the queue's labels with **get_llmobs_annotation_label_schema** first: values are keyed by `label_
Upsert reference table rowsInsert new rows or update existing rows in a reference table. If a row with the same primary key already exists its values are overwritten; if it does not exist it is created. Composite primary keys a
Upsert rum metricCreate or update a RUM custom metric. If the metric does not exist it is created; if it already exists its mutable fields (filter, group_by, include_percentiles) are updated. IMMUTABLE after creation:

Changes wait in Needs you

Changes and sends in Datadog MCP are held for a person's approval by default. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.

How approvals work

Datadog MCP questions

Can an agent change data in Datadog MCP on its own?

Not by default. Changes and sends in Datadog MCP are held for a person's approval. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.

What can an agent read in Datadog MCP?

This connector lists 245 read actions. Reads run at once, without waiting for approval.

How does Datadog MCP connect?

It connects with dcr oauth. Connectors are built and maintained by third-party developers; availability is confirmed during scoping.

Bring Datadog MCP to your agents.

Book a discovery call