The following tools are available in the Datadog MCP Server. Each entry includes the required toolset, permissions, and example prompts. Tools are grouped by toolsets, which allow you to use only the tools you need, saving valuable context window space.

?toolsets=apm,llmobs

See Set Up the Datadog MCP Server for more information on connecting to the MCP Server, enabling toolsets, and omitting specific tools.

Core tools

The default toolset for logs, metrics, traces, dashboards, monitors, incidents, hosts, services, events, and notebooks.

search_datadog_events

Toolset: core
Permissions Required: Events and Timeseries
Searches events like monitor alerts, deployment notifications, infrastructure changes, security findings, and service status changes.

• Show me all deployment events from the last 24 hours.
• Find events related to our production environment with error status.
• Get events tagged with service:api from the past hour.

Note: See the Event Management API for more details.

get_datadog_incident

Toolset: core
Permissions Required: Incidents Read
Retrieves detailed information about an incident.

• Get details for incident ABC123.
• What’s the status of incident ABC123?
• Retrieve full information about the Redis incident from yesterday.

Note: The tool is operational, but does not include incident timeline data.

get_datadog_metric

Toolset: core
Permissions Required: Cloud Cost Management Read or Metrics or Timeseries
Queries and analyzes historical or real-time metric data, supporting custom queries and aggregations.

• Show me CPU utilization metrics for all hosts in the last 4 hours.
• Get Redis latency metrics for the production environment.
• How much did my cloud costs change from January to February?

get_datadog_metric_context

Toolset: core
Permissions Required: Cloud Cost Management Read or Metrics
Retrieves detailed information about a metric or derived metric, including metadata, available tags, and tag values for filtering and grouping.

• What tags are available for the system.cpu.user metric?
• Show me all possible values for the env tag on redis.info.latency_ms.
• Get metadata and dimensions for the requests.count metric.

search_datadog_monitors

Toolset: core
Permissions Required: Monitors Read
Retrieves information about Datadog monitors, including their statuses, thresholds, and alert conditions.

• List all monitors that are currently alerting.
• Show me monitors related to our payment service.
• Find monitors tagged with team:infrastructure.

get_datadog_trace

Toolset: core
Permissions Required: APM Read
Fetches a complete trace from Datadog APM using a trace ID.

• Get the complete trace for ID 7d5d747be160e280504c099d984bcfe0.
• Show me all spans for trace abc123 with timing information.
• Retrieve trace details including database queries for ID xyz789.

Note: Large traces with thousands of spans may be truncated (and indicated as such) without a way to retrieve all spans.

search_datadog_dashboards

Toolset: core
Permissions Required: Dashboards Read and User Access Read
Lists available Datadog dashboards and key details.

• Show me all available dashboards in our account.
• List dashboards related to infrastructure monitoring.
• Find shared dashboards for the engineering team.

Note: This tool lists relevant dashboards but provides limited detail about their contents. Use get_datadog_dashboard to retrieve full widget definitions.

get_datadog_notebook

Toolset: core
Permissions Required: Notebooks Read
Retrieves detailed information about a specific notebook by ID, including name, status, and author.

• Get details for notebook abc-123-def.
• Show me the contents of the debugging notebook from yesterday.

search_datadog_notebooks

Toolset: core
Permissions Required: Notebooks Read
Lists and searches Datadog notebooks with filtering by author, tags, and content.

• Show me all notebooks created by the platform team.
• Find notebooks related to performance investigation.
• List notebooks tagged with incident-response.

delete_datadog_notebook

Toolsets: core, notebooks
Permissions Required: Notebooks Write
Soft-deletes a notebook by its numeric ID. Use recover_datadog_notebook to restore it within 30 days of deletion.

• Delete notebook 12345678.
• Delete the notebook with ID 12345678 that I created for testing.

recover_datadog_notebook

Toolsets: core, notebooks
Permissions Required: Notebooks Write
Restores a soft-deleted notebook by its numeric ID. The notebook can be restored only within 30 days of deletion.

• Recover notebook 12345678.
• Restore the notebook with ID 12345678 that I deleted by mistake.

search_datadog_hosts

Toolset: core
Permissions Required: Hosts Read and Timeseries
Lists and provides information about monitored hosts, supporting filtering and searching.

• Show me all hosts in our production environment.
• List unhealthy hosts that haven’t reported in the last hour.
• Get all hosts tagged with role:database.

search_datadog_incidents

Toolset: core
Permissions Required: Incidents Read
Retrieves a list of Datadog incidents, including their state, severity, and metadata.

• Show me all active incidents by severity.
• List resolved incidents from the past week.
• Find incidents that are customer-impacting.

search_datadog_metrics

Toolset: core
Permissions Required: Metrics
Lists available metrics, with options for filtering and metadata.

• Show me all available Redis metrics.
• List CPU-related metrics for our infrastructure.
• Find metrics tagged with service:api.

search_datadog_entities

Toolset: core
Permissions Required: Service Catalog Read
Searches Datadog’s Catalog for service identity, ownership and upstream and downstream dependencies.

• Find services related to payment processing.
• List services owned by the platform team.
• Show me all upstream services that call the checkout service.
• What downstream services does the payment API depend on?

search_datadog_spans

Toolset: core
Permissions Required: APM Read
Retrieves spans from APM traces with filters such as service, time, resource, and so on.

• Show me spans with errors from the checkout service.
• Find slow database queries in the last 30 minutes.
• Get spans for failed API requests to our payment service.

aggregate_spans

Toolset: core
Permissions Required: APM Read
Aggregates APM spans to compute counts, sums, averages, minimums, maximums, cardinality, and percentiles (p50 to p99). Group results by fields such as service or resource, or set group_by.interval in milliseconds to return a timeseries.

• What is the p95 duration by resource for the checkout service over the last hour?
• Show me request counts for the payments service in 5-minute buckets over the last day.
• Count errors grouped by endpoint and status code for service:web-store.

analyze_datadog_logs

Toolset: core
Permissions Required: Logs Read Data and Logs Read Index Data and Timeseries
Analyze Datadog logs using SQL queries for counting, aggregations, and numerical analysis. Use this for statistical analysis.

• Count error logs by service in the last hour.
• Show me the top 10 HTTP status codes with their counts.
• Which services were logging the most during that time period?

search_datadog_logs

Toolset: core
Permissions Required: Logs Read Data and Logs Read Index Data
Searches logs with filters (time, query, service, host, storage tier, and so on) and returns log details. Renamed from get_logs.

• Show me error logs from the nginx service in the last hour.
• Find logs containing ‘connection timeout’ from our API service.
• Get all 500 status code logs from production.

search_datadog_rum_events

Toolset: core, rum
Permissions Required: RUM Apps Read
Search Datadog RUM events using advanced query syntax.

• Show JavaScript errors and console warnings in RUM.
• Find pages that are loading slowly (more than 3 seconds).
• Show recent user interactions on product detail pages.

aggregate_rum_events

Toolset: core, rum
Permissions Required: RUM Apps Read
Aggregates RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles, with grouping support. Use this for statistical analysis and trend data, not for inspecting individual events.

• Count JavaScript errors by page in the last 24 hours.
• Show me the p95 loading time grouped by country for my main RUM application.
• How many sessions had a Core Web Vitals failure this week?

create_datadog_notebook

Toolset: core
Permissions Required: Notebooks Read and Notebooks Write
Creates a new Datadog notebook.

• Create a notebook to document the investigation into the checkout service latency spike.
• Make a new notebook for our weekly performance review.

edit_datadog_notebook

Toolset: core
Permissions Required: Notebooks Read and Notebooks Write
Edits an existing Datadog notebook.

• Add a section to notebook abc-123-def with the latest log analysis results.
• Update the incident response notebook with today’s findings.

Agent Builder

Tools for Bits Agent Builder, including creating and configuring custom AI agents, managing their Datadog-managed MCP servers, running agents, and inspecting their conversations.

Workflow Automation tools are used to configure workflows that invoke an agent. Agents do not schedule or trigger themselves. Use a workflow to run an agent on a schedule, in response to a monitor, or as part of a sequence of steps.

Connect or disconnect OAuth MCP integrations through the Datadog UI.

list_datadog_bits_agents

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read
Lists the custom AI agents in your organization, including each agent’s ID, name, description, and model. Use get_datadog_bits_agent for the complete configuration.

• List the Bits agents in this organization.
• Find the agent that investigates checkout service errors.

get_datadog_bits_agent

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read and Workflows Read
Retrieves an agent by ID, including its system prompt, action tools, MCP servers, and the workflows that invoke it. Use get_datadog_workflow to inspect a workflow’s complete specification.

• Show the system prompt and tools configured for the checkout investigation agent.
• Which workflows invoke this agent?

list_datadog_bits_agent_models

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read or Bits Agent Builder Write\

Lists supported model identifiers, identifies the default, and notes capabilities such as tool search support. Use these identifiers when creating or updating an agent.

• Which models are available for a Bits agent?
• Show the default model and models that support tool search.

create_datadog_bits_agent

Toolset: agent-builder
Permissions Required: Bits Agent Builder Write
Creates a persistent custom AI agent from a name and system prompt. Optionally, provide a description, model, action tools, and a code-sandbox MCP server. The datadog MCP server is attached automatically with full tool access. Look up action identifiers and input schemas with search_datadog_workflow_actions and get_datadog_workflow_action before adding action tools.

• Create an agent that investigates checkout service errors using logs, metrics, and traces.
• Create an agent that summarizes service health and can send its findings to a Slack channel.

update_datadog_bits_agent

Toolset: agent-builder
Permissions Required: Bits Agent Builder Write
Updates an agent’s name, description, system prompt, model, or action tools. Omitted fields remain unchanged. Providing action_tools replaces the complete list. An empty array clears it. Set dry_run: true to preview changes. To change an agent’s MCP configuration, use add_datadog_managed_mcp_server_to_bits_agent or remove_datadog_managed_mcp_server_from_bits_agent.

• Update the checkout investigation agent’s instructions to include deployment events.
• Preview changing this agent to the default model returned by list_datadog_bits_agent_models.

list_datadog_bits_agent_mcp_tools

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read
Lists the tools exposed by the datadog or code-sandbox MCP server for a specific agent. Returns the full catalog available to your organization, regardless of the agent’s allowed_tools restrictions. Use the returned names when restricting tools. For capabilities absent from the catalog, use search_datadog_workflow_actions to search the Workflow Automation action catalog.

• List the Datadog MCP tools available for this agent.
• Check which MCP tools are available before restricting the agent’s access.

add_datadog_managed_mcp_server_to_bits_agent

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read and Bits Agent Builder Write
Adds or reconfigures the datadog or code-sandbox MCP server on an agent, preserving its OAuth MCP integrations. If the named server already exists, this tool replaces its configuration. An empty allowed_tools list permits all tools. For code-sandbox, provide repo_urls for repositories connected through the Source Code integration. Set dry_run: true to preview changes.

• Restrict this agent’s Datadog MCP server to selected tools from list_datadog_bits_agent_mcp_tools.
• Add a code sandbox for the connected repository github.com/example/checkout.

remove_datadog_managed_mcp_server_from_bits_agent

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read and Bits Agent Builder Write
Removes the datadog or code-sandbox MCP server from an agent, preserving its OAuth MCP integrations. If the server is not configured, the agent remains unchanged. Set dry_run: true to preview changes.

• Remove the code sandbox from the checkout investigation agent.
• Preview removing this agent’s Datadog MCP server.

run_datadog_bits_agent

Toolset: agent-builder
Permissions Required: Bits Agent Builder Run
Starts an agent with a user prompt and returns a conversation_id immediately while the agent runs in the background. Each call starts a separate conversation. This tool cannot add messages to an existing conversation. Poll get_datadog_bits_agent_conversation_events to retrieve the response.

• Run the checkout investigation agent to investigate the error spike from the past hour.
• Ask the service health agent to summarize the payments service’s current status.

list_datadog_bits_agent_conversations

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read
Lists an agent’s past conversations, including IDs and titles. Use the returned IDs with get_datadog_bits_agent_conversation_events to inspect their history.

• List past conversations for the checkout investigation agent.
• Find the conversation from the last service health investigation.

get_datadog_bits_agent_conversation_events

Toolset: agent-builder
Permissions Required: Bits Agent Builder Read
Retrieves a conversation’s event history using its agent_id and conversation_id, including prompts, agent messages, tool calls, tool results, and errors. Filter with event_types, or omit it to return all events. After starting a run, poll until a final_response event indicates success or an application_error event indicates failure.

• Retrieve the response from the latest agent run.
• Show the tool calls and results from this investigation.
• Check whether this conversation has a final response or an application error.

Alerting

Tools for validating monitors, searching monitor groups, and retrieving monitor templates.

validate_datadog_monitor

Toolset: alerting
Permissions Required: Monitors Read
Validates a monitor definition for correctness before creating or updating it.

• Validate this monitor definition before I create it.
• Check if my monitor query syntax is correct.

get_datadog_monitor_templates

Toolset: alerting
Permissions Required: Monitors Read
Retrieves available monitor templates to help you create monitors.

• Show me the available monitor templates.
• What templates can I use to create a new monitor?

search_datadog_monitor_groups

Toolset: alerting
Permissions Required: Monitors Read
Searches monitor groups by name or criteria.

• Show me all monitor groups in an alerting state.
• Find monitor groups related to the checkout service.

search_datadog_slos

Toolset: alerting
Permissions Required: SLOs Read
Searches Datadog SLOs by name, tags, or type. Supports query syntax for filtering by service, team, or other attributes.

• Search for SLOs related to service:checkout.
• List all SLOs tagged with team:backend.
• List SLOs for the payments service.

create_datadog_monitor

Toolset: alerting
Permissions Required: Monitors Write
Creates a Datadog monitor in draft mode. Monitors created with this tool do not send notifications and are set to priority 5 (low). Use validate_datadog_monitor to check the definition before creating and get_datadog_monitor_templates for query syntax examples. After creation, publish the monitor in the Datadog UI.

• Create a metric alert monitor for high CPU usage on the web service.
• Set up a log alert monitor for error spikes in the payments service.
• Create a monitor to track p95 latency for the checkout endpoint.

get_monitor_coverage

Toolset: alerting
Permissions Required: Monitors Read
Finds monitoring gaps and coverage for services or hosts. Returns which signals (such as error rate, latency, and request rate) are covered by existing monitors and which are missing. Use with create_datadog_monitor to fill gaps.

• Get monitoring coverage for service:checkout.
• What monitoring gaps exist for host:web-01?
• Find services that are missing error rate monitors.

APM

Tools for in-depth APM trace analysis, service health, performance investigation, recommendations, and managing sampling and service remapping rules.

apm_query_trace

Toolset: apm
Permissions Required: APM Read
Runs a read-only SQL query against a trace’s spans to answer a specific question, such as ranking spans by self-time or isolating one span’s attributes. Complements get_datadog_trace, which shows a trace’s overall shape.

• Which service accounted for the most self-time in trace abc123?
• Get the attributes for span xyz789 along with the root span’s attributes.
• How many database calls happened in this trace, and which one took the longest?
• Which of the child spans under span xyz789 was slowest?

apm_discover_span_tags

Toolset: apm
Permissions Required: APM Read
Discovers available tag keys on spans within a time range.

• What tags are available on spans for service:checkout?
• Show me the tag keys I can filter by in APM.

apm_get_primary_tag_keys

Toolset: apm
Permissions Required: APM Read
Retrieves the primary tag keys configured for the organization.

• What are my organization’s primary tag keys?

apm_get_service_health

Toolset: apm
Permissions Required: APM Read
Retrieves the current health status (ok/warning/critical) for one or more APM services plus the signals driving it (paging monitors, incidents, Watchdog anomalies, DBM regressions). Returns present state only; no historical trends.

• Check the health of the checkout and payment services in staging.
• We rolled out a fix to the checkout service in prod. Show me the current status.

apm_latency_bottleneck_summary

Toolset: apm
Permissions Required: APM Read
Analyzes latency bottlenecks across traces in an anomaly period using self-time calculations. Identifies which service and resource combinations consume the most self-time, detects cascading call patterns, and surfaces root causes of latency spikes.

• Summarize the latency bottlenecks for the checkout service between 2pm and 3pm today.
• What is consuming the most self-time in the payments service during this latency spike?
• Identify which endpoints are the top bottlenecks for service:api between 10:00 and 10:30.

apm_search_recommendations

Toolset: apm
Permissions Required: APM Read
Searches for APM recommendations from Datadog.

• Show me APM recommendations for my services.
• Are there any optimization suggestions for my application?

apm_get_recommendation

Toolset: apm
Permissions Required: APM Read
Retrieves full details of a specific APM recommendation by ID.

• Get the details of recommendation abc123.

search_apm_sampling_rules

Toolset: apm
Permissions Required: APM Remote Configuration Read
Lists remote sampling rules that set a fixed sample rate for spans matching a service, environment, and resource. Filter by service, environment, or both.

• Show me the sampling rules for the checkout service in prod.
• List all remote sampling rules in my organization.

create_apm_sampling_rule

Toolset: apm
Permissions Required: APM Remote Configuration Read and APM Remote Configuration Write
Creates a remote sampling rule that sets a sample rate for a service, environment, and resource, with no redeploy needed. A low rate can drop most of a service’s traces. If a rule already exists for that target, use update_apm_sampling_rule instead. The tool requires explicit confirmation before it creates the rule.

• Sample 10% of GET /health spans for the checkout service in prod.
• Keep all traces for the POST /payments resource on the payments service in staging.

update_apm_sampling_rule

Toolset: apm
Permissions Required: APM Remote Configuration Read and APM Remote Configuration Write
Changes the sample rate of an existing remote sampling rule, identified by its service, environment, and resource. To change the rule’s target, delete the rule and create a new one. The tool requires explicit confirmation before it applies changes.

• Raise the sample rate for GET /api/orders on the orders service in prod to 50%.
• Lower the sample rate for the checkout service’s health check endpoint to 1%.

delete_apm_sampling_rule

Toolset: apm
Permissions Required: APM Remote Configuration Read and APM Remote Configuration Write
Permanently deletes a remote sampling rule, identified by its service, environment, and resource. Matching spans fall back to the next applicable sampling mechanism. The tool requires explicit confirmation before it deletes the rule. This operation is idempotent.

• Remove the sampling rule for GET /health on the checkout service in prod.

search_apm_service_remapping_rules

Toolset: apm
Permissions Required: APM Read
Lists the organization’s service remapping rules in evaluation order, or retrieves one rule by ID. Each result includes the rule’s filter, new name, and current version.

• List all service remapping rules in my organization.
• Which remapping rule renames the postgres inferred service?

create_apm_service_remapping_rule

Toolset: apm
Permissions Required: APM Read and APM Service Remapping Write
Creates a service remapping rule that renames services or inferred entities on matching spans, which changes how they appear across APM, monitors, and dashboards. New rules are evaluated after existing rules. You can also specify a different tag for the rule to rewrite. The tool requires explicit confirmation before it creates the rule.

• Rename the inferred database service postgres to orders-db for spans from the orders service.
• Create a remapping rule that renames web-store-v2 to web-store.

update_apm_service_remapping_rule

Toolset: apm
Permissions Required: APM Read and APM Service Remapping Write
Updates an existing service remapping rule’s name, filter, the name it assigns to matching services or inferred entities, or the tag it rewrites (service or peer.service by default). The rule type cannot be changed, and rules with multiple rewrite mappings must be edited in Datadog instead. The tool requires explicit confirmation before it applies changes.

• Update the orders-db remapping rule to also match spans from the fulfillment service.
• Update the web-store remapping rule to rename matching services to storefront.

reorder_apm_service_remapping_rules

Toolset: apm
Permissions Required: APM Read and APM Service Remapping Write
Sets the evaluation order of all service remapping rules. The first matching rule applies, so order determines which rule wins when a span matches more than one. The tool requires explicit confirmation before it applies changes.

• Move the orders-db remapping rule ahead of the generic database rule.

delete_apm_service_remapping_rule

Toolset: apm
Permissions Required: APM Read and APM Service Remapping Write
Permanently deletes a service remapping rule by ID. New spans that matched the rule keep their original service name. Data that’s already indexed doesn’t change. The tool requires explicit confirmation before it deletes the rule. This operation is idempotent.

• Delete the web-store service remapping rule.

Assistant

Tools for interacting with Bits Chat, the AI-powered companion that helps you search and act across Datadog using natural language.

Note: The assistant toolset does not support mutating actions, such as creating, editing, or deleting Datadog resources. To perform those actions, use the specific product toolset instead, for example dashboards or alerting.

send_message_to_assistant

Toolset: assistant
Permissions Required: Bits Chat Access
Sends a message to the Datadog Assistant and returns its response. Optionally continues an existing conversation by providing a conversation_id.

• Ask the assistant what’s causing the latency spike on the checkout service.
• Continue conversation abc-123-def and ask the assistant for next steps.
• Ask the assistant to summarize open P1 incidents, with debug mode enabled.

get_assistant_conversation_history

Toolset: assistant
Permissions Required: Bits Chat Access
Retrieves the full conversation history for a specific assistant conversation by its ID.

• Get the full conversation history for conversation abc-123-def.
• Show me everything the assistant said in my last conversation about the payment outage.

list_assistant_conversations

Toolset: assistant
Permissions Required: Bits Chat Access
Lists all Datadog Assistant conversations for the current user.

• List all my past conversations with the Datadog Assistant.
• Show me my most recent assistant conversations.

Audit Trail

Tools for Audit Trail, including searching and retrieving Audit Trail events and forming Audit Trail search queries.

search_audit_events

Toolset: audit-trail
Permissions Required: Audit Trail Read
Searches for Audit Trail events using Datadog query syntax with support for pagination. Use when you need to find and filter events by specific attributes. Returns Audit Trail events without metadata and previous or new asset values unless requested.

• Who deleted the monitor abc123?
• Have there been any failed Datadog login attempts in the past week?
• Search Audit Trail to see if there were any API key leak notifications this month.

list_audit_events

Toolset: audit-trail
Permissions Required: Audit Trail Read
Lists Audit Trail events over a time window with support for pagination and an optional query. Use to scan recent Audit Trail events. Returns Audit Trail events without metadata and previous or new asset values unless requested.

• Show me Audit Trail events for the past hour.

build_audit_trail_query

Toolset: audit-trail
Permissions Required: Audit Trail Read
Translates a natural-language description into an Audit Trail query string. If you are uncertain of query syntax when searching Audit Trail events, use this tool first with a description of the events you would like to retrieve, then pass the returned query and timestamps directly into search_audit_events.

• Provide an Audit Trail query to see who created new monitors in the past 2 weeks.
• Create an Audit Trail query to show when the dashboard abc123 was deleted.
• Generate an Audit Trail query to check which actions were executed through the Datadog MCP server.

Cases (Work Management)

Tools for Work Management, including creating, searching, and updating work items; managing projects; linking work items to each other and to Jira issues; and managing attachments.

Work items are also called cases. The tool names, the case_id argument, and the keys these tools return (for example, CASE-1234) all use case. You can refer to either term in your prompts.

search_datadog_cases

Toolset: cases
Permissions Required: Cases Read
Searches Work Management work items (cases) with filters including status, priority, project, and assignee. Supports time range filtering and pagination.

• Show me all open work items assigned to me.
• Are there any open P1 cases in the Security Reviews project?
• Show me all cases opened this week related to the payment service.

get_datadog_case

Toolset: cases
Permissions Required: Cases Read
Retrieves detailed information about a specific work item (case) by ID or key, including title, status, priority, assignee, and timestamps. Optionally includes timeline activity (comments and status changes) and custom attributes.

• What’s the latest update on CASE-1234? Show me the full timeline.
• Who’s working on this case and what progress has been made so far?
• Pull up the details and all comments for the database migration case.

create_datadog_case

Toolset: cases
Permissions Required: Cases Write and Cases Read
Creates a new Work Management work item (case) with a title, project, and optional fields like description, priority, and assignee. The project can be given as a project key, a project name, or a project ID.

• I’m seeing a latency spike on the checkout service. Create a P2 work item to track the investigation.
• Open a security review case for the suspicious login activity we found in the logs.

update_datadog_case

Toolset: cases
Permissions Required: Cases Write and Cases Read
Updates an existing work item (case): status, priority, title, description, assignee, due date, and custom attributes. Only the fields you provide are updated.

• This issue is now customer-impacting. Escalate CASE-1234 to P1.
• Mark the database migration case as resolved.
• Set a due date for end of week on CASE-1234.

add_comment_to_datadog_case

Toolset: cases
Permissions Required: Cases Write
Adds a comment to a work item (case) timeline. Comments support markdown formatting.

• Add a note to the work item summarizing what we found in the logs and traces.
• Post an update that the hotfix has been deployed and we’re monitoring.
• Document the root cause analysis findings on this case.

attach_file_to_datadog_case

Toolset: cases (Preview)
Permissions Required: Cases Write and Cases Read
Uploads a file of up to 10 MiB and attaches it to a work item (case). The attachment remains in processing while Work Management validates it.

• Attach the incident timeline I exported to CASE-1234.
• Upload this screenshot of the error to the checkout latency work item.

get_datadog_case_attachment

Toolset: cases (Preview)
Permissions Required: Cases Read
Lists the attachments on a work item (case), or retrieves the contents of a specific attachment by ID.

• What files are attached to CASE-1234?
• Show me the screenshot attached to the database migration case.

link_jira_issue_to_datadog_case

Toolset: cases (Preview)
Permissions Required: Cases Write

• Link the Jira ticket for the infrastructure migration to this case so we can track both together.
• Connect PROJ-456 to the Datadog case so the engineering team has visibility.

link_datadog_cases

Toolset: cases
Permissions Required: Cases Write and Cases Read
Creates a directional link between two work items (cases). The relationship is stated from the parent’s perspective, and can be RELATES_TO, CAUSES, BLOCKS, DUPLICATES, PARENT_OF, or SUCCESSOR_OF.

• Mark CASE-1234 as blocking CASE-5678.
• CASE-910 duplicates CASE-1234. Link them.

get_datadog_case_links

Toolset: cases
Permissions Required: Cases Read
Lists all links for a work item (case), including each link’s ID, relationship type, and the work items on each side.

• What other work items are linked to CASE-1234?
• Is anything blocking the database migration case?

unlink_datadog_cases

Toolset: cases
Permissions Required: Cases Write
Removes a link between two work items (cases) by link ID. Use get_datadog_case_links to find the link ID.

• CASE-1234 no longer blocks CASE-5678. Remove that link.

list_datadog_case_projects

Toolset: cases
Permissions Required: Cases Read
Lists available Work Management projects with optional filtering by name or key.

• What projects are available in Work Management?
• Is there a project related to security in Work Management?

get_datadog_case_project

Toolset: cases (Preview)
Permissions Required: Cases Read
Retrieves details for a specific project by ID.

• What project is this work item part of?

create_datadog_case_project

Toolset: cases (Preview)
Permissions Required: Cases Write
Creates a Work Management project with default settings, given a name and an uppercase key used as the prefix for work items in the project.

• Create a Work Management project called Platform Reliability with the key PLAT.

search_datadog_users

Toolset: cases
Permissions Required: User Access Read
Searches for Datadog users by email, name, or handle. Useful for finding the right person to assign a work item to.

• Find the Datadog user account for jane.doe@example.com.

Cloud Cost Management

Tools for Cloud Cost Management, including listing cost-saving recommendations ranked by estimated potential daily savings.

cost_recommendations

Toolset: cost
Permissions Required: Cloud Cost Management Read
Lists an organization’s Cloud Cost Management cost-saving recommendations, ranked by estimated potential daily savings (highest first). Supports faceted filtering by cloud provider, recommendation type, status, savings threshold, and resource tags, along with pagination and a summary of the total count and total potential daily savings.

Examples of queries:

• What are my top cloud cost-saving recommendations?
• How much could I save per day, and how many open recommendations do I have?
• Which of our Kubernetes cluster optimizations does the team already have underway?

Cloud Resources

Tools for looking up a cloud resource in the Resource Catalog by its cloud resource ID, across AWS, Azure, Google Cloud, and OCI.

get_cloud_resource_details

Toolset: cloud-resources
Permissions Required: Hosts Read or DDSQL Editor Read
Gets the configuration and metadata that Datadog records for a single cloud resource. Identify the resource by its cloud resource ID: an AWS ARN, an Azure resource ID, a Google Cloud resource name, or an OCID. Returns the resource’s account, region, tags, and provider configuration. Use this tool when you have a cloud resource ID and need the details behind it. To find resources by attribute, use a search tool instead. If the resource is not in the Resource Catalog, the tool reports that it was not found. This can mean the resource was deleted, was never ingested, or is not a supported type.

• Which team owns arn:aws:rds:us-east-1:123456789012:db:payments-primary?
• What account and region is this resource in: arn:aws:ec2:us-east-1:123456789012:instance/i-0abc123def4567890?
• Show me the configuration of this Azure resource: /subscriptions/0000/resourceGroups/prod/providers/Microsoft.Compute/virtualMachines/web-01.
• What tags are set on this resource, and is it owned by a team?

Code Execution

Tools for running agent-authored JavaScript in a Datadog-managed sandbox with direct access to Datadog APIs, for multi-signal investigation and ad-hoc data exploration in one call. See Code Execution with the MCP Server for more information on how this toolset works and when to use it.

Code executed by this toolset runs against your Datadog APIs using your own user identity. The sandbox applies your existing role permissions to every API call, so an agent can only read or modify data that you can already access in Datadog.

execute_code

Toolset: code-exec
Permissions Required: Any product-specific role permissions needed to access the underlying Datadog resources the executed code interacts with (for example, Logs Read to read logs).
Executes AI agent-authored JavaScript in a Datadog-managed sandbox. The code receives a dd.* namespace with helpers for querying logs, metrics, traces, services, change events, incidents, monitors, dashboards, and other Datadog APIs, and returns a structured value back to the agent. This can reduce the number of round-trips needed for multi-signal investigations and ad-hoc data exploration.

• For the checkout-api service in the last two hours, pull error logs, latency metrics, and recent deployments together and tell me which deployment lines up with the error spike.
• Compare error-span counts, monitor alerts, and config changes for the payments service over the last day, and identify anything that moved at the same time.
• For auth-service, correlate the top error patterns in logs with CPU and memory metrics from the last hour to see whether errors track resource pressure.

search_datadog_sdk

Toolset: code-exec
Permissions Required: None
Looks up the SDK functions, types, and API methods available for writing execute_code scripts. Call this before writing a script to confirm which methods exist and their signatures.

• What SDK methods are available for querying logs in a script?
• Show me the available methods for aggregating spans.
• What does the dd.time namespace provide?

Dashboards

Tools for retrieving, creating, updating, and deleting dashboards, plus widget schema reference and validation.

get_datadog_dashboard

Toolset: core, dashboards
Permissions Required: Dashboards Read and User Access Read
Retrieves a Datadog dashboard by ID, returning its title, description, tags, and widgets. Use search_datadog_dashboards first to find dashboard IDs.

• Get the full details of dashboard ps7-mn3-kwf.
• Show me the widgets and layout of the infrastructure overview dashboard.
• Retrieve the template variables configured on this dashboard.

upsert_datadog_dashboard

Toolset: core, dashboards
Permissions Required: Dashboards Read and Dashboards Write
Creates or updates a Datadog dashboard. To update an existing dashboard, provide the dashboard ID; omit it to create a new one. Call get_widget_reference for widget schemas before building widgets.

• Create a dashboard showing CPU and memory usage across all hosts.
• Add a timeseries widget for error rate to dashboard abc-123-def.
• Update the title and description of my service overview dashboard.

delete_datadog_dashboard

Toolset: dashboards
Permissions Required: Dashboards Read and Dashboards Write
Permanently deletes a Datadog dashboard by ID. This action cannot be undone. Use search_datadog_dashboards first to find dashboard IDs.

• Delete dashboard ps7-mn3-kwf.
• Remove the old staging environment dashboard.

get_widget_reference

Toolset: dashboards
Permissions Required: Dashboards Read or Dashboards Write or Notebooks Read
Returns schemas and building instructions for dashboard widget types. Widget definitions are JSON objects; this tool returns TypeScript type definitions representing their schemas along with building instructions covering query patterns, formula syntax, and common pitfalls. Call this before generating widgets with upsert_datadog_dashboard.

• Get the schema for a timeseries widget.
• Show me how to build a toplist and a query table widget.
• What’s the schema for the scatterplot widget?

validate_dashboard_widget

Toolset: dashboards
Permissions Required: Dashboards Read or Dashboards Write or Notebooks Read
Validates a widget definition against the dashboard schema. Use this to check widget JSON before passing it to upsert_datadog_dashboard.

• Validate my timeseries widget definition before creating the dashboard.
• Check if this query table widget JSON is correct.

ask_widget_expert

Toolset: dashboards
Permissions Required: Dashboards Read or Dashboards Write or Notebooks Read
Ask a Datadog widget expert a question about widget configuration, schemas, query syntax, field usage, debugging, or pitfalls. Best for targeted questions: schema lookups, field clarifications, debugging an existing widget definition, or understanding how a specific widget type works.

• What response_format should I use for a toplist?
• What’s the schema for the scatterplot widget?
• Help me debug why this widget is showing fractional values when it should be a count.
• How do I configure a timeseries to show both bars and lines?

Data Observability

Tools for Data Observability, including data catalog search, lineage analysis, data quality monitoring, and cost and performance recommendations for data warehouses and Spark jobs.

search_data_entities

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Searches for data entities in the data catalog by name, full-text search, or filters (platform, schema, database, account).

• Find tables named “orders” in Snowflake.
• List all dbt models starting with stg_.
• What schemas exist in my BigQuery project?

get_data_catalog_schema

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Returns the entity type schema for every platform with data in the catalog: entity types, containment hierarchy, filterable attributes, and default metrics.

• What platforms are connected to Data Observability?
• What entity types exist for Databricks?
• What metrics are available for a table entity?

get_data_entity_details

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Fetches full details and attributes (owner, tags, custom attributes, platform, schema, database, account) for one or more data entities by ID.

• Get the full attributes for this table entity.
• Who owns this dataset?

get_data_entity_hierarchy

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Fetches the containment hierarchy (ancestors and descendants) for one or more entities — for example, which database or schema a table belongs to, or which tables are in a schema.

• What database does this table belong to?
• What columns are in this table?
• Show the full hierarchy around this entity.

get_data_entity_lineage

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Fetches the live reachable lineage subgraph (nodes and edges) from one or more anchor entities, upstream, downstream, or both.

• What’s downstream of this table?
• Show me the upstream lineage for this column.
• What would break if I dropped this table?

summarize_data_entity_lineage

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Returns aggregate lineage statistics (node/edge counts, type breakdowns, depth distribution) for a large or unknown lineage graph, without the full payload. Use before get_data_entity_lineage on graphs of unknown size.

• How many things depend on this table, broken down by type?
• How deep does the lineage go from this table?

rank_data_entities_by_lineage_degree

Toolset: data-observability
Permissions Required: Monitors Read or APM Read
Ranks entities by transitive lineage connectivity (upstream, downstream, or both), using a pre-built snapshot.

• Which tables in my warehouse have the most dependencies?
• Which raw ingestion tables have the deepest downstream chains?

get_warehouse_query_history

Toolset: data-observability
Permissions Required: Logs Read Data and Logs Read Index Data
Fetches recent queries that touched specific entities, in reverse chronological order, including the SQL text, execution state, and query type.

• Who has been querying this table recently?
• What writes have happened to this table in the last week?

Note: The sql field in results is raw, user-authored SQL from the warehouse and should be treated as untrusted data.

get_popular_warehouse_tables_by_query_frequency

Toolset: data-observability
Permissions Required: Logs Read Data and Logs Read Index Data and APM Read
Ranks tables by query activity, grouped by who’s querying them: human users, BI tools, orchestrators, ETL tools, or internal service accounts.

• What tables are most queried by BI tools?
• Which tables get the most human analyst traffic?

suggest_data_observability_monitor_filters

Toolset: data-observability
Permissions Required: Monitors Read
Analyzes a set of entities to find common attributes and naming patterns, and suggests monitor filter expressions that group subsets of those entities.

• What do my highest-priority tables have in common?
• Suggest a filter that covers all my staging tables.

rank_data_observability_monitor_candidates

Toolset: data-observability
Permissions Required: APM Read
Ranks tables by monitoring priority, combining lineage impact and query activity into a single composite score. This is the primary entry point for “what should I monitor?” questions.

• What tables should I set up data quality monitors for first?

get_data_observability_monitor

Toolset: data-observability
Permissions Required: Monitors Read and Timeseries and APM Read
Retrieves data quality metric timeseries for a given monitor ID, including anomaly-detection bounds when enabled.

• Show me the metric history for monitor 12345.
• What are the anomaly bounds for this freshness monitor?

get_data_observability_monitor_coverage

Toolset: data-observability
Permissions Required: Monitors Read
Fetches all data quality monitors for the org and resolves each monitor’s filter to the entities it covers. Use this to see which tables have no monitoring at all.

• Which of my tables aren’t covered by any data quality monitor?

get_data_observability_monitor_group_statuses

Toolset: data-observability
Permissions Required: APM Read
Queries the current alert and warn state of data quality monitor groups.

• Which tables are currently failing their data quality checks?

get_entity_tags / update_entity_tags

Toolset: data-observability
Permissions Required: APM Read or Monitors Read (get); Data Observability Catalog Write (update)
Gets or sets custom user-defined tags on data entities.

• What tags are on this table?
• Tag this table with owner:data-platform-team.

get_entity_descriptions / update_entity_description

Toolset: data-observability
Permissions Required: APM Read or Monitors Read (get); Data Observability Catalog Write (update)
Gets or sets custom user-defined descriptions on data entities.

• What’s the description on this table?
• Set a description explaining what this table is used for.

get_spark_job_health

Toolset: data-observability
Permissions Required: APM Read
Retrieves detailed health metrics (duration, executor CPU time, shuffle, spill, worst stages) for a single Spark or Databricks job run.

• Why did this Spark job run slowly?
• Show me the worst stages for the most recent run of this job.

get_spark_sql_plan

Toolset: data-observability
Permissions Required: APM Read
Retrieves the Spark SQL physical execution plan for a stage, including join strategies, shuffle information, and per-node metrics.

• Show me the execution plan for this Spark stage.

list_data_observability_recommendations

Toolset: data-observability
Permissions Required: APM Read
Lists cost and performance optimization recommendations for data jobs and queries (Spark, Databricks, Snowflake, BigQuery), with estimated cost and duration savings. Returns lightweight summaries with cursor pagination.

• What cost-saving recommendations do I have for my Databricks jobs?
• Are there any recommendations for reducing data skew in my Spark jobs?

get_data_observability_recommendation

Toolset: data-observability
Permissions Required: APM Read
Retrieves full details of a specific Data Observability recommendation by ID, including its structured body describing the problem, evidence, and proposed change.

• Get the details of recommendation abc123.

Database Monitoring

Tools for interacting with Database Monitoring.

find_datadog_database_instances

Toolset: dbm
Permissions Required: Database Monitoring Read
Discovers and ranks database instances for DBM investigation. Call this before other DBM tools that require a database_instance parameter. Accepts an APM trace or span ID, tags, or both to find matching instances, then assesses and ranks their health.

• Find database instances correlated with trace abc123 from an hour ago.
• What PostgreSQL instances match cluster_name:payments-prod?
• Rank database instances for service checkout-api by health.

get_datadog_database_calling_services

Toolset: dbm
Permissions Required: Database Monitoring Read
Identifies upstream APM services and resources that call database queries. Correlates database activity with application traces for root cause analysis across the APM-database boundary.

• Which services are calling the slowest queries on db-prod-1?
• Find the primary caller of query signature abc123def.
• Show me APM resources driving load on the payments database.

get_datadog_database_explain_plans

Toolset: dbm
Permissions Required: Database Monitoring Read
Retrieves PostgreSQL explain plans for a query signature within a time frame. Returns simplified plan structures with operator trees, index usage, and estimated costs, sorted by cost.

• Get explain plans for query signature abc123def on db-prod-1.
• Show me the most expensive execution plans for this slow query.
• What plan variations does query signature xyz789 have over the past day?

get_datadog_database_health_signals

Toolset: dbm
Permissions Required: Database Monitoring Read
Runs health checks to surface potential PostgreSQL issues such as CPU saturation, restarts, query latency, and blocking. Compares a regression time frame against a baseline period.

• Run health checks on db-prod-1 for the last hour versus the previous hour.
• Check database health around the incident time frame.
• What signals explain the regression on the payments database?

get_datadog_database_instance_settings

Toolset: dbm
Permissions Required: Database Monitoring Read
Retrieves collected PostgreSQL configuration settings for a Database Monitoring instance, the same values shown on the Configuration tab. Returns parameters that affect performance and behavior, including memory (shared_buffers, work_mem), connections (max_connections), autovacuum, logging, WAL, and query planner settings. Filter by setting name to narrow results.

• Show autovacuum settings for db-prod-1.
• What logging settings are enabled on the payments PostgreSQL instance?
• What is shared_buffers set to on db-prod-1?

get_datadog_database_query_performance

Toolset: dbm
Permissions Required: Database Monitoring Read
Analyzes a specific PostgreSQL query’s performance. Returns throughput, average latency, execution time, rows per execution, cache hit ratio, I/O stats, connection activity, wait events, and transaction duration, with both overall statistics and time-bucketed analysis.

• Analyze performance for query signature abc123def over the last hour.
• Why is this query slow on the production PostgreSQL instance?
• Show wait events and cache hit ratio for query signature xyz789.

get_datadog_database_query_statement

Toolset: dbm
Permissions Required: Database Monitoring Read
Retrieves the SQL statement text for a given query signature. Use this to map signature hashes back to the concrete SQL for investigation and reporting.

• Get the SQL for query signature abc123def.
• Show me the statement behind this query hash on db-prod-1.
• What query does signature xyz789 correspond to?

get_datadog_database_recommendations

Toolset: dbm
Permissions Required: Database Monitoring Read
Retrieves live database recommendations for a database, query, table, host, or index. Returns the matching recommendations with status, severity, and a normalized scope block highlighting affected instances, query signatures, tables, indexes, services, plans, and infrastructure identifiers.

• Show open database recommendations for db-prod-1.
• List missing index recommendations on the payments database.
• Get high-severity recommendations for query signature abc123def.

get_datadog_database_schemas

Toolset: dbm
Permissions Required: Database Monitoring Read
Fetches schema definitions (columns, indexes, foreign keys, partitions) for one or more database objects. Accepts table names with optional schema, database, and instance qualifiers.

• Show me the schema for the orders table.
• Get columns and indexes for public.users on db-prod-1.
• Fetch foreign keys for the payments table.

optimize_datadog_database_query

Toolset: dbm
Permissions Required: Database Monitoring Read
Analyzes a PostgreSQL query for optimization opportunities using deterministic rules. Returns query rewrites, anti-pattern detection (SELECT *, OFFSET without ORDER BY, ORDER BY without LIMIT), missing index suggestions, and idle-in-transaction impact analysis. Accepts either SQL text or a query signature.

• Optimize query signature abc123def on the payments database.
• Check this SQL for missing indexes and anti-patterns.
• Suggest rewrites for the slowest query on db-prod-1.

search_datadog_database_plans

Toolset: dbm
Permissions Required: Database Monitoring Read
Searches Database Monitoring query execution plans, which show how the database engine executes queries, including index usage, join strategies, and cost estimates. Use this to analyze query performance and identify optimization opportunities.

• Show me execution plans for slow queries on host:db-prod-1 from the last hour.
• Find query plans with @db.plan.type:explain_analyze for the production database.
• Get execution plans for queries by @db.user:app_user with duration greater than 1 second.

search_datadog_database_samples

Toolset: dbm
Permissions Required: Database Monitoring Read
Searches Database Monitoring query samples, which represent individual query executions with performance metrics. Use this to analyze database activity patterns, identify slow queries, and investigate database performance issues.

• Show me query samples with @duration:>1000000000 (duration greater than 1 second) from db:mydb.
• Find slow queries on host:db-prod-1 filtered by @db.user:app_user.
• Get recent query samples for @db.query_signature:abc123def and analyze performance patterns.

DDSQL

Tools for querying Datadog data using DDSQL, a SQL dialect with support for infrastructure resources, logs, metrics, RUM, spans, and other Datadog data sources.

ddsql_get_spec

Toolset: ddsql
Gets a compact DDSQL capability spec, including supported SQL functions, SQL keywords, and DDSQL-specific differences from standard PostgreSQL. Call this tool before composing queries to understand supported syntax.

• What SQL functions are supported in DDSQL?
• Show me the DDSQL query syntax rules and differences from PostgreSQL.
• What aggregate functions can I use in DDSQL?

ddsql_schema_search_tables

Toolset: ddsql
Searches DDSQL datasets and returns tables (public data sources and reference tables) and available metrics.

• What tables are available to query in DDSQL?
• Search for DDSQL tables related to Kubernetes.
• Show me the available metrics I can query with DDSQL.

ddsql_schema_get_table_columns

Toolset: ddsql
Gets static SQL columns for a DDSQL table from schema metadata.

• What columns are available in the aws.ec2_instance table?
• Show me the schema for the k8s.pods table.

ddsql_schema_search_unstructured_fields

Toolset: ddsql
Searches and ranks fields for unstructured DDSQL sources, such as logs, RUM, and spans, sorted by frequency. Use this tool for schema discovery on searchable sources before falling back to ddsql_schema_get_table_columns.

• What fields are available in DDSQL logs?
• Find fields related to service in my RUM data.
• Show me the most common fields in my span data.

ddsql_run_query

Toolset: ddsql
Runs a DDSQL query and returns results. Supports using SQL syntax to query infrastructure resources, logs, metrics, RUM, spans, and other Datadog data sources. See the DDSQL Reference for syntax details.

• How many EC2 instances are running in each AWS region?
• Show me the top 10 services by error log count in the last hour.
• Query average CPU usage grouped by host for the past 24 hours.

ddsql_create_link

Toolset: ddsql
Generates a Datadog UI link to the DDSQL Editor with a given query pre-populated.

• Generate a DDSQL Editor link for this query.
• Create a shareable link to the DDSQL Editor with my infrastructure query.

ddsql_search_saved_queries

Toolset: ddsql
Searches saved DDSQL queries by name or description and returns their SQL text and metadata, sorted by most recently modified. Supports optional text filtering and pagination. Multiple filter words are ANDed together.

• Find saved DDSQL queries about Kubernetes.
• List the organization’s most recently updated saved queries.
• Search saved queries for CPU usage.

ddsql_read_saved_query

Toolset: ddsql
Gets a saved DDSQL query by its query ID, including its name, SQL text, columns, description, and author metadata.

• Show the SQL for this saved query.
• Get the details of the saved query with this ID.

ddsql_upsert_saved_query

Toolset: ddsql
Creates or updates a saved DDSQL query. To create a query, provide a name and SQL text and omit the query ID. To update a query, provide its query ID and a new name, SQL text, or both. If the name or SQL text is omitted from an update, its existing value is preserved.

• Save this query as “CPU usage by host”.
• Rename this saved query to “Production hosts”.
• Update the SQL in this saved query to include only production hosts.

Derived Metrics

Tools for creating, updating, and deleting derived metrics, which let you save metric queries and formulas under a new metric name.

create_derived_metric

Toolset: derived-metrics
Permissions Required: Metric Tags Write
Creates a derived metric from a metric name, formula, and complete set of named queries. If the metric name already exists, creation fails and the existing metric is unchanged.

• Create custom.cpu.user with formula a and a query named a: avg:system.cpu.user{*}, using the metrics data source.
• Create custom.cpu.total with formula a + b. Query a is avg:system.cpu.user{*} and query b is avg:system.cpu.system{*}. Both queries use the metrics data source.

update_derived_metric

Toolset: derived-metrics
Permissions Required: Metric Tags Write
Updates an existing derived metric by replacing its entire definition. Include the formula and every named query you want to keep. Any omitted queries are removed. If the metric does not exist, the update fails without creating it.

• Replace the definition of custom.cpu.user with formula a and a query named a: avg:system.cpu.user{env:prod}, using the metrics data source.
• Update custom.cpu.total to formula a + b. Query a is avg:system.cpu.user{env:prod} and query b is avg:system.cpu.system{env:prod}. Both queries use the metrics data source. Remove any other queries.

delete_derived_metric

Toolset: derived-metrics
Permissions Required: Metric Tags Write
Deletes a derived metric definition. Deleting a definition can break dashboards, monitors, and other resources that use the metric. The tool requires explicit confirmation before it deletes the metric. This operation is idempotent.

• Delete the derived metric custom.cpu.user.
• Delete the derived metric custom.cpu.total if it exists.

Documentation

Tools for searching and reading published Datadog documentation, with source URLs your agent can cite.

search_datadog_documentation

Toolset: documentation
Permissions Required: None
Searches published Datadog documentation and returns up to 10 matching passages with links to their source pages. Returns source passages, not a generated answer. Supports English, French, Japanese, Korean, and Spanish. Other languages return no results. Search uses AI models to match by meaning. If your organization has disabled AI providers, search matches by keyword only.

• How do I write a Grok parsing rule in a Datadog log pipeline? Cite the docs.
• What’s the difference between a metric monitor and an anomaly monitor?
• Which Datadog Agent settings control container log collection?

read_datadog_documentation

Toolset: documentation
Permissions Required: None
Reads a full Datadog documentation page from a docs.datadoghq.com URL or a document ID returned by search_datadog_documentation. Reads long pages in parts. Site-specific values, such as endpoints, appear as placeholders like <YOUR_MCP_SERVER_ENDPOINT>.

• Read https://docs.datadoghq.com/logs/log_configuration/processors/grok_parser/ and explain the matcher syntax.
• Open the Datadog MCP Server setup page and summarize the toolset options.
• Search the Datadog docs for log pipeline processors, then read the top result in full.

Error Tracking

Tools for interacting with Datadog Error Tracking.

search_datadog_error_tracking_issues

Toolset: error-tracking
Permissions Required: Error Tracking Read
Searches Error Tracking Issues across data sources (RUM, Logs, Traces).

• Show me all Error Tracking Issues in the checkout service from the last 24 hours.
• What are the most common errors in my application over the past week?
• Find Error Tracking Issues in the production environment with service:api.

get_datadog_error_tracking_issue

Toolset: error-tracking
Permissions Required: Cases Read and Error Tracking Read
Retrieves detailed information about a specific Error Tracking Issue from Datadog.

• Help me solve Error Tracking Issue 550e8400-e29b-41d4-a716-446655440000.
• What is the impact of Error Tracking Issue a3c8f5d2-1b4e-4c9a-8f7d-2e6b9a1c3d5f?
• Create a test case to reproduce Error Tracking Issue 7b2d4f6e-9c1a-4e3b-8d5f-1a7c9e2b4d6f.

analyze_datadog_error_tracking_errors

Toolset: error-tracking
Permissions Required: Error Tracking Read and Timeseries
Analyzes Datadog Error Tracking errors using SQL queries for counting, aggregations, and numerical analysis. Operates on individual error samples, not Issues (groups of errors).

• Count errors by service in the last hour.
• Show me the top error types in the checkout service over the past week.
• Break down errors by version to identify which deployment introduced an issue.

update_datadog_error_tracking_issue

Toolset: error-tracking
Permissions Required: Cases Read, Cases Write, Error Tracking Read, and Error Tracking Write
Updates the state or assignee of an Error Tracking Issue in Datadog.

• Mark Error Tracking Issue 550e8400-e29b-41d4-a716-446655440000 as resolved.
• Assign Error Tracking Issue a3c8f5d2-1b4e-4c9a-8f7d-2e6b9a1c3d5f to me.
• Set the state of Error Tracking Issue 7b2d4f6e-9c1a-4e3b-8d5f-1a7c9e2b4d6f to ignored.

manage_datadog_error_tracking_issue_comments

Toolset: error-tracking
Permissions Required: Cases Read, Cases Write, Error Tracking Read, and Error Tracking Write
Adds, updates, or deletes a comment on a Datadog Error Tracking Issue.

• Add a comment to Error Tracking Issue 550e8400-e29b-41d4-a716-446655440000 saying “Investigating this now”.
• Update the comment we just added to say “Fixed in version 2.3.1”.
• Delete the comment we just added from that issue.

manage_datadog_error_tracking_issue_links

Toolset: error-tracking
Permissions Required: Cases Read, Cases Write, Error Tracking Read, and Error Tracking Write
Creates, links, or unlinks a Jira ticket, Linear ticket, or Datadog case for an Error Tracking Issue.

• File a Jira ticket for Error Tracking Issue 550e8400-e29b-41d4-a716-446655440000.
• Link Error Tracking Issue a3c8f5d2-1b4e-4c9a-8f7d-2e6b9a1c3d5f to Case CTS-203.
• Unlink the Linear ticket from Error Tracking Issue 7b2d4f6e-9c1a-4e3b-8d5f-1a7c9e2b4d6f.

get_datadog_error_tracking_analytics

Toolset: error-tracking
Permissions Required: Error Tracking Read
Retrieves daily Error Tracking Issue counts broken down by state and category, for a set of services or teams. Each day’s count is a snapshot of issue states at end of day.

• Is the error backlog for the payments service growing or shrinking over the last 30 days?
• How many new Error Tracking Issues were introduced compared to resolved last week?
• Did regressions spike after last Tuesday’s deploy?

Experiments

Tools for managing and analyzing Experiments, including creating and concluding experiments, running diagnostics, and investigating metric movements.

list_experiments

Toolset: experiments
Permissions Required: Product Analytics Experiments Read
Lists experiments for the organization, with optional name search, limit, and offset for pagination.

• Show me all running experiments.
• Find experiments with “checkout” in the name.

get_experiment

Toolset: experiments
Permissions Required: Product Analytics Experiments Read
Gets a single experiment by ID, including status, linked feature flag, subject type, primary metric, assignment dates, and decision.

• Get the details for experiment abc123.
• What is the current status and linked flag for experiment abc123?

create_experiment

Toolset: experiments
Permissions Required: Product Analytics Experiments Write
Creates a new experiment with a name, hypothesis, subject type, and primary metric.

• Create an experiment called “New Checkout Flow” to test whether the redesign improves conversion rate.

link_feature_flag_to_experiment

Toolset: experiments
Permissions Required: Product Analytics Experiments Write
Links a feature flag to an experiment.

• Link feature flag new-checkout-flow to experiment abc123.

start_experiment

Toolset: experiments
Permissions Required: Product Analytics Experiments Read and Product Analytics Experiments Write
Starts a standard experiment from its saved configuration using Datadog feature flags or warehouse-native assignment. The tool checks readiness before starting. If setup is incomplete, it returns every detected blocker with an action to resolve it and does not change the experiment. For warehouse-native experiments, configure variants and run dates before using this tool because it accepts only the experiment ID.

• Start experiment abc123.

conclude_experiment

Toolset: experiments
Permissions Required: Product Analytics Experiments Write
Concludes a running experiment with a permanent winning variant decision.

• Conclude experiment abc123 with the treatment variant as the winner.

cancel_experiment

Toolset: experiments
Permissions Required: Product Analytics Experiments Write
Cancels a running experiment with a required reason.

• Cancel experiment abc123 because an SRM issue was detected.

get_experiment_diagnostics

Toolset: experiments
Permissions Required: Product Analytics Experiments Read
Returns a health summary for an experiment before interpreting results: sample ratio mismatch (SRM) status, total subjects, per-variant exposure counts and fractions, and per-metric health including unreliable and zero-data metrics. Call this before get_experiment_results — if srm.has_warning is true, variant-level comparisons are not safe to interpret.

• Run diagnostics on experiment abc123 before I look at the results.
• Is there a sample ratio mismatch in experiment abc123?

get_experiment_results

Toolset: experiments
Permissions Required: Product Analytics Experiments Read
Returns computed per-variant, per-metric results. The verdict field (better, worse, inconclusive, or unreliable) is authoritative — do not recalculate significance from raw p-values or confidence intervals.

• Show me the results for experiment abc123.
• What is the verdict on the primary metric for experiment abc123?

explore_experiment_results

Toolset: experiments
Permissions Required: Product Analytics Experiments Read, Product Analytics Metrics Read
Segments results by an assignment property (device type, country, plan tier, and so on) or over time. Use after get_experiment_results for deeper analysis.

• Break down the results for experiment abc123 by device type.
• How did the lift for experiment abc123 trend over the last two weeks?

list_experiment_segmentation_properties

Toolset: experiments
Permissions Required: Product Analytics Experiments Read, Product Analytics Metrics Read
Lists the assignment properties an experiment can be split by. Call this before explore_experiment_results to get valid property IDs — do not guess them.

• What segmentation properties can I use to break down experiment abc123?

get_experiment_segmentation_property_values

Toolset: experiments
Permissions Required: Product Analytics Experiments Read, Product Analytics Metrics Read
Returns the concrete values for a segmentation property (for example, ["mobile", "desktop", "tablet"] for device type). Use this before filtering in explore_experiment_results to avoid invalid filter strings.

• What values are available for the device type property in experiment abc123?

get_metric_definition

Toolset: experiments
Permissions Required: Product Analytics Metrics Read
Returns the definition of an experiment metric — the underlying event query, data source, and the recommended Datadog MCP tool for investigating why the metric moved. For datadog-sourced metrics, the response includes a recommended_tool_call field with the structured parameters needed to query the raw event data. Not for Datadog infrastructure or APM metrics; use get_datadog_metric for those.

• What is the event query behind the primary metric for experiment abc123?
• Which MCP tool should I use to investigate why this metric moved?

diagnose_experiment_run_failure

Toolset: experiments
Permissions Required: Product Analytics Experiments Read
Diagnoses why the latest (or a specific) analysis pipeline run for an experiment failed. Returns the root-cause task, a categorized failure explanation, and actionable next steps. Use get_experiment_diagnostics for result quality and SRM issues instead.

• Why did the latest analysis run for experiment abc123 fail?
• Diagnose the pipeline failure for experiment abc123.

Feature Flags

Tools for managing feature flags, including creating, listing, and updating flags and their environments.

list_datadog_feature_flags

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read and Feature Flag Read
Lists feature flags with pagination support.

• Show me all feature flags in my organization.
• List feature flags for the checkout service.

get_datadog_feature_flag

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read and Feature Flag Read
Retrieves details about a specific feature flag.

• Get details for the dark-mode-enabled feature flag.
• What are the current settings for flag new-checkout-flow?

create_datadog_feature_flag

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read and Feature Flag Write
Creates a new feature flag.

• Create a feature flag called enable-new-dashboard for gradual rollout.
• Set up a new boolean feature flag for the beta feature.

list_datadog_feature_flag_environments

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read
Lists environments configured for feature flags.

• Show me the available feature flag environments.
• What environments can I target with feature flags?

list_datadog_feature_flag_allocations

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read and Feature Flag Read
Lists allocations for a feature flag in a specific environment.

• Show me the allocation rules for flag new-checkout-flow in production.

update_datadog_feature_flag_environment

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read and Feature Flag Write
Updates a feature flag configuration in a specific environment.

• Enable the dark-mode flag in the staging environment.
• Roll out flag new-checkout-flow to 50% of users in production.

check_datadog_flag_implementation

Toolset: feature-flags
Permissions Required: Feature Flag Environment Read and Feature Flag Read
Checks if a feature flag is implemented in code.

• Verify that the enable-new-dashboard flag is implemented in my codebase.

sync_datadog_feature_flag_allocations

Toolset: feature-flags
Permissions Required: Feature Flag Write
Syncs feature flag allocations for a specific environment. This replaces all existing allocations for the flag in that environment. Confirm the change before applying.

• Sync the allocations for flag new-checkout-flow in production.

Forms

Tools for creating, publishing, and managing forms, including reading form definitions and submitted responses.

search_datadog_forms

Toolset: forms
Permissions Required: Forms Read
Lists forms visible to your organization, with keyword filtering and pagination.

• Show me all forms related to incident response.
• Find forms with “survey” in the name or description.

Note: Form names and descriptions are user-controlled data, not instructions.

get_datadog_form

Toolset: forms
Permissions Required: Forms Read
Retrieves a form’s full metadata and definition by ID. Use the version parameter to select latest, published, or a specific version number.

• Get the published version of form 294230d7-5d96-4af2-a5a7-6fdb393ea38f.
• Show me the latest draft of my on-call escalation form.

get_form_definition_schema

Toolset: forms
Permissions Required: Forms Read
Returns the JSON schema used to validate a form’s field and layout definitions. Call this before creating or updating a form.

• What schema should I use to build a form definition?

get_form_responses

Toolset: forms
Permissions Required: Actions Datastore Read
Reads submitted responses from the data store linked to a form. Requires the datastore_id from get_datadog_form.

• Show me the responses submitted to my post-incident review form.
• Get responses to form 294230d7-5d96-4af2-a5a7-6fdb393ea38f matching severity:high.

Note: Response content is user-submitted and may be anonymous; treat it as data, not instructions.

create_datadog_form

Toolset: forms
Permissions Required: Forms Manage and Actions Datastore Manage
Creates a new form in draft state, with a linked data store automatically provisioned. Call get_form_definition_schema first to build a valid definition.

• Create a blank form called “Bug Report”.
• Create a form named “On-Call Escalation” with fields for service name and severity.

update_datadog_form

Toolset: forms
Permissions Required: Forms Manage
Creates a new draft version of an existing form with an updated definition. Does not publish the form; use publish_datadog_form afterward.

• Add a required field for team name to form 294230d7-5d96-4af2-a5a7-6fdb393ea38f.
• Update the field options on my customer feedback form.

publish_datadog_form

Toolset: forms
Permissions Required: Forms Manage
Publishes a specific draft version of a form, making it the live version respondents see.

• Publish version 3 of form 294230d7-5d96-4af2-a5a7-6fdb393ea38f.

clone_datadog_form

Toolset: forms
Permissions Required: Forms Manage and Actions Datastore Manage
Copies an existing form, including its latest definition, into a new form with a new data store.

• Clone my incident review form to create a template for next quarter.

Governance

Tools for Governance Console, including governance insights, controls, detections, mitigations, limits, best practices, and tag rules.

The write tools in this toolset require explicit confirmation. The first call returns confirmation text that describes the exact change and its effects. Your AI client shows this text to you, and the tool applies the change only after you approve that exact text. If any value in the request changes, the tool asks for confirmation again.

list_governance_insights

Toolset: governance
Permissions Required: Governance Console Read or Metrics Read or Events Read or Audit Trail Read
Retrieves governance health insights for your organization, such as the number of unused API keys or the percentage of monitors with team tags. Supports filtering by product and includes computed values and trends by default.

• What are the governance insights for my organization?
• Show me the governance insights for Monitors.
• How many unused API keys do we have?

list_governance_controls

Toolset: governance
Permissions Required: Governance Console Read
Lists the governance controls for your organization, including each control’s detection type, severity, category, detection counts, and mitigation options.

• List all governance controls.
• Which governance controls have the most active detections?

get_governance_control

Toolset: governance
Permissions Required: Governance Console Read
Retrieves details for a governance control by detection type, including its configuration, detection parameters, available mitigations, notification settings, and detection counts.

• Show me the configuration of the unused_api_keys control.
• Which mitigations are available for the monitors_without_team_tag control?

list_governance_detections

Toolset: governance
Permissions Required: Governance Console Read
Lists the detections for a governance control. A detection is a resource that violates the control, such as an unused API key. Supports filtering by state (active, exception, or mitigated) and searching by resource ID or name.

• List the active detections for the unused_api_keys control.
• Which monitors are missing a team tag?
• Show me the detections marked as exceptions for the unused_api_keys control.

get_governance_detection

Toolset: governance
Permissions Required: Governance Console Read
Retrieves details for a governance detection, including its state, resource details, assignment, mitigation deadline, and notification history.

• Show me the details of detection abc123 for the unused_api_keys control.
• When is detection abc123 scheduled for automatic mitigation?

list_governance_limits

Toolset: governance
Permissions Required: Governance Console Read
Lists your organization’s rate limits and resource limits, with current usage compared to each limit. Use this tool to find resources that are close to or over their limits.

• Which of my rate limits are close to being exceeded?
• Show me my organization’s resource limits and current usage.

list_governance_best_practices

Toolset: governance
Permissions Required: Governance Console Read
Lists recommended governance best practices, each with a description, expected impact, priority, and a link to the relevant page in Datadog. Supports filtering by category (access_governance, security, compliance, or operational_hygiene) and keyword search.

• What governance best practices should my organization follow?
• List the security best practices for my organization.

list_tag_rules

Toolset: governance
Permissions Required: Telemetry Rules Read or Metrics Read
Lists your organization’s tag rules. A tag rule flags telemetry that is missing a required tag or has a tag value that does not match an allowed pattern. Rules apply to logs, spans, metrics, RUM events, or feed events. Supports filtering by source and including disabled or deleted rules.

• List all tag rules for logs.
• Show me the disabled tag rules.

get_tag_rule

Toolset: governance
Permissions Required: Telemetry Rules Read or Metrics Read
Retrieves a tag rule by ID, including the tag key it governs, its allowed value patterns, its scope, and whether it is enabled.

• Show me the details of tag rule abc123.

mitigate_governance_detections

Toolset: governance
Permissions Required: Governance Console Read and MCP Write
Runs a mitigation on up to 25 detections for a control, such as revoking unused API keys. You must specify the mitigation type. Use get_governance_control to see the mitigations available for a control. Each mitigation also requires the permissions to change the affected resources. Some mitigations cannot be undone. The tool requires explicit confirmation before it runs the mitigation.

• Revoke the unused API keys from detections abc123 and def456.
• Mitigate all active detections for the unused_api_keys control.

update_governance_detection

Toolset: governance
Permissions Required: Governance Console Read and MCP Write
Updates a governance detection. Use this tool to mark a detection as an exception, reactivate it, assign it to a user or team, or change its automatic mitigation deadline. The tool requires explicit confirmation before it applies changes.

• Mark detection abc123 as an exception.
• Assign detection abc123 to the Platform team.
• Delay automatic mitigation of detection abc123 until the end of the month.

create_tag_rule

Toolset: governance
Permissions Required: Telemetry Rules Create
Creates a tag rule. Rules created with this tool only flag non-compliant telemetry; they do not block it. New rules are disabled unless you ask for the rule to be enabled. The tool requires explicit confirmation before it creates the rule.

• Create a tag rule that requires the team tag on all logs.
• Create a tag rule that allows only prod, staging, and dev as values of the env tag on spans.

update_tag_rule

Toolset: governance
Permissions Required: Telemetry Rules Create and (Telemetry Rules Read or Metrics Read)
Updates the fields you specify on a tag rule and leaves other fields unchanged. To change the source of a rule, delete the rule and create another one. You cannot update rules that block telemetry with this tool; use Governance Console instead. The tool requires explicit confirmation before it applies changes.

• Enable tag rule abc123.
• Add qa to the allowed values for tag rule abc123.

delete_tag_rule

Toolset: governance
Permissions Required: Telemetry Rules Create
Deletes a tag rule. By default, the rule is soft-deleted and can be recovered. To delete the rule permanently, ask for a hard delete. The tool requires explicit confirmation before it deletes the rule.

• Delete tag rule abc123.
• Permanently delete tag rule abc123.

Investigations

Tools for triggering, searching, and steering Bits Investigation investigations for monitor alerts, incidents, and general troubleshooting.

trigger_bits_ai_investigation

Toolset: investigator
Permissions Required: Bits Investigations Write
Triggers a Bits Investigation for a monitor alert. This starts an automated investigation that analyzes the alert context and provides findings and conclusions. Use get_bits_ai_investigation to retrieve results.

• Investigate why monitor 12345 fired at event abc123.
• Kick off a Bits Investigation for the CPU alert on the checkout service.

trigger_general_investigation

Toolset: investigator
Permissions Required: Bits Investigations Write
Triggers a Bits Investigation from a text description. For best results, scope the investigation with a service:<name> or host:<name> tag. Use get_bits_ai_investigation to poll for results after triggering.

• Investigate the latency spike on service:checkout since 2pm today.
• Start an investigation into elevated error rates on host:web-01.

trigger_incident_investigation

Toolset: investigator
Permissions Required: Bits Investigations Write
Triggers a Bits Investigation scoped to a Datadog incident. The investigation analyzes the incident timeline and context to provide findings and conclusions. Use get_investigations_from_incident_id to check for existing investigations first.

• Trigger an investigation for incident 1234 to help find the root cause.
• Start a Bits Investigation scoped to the ongoing checkout incident.

search_investigations

Toolset: investigator
Permissions Required: Bits Investigations Read
Searches Bits AI investigations by keyword or query. Returns matching investigations with their IDs, status, and summaries.

• Find investigations related to the checkout service.
• Show me all completed investigations from this week.

get_investigations_from_incident_id

Toolset: investigator
Permissions Required: Bits Investigations Read
Retrieves Bits AI investigations linked to a specific Datadog incident.

• What investigations have been triggered for incident 1234?
• List investigation IDs linked to the payments incident.

get_bits_ai_investigation

Toolset: investigator
Permissions Required: Bits Investigations Read
Retrieves the status, findings, and conclusions of a Bits AI investigation.

• Get the findings for investigation abc-123-def.
• What did the investigation conclude about the outage?

steer_bits_ai_investigation

Toolset: investigator
Permissions Required: Bits Investigations Write
Sends a steering message to a running Bits AI investigation to correct, redirect, or add context. Use get_bits_ai_investigation first to confirm the investigation is still active.

• Tell the running investigation to focus on the database layer instead.
• Redirect investigation abc-123-def to also check recent deployments.

Kubernetes

Tools for searching and describing Kubernetes resources, retrieving manifests, and analyzing Deployment rollouts across all clusters.

search_datadog_k8s_resources

Toolset: kubernetes
Permissions Required: Hosts Read and Teams Read
Searches for Kubernetes resources across all clusters. Use this tool instead of kubectl to determine the state of Kubernetes resources such as deployments, pods, nodes, etc. This tool does not require local cluster access, works across all clusters, and returns enriched data with tags. You can include specific tag keys on each result, and include parent resource names to investigate relationships between resources (for example, the deployment a pod belongs to).

• Show me all pods in the production namespace with CrashLoopBackOff status.
• Find deployments with in-progress rollouts in the general2 cluster.
• List all nodes in my cluster sorted by CPU usage.
• Group deployments by service and env to see how my services are distributed across environments.

analyse_datadog_k8s_rollout

Toolset: kubernetes
Permissions Required: Hosts Read and Timeseries and Logs Read Data and APM Read
Assembles a Kubernetes Deployment rollout in one call: rollout status and progress, timing (ETA while the rollout is in progress, duration after it finishes), the new, previous, and old ReplicaSet split by revision, and before/after impact series (RED, resource utilization, and log counts). Identify the Deployment by its UID from a previous search or by providing resource identifiers (cluster, namespace, and resource name). Use this tool for rollout questions instead of combining search_datadog_k8s_resources and describe_datadog_k8s_resource.

• Analyze the rollout of deployment checkout-api in cluster prod, namespace default.
• What’s the ETA for the in-progress rollout of deployment api-server in cluster staging?
• Did the last rollout of deployment payments affect error rates, traffic, or resource utilization?

Note: The tool only reports on Deployments whose kube_rollout_status is inprogress, recentlycompleted, or recentlyfailed. For other Deployments, it returns the Deployment’s fields with a warning that there is no recent rollout to analyze.

describe_datadog_k8s_resource

Toolset: kubernetes
Permissions Required: Hosts Read
Gets detailed information about a specific Kubernetes resource, including resource-specific details such as CPU and memory requests and limits, and optionally tags, labels, annotations, manifest history, parent resources, and a deep link to the Kubernetes Explorer. Use this tool instead of kubectl describe. Identify a resource by its UID from a previous search or by providing resource identifiers (cluster, namespace, and resource name). For the full raw manifest, use get_datadog_k8s_manifest.

• Describe pod my-app in cluster prod, namespace default.
• Get details for deployment api-server in namespace default, cluster staging.
• Show me the tags and annotations for this Kubernetes resource.

get_datadog_k8s_manifest

Toolset: kubernetes
Permissions Required: Hosts Read
Retrieves the YAML manifest for a specific Kubernetes resource. Use this tool instead of kubectl get -o yaml. Supports extracting specific subtrees with a kubectl JSONPath expression and a concise mode that omits status and managedFields to reduce response size.

• Get the manifest for pod my-app in cluster prod, namespace default.
• Show me the container ports for deployment api-server in namespace default, cluster staging.
• Get the container images from the manifest of pod my-app.

Metrics Governance

Tools for analyzing metric timeseries volume and tag cardinality and managing Metrics without Limits™ tag configurations and indexing rules.

estimate_datadog_metric_cardinality

Toolset: metrics-governance
Permissions Required: Metrics Read
Estimates a metric’s timeseries cardinality for a proposed allowlist of tag keys. Use this tool to evaluate how keeping or removing tags could affect indexed volume.

• Estimate the cardinality of custom.checkout.requests if I keep only env, service, and region.
• How many timeseries would custom.api.latency have with no tags retained?
• Compare the existing tag configuration for custom.orders.count with an allowlist of env and team.

get_metric_cardinality_profile

Toolset: metrics-governance
Permissions Required: Metrics Read
Identifies the tag-level drivers of a metric’s indexed timeseries volume, including tag cardinality, query activity from the past 30 days, active aggregations, and the direct tag configuration. The profile describes observed data and does not estimate the combined effect of changing multiple tags.

• Profile the cardinality drivers for custom.checkout.requests over the last day.
• Which high-cardinality tags on custom.api.latency have not been queried in the past 30 days?
• Show the indexed and ingested volume, active tags, and tag configuration for custom.orders.count.

get_metric_governance_status

Toolset: metrics-governance
Permissions Required: Metrics Read
Retrieves the Metrics without Limits™ governance status for up to 20 metrics, including direct tag configurations, exemptions, and optionally the first matching tag indexing rule.

• Show the governance status for custom.checkout.requests.
• Which tag indexing rule applies to custom.api.latency?
• Check whether custom.orders.count and custom.payments.count have exemptions.

get_metric_tag_configuration

Toolset: metrics-governance
Permissions Required: Metrics Read
Retrieves the direct Metrics without Limits™ tag configuration for up to 20 metrics. The result identifies whether each configuration is an allowlist or denylist; a metric without a configuration might still be governed by a tag indexing rule.

• Which tags are enabled for custom.checkout.requests?
• Is the tag configuration for custom.api.latency an allowlist or a denylist?
• Compare the direct tag configurations for custom.orders.count and custom.payments.count.

get_metric_tags

Toolset: metrics-governance
Permissions Required: Metrics Read
Retrieves indexed and ingested tag keys for a metric over the last four hours, with one observed sample value for each key.

• List the indexed and ingested tags for custom.checkout.requests.
• Which tags were observed on custom.api.latency in the last four hours?
• Show a sample value for each tag on custom.orders.count.

get_metric_volume

Toolset: metrics-governance
Permissions Required: Metrics Read
Retrieves series volume for up to 20 metrics. Custom metrics return indexed and ingested volume, while standard metrics return distinct volume. Supports windows from four hours to two weeks.

• Show the indexed and ingested volume for custom.checkout.requests.
• Compare the volume of custom.orders.count and custom.payments.count over the last week.
• Get the distinct volume for system.cpu.user.

get_tag_indexing_rules

Toolset: metrics-governance
Permissions Required: Metrics Read
Lists Metrics without Limits™ tag indexing rules in priority order. The first rule that matches a metric determines its tag configuration.

• List all tag indexing rules in priority order.
• Which rules match metrics with the custom.checkout.* naming pattern?
• Show the next page of tag indexing rules.

manage_metric_tag_configuration

Toolset: metrics-governance
Permissions Required: Metrics Write
Creates, updates, or deletes a direct Metrics without Limits™ tag configuration for a metric. The tool provides a preview and requires explicit confirmation before applying changes.

• Create an allowlist with env, service, and region for custom.checkout.requests.
• Update custom.api.latency to exclude the request_id tag.
• Delete the direct tag configuration for custom.orders.count.

manage_tag_indexing_rule

Toolset: metrics-governance
Permissions Required: Metrics Write
Creates, updates, deletes, or reorders Metrics without Limits™ tag indexing rules and manages metric exemptions. The tool provides a preview and requires explicit confirmation before applying changes.

• Create a rule for custom.checkout.* that keeps env, service, and region.
• Move the checkout metrics rule to the highest priority.
• Add an exemption for custom.checkout.debug with a reason.

Live Debugger

Tools for debugging running applications with Live Debugger logpoints, which instrument code to capture runtime variables and execution state without a redeployment.

discover_datadog_logpoint

Toolset: live-debugger
Permissions Required: Live Debugger Read and Live Debugger Write
Discovers the deployment environments where a service runs Live Debugger and the features it supports, such as message_templates, conditions, and capture_expressions. Call this tool before create_datadog_logpoint.

• Which environments can I debug for the checkout service?
• What Live Debugger features are available for service:web-store?

enable_live_debugger

Toolset: live-debugger
Permissions Required: Live Debugger Read and Live Debugger Write
Enables Live Debugger for a service in an environment where it is supported but not yet enabled. This tool may block for a few minutes to confirm enablement. Run discover_datadog_logpoint again to confirm logpoint readiness.

• Enable Live Debugger for the checkout service in staging.
• Turn on dynamic instrumentation for service:payments in the qa environment.

create_debugger_session

Toolset: live-debugger
Permissions Required: Live Debugger Read and Live Debugger Write
Creates a Live Debugger session. Use the returned session_id to create, list, and disable logpoints.

• Create a debugging session so I can add logpoints to the checkout service.
• Start a Live Debugger session to investigate a null pointer error in the payments service.

create_datadog_logpoint

Toolset: live-debugger
Permissions Required: Live Debugger Read and Live Debugger Write
Creates a logpoint to capture runtime data unavailable in existing logs, metrics, or traces. Call discover_datadog_logpoint first to confirm the environment supports logpoints. Logpoints take up to a minute to propagate before they begin capturing data.

• Add a logpoint at line 42 of src/cart.py in the checkout service to capture the cart contents.
• Add a logpoint to Handler.GetData in staging to capture its arguments and return value.

list_datadog_session_logpoints

Toolset: live-debugger
Permissions Required: Live Debugger Read
Lists the logpoints in a Live Debugger session, with the service, source location, message template, and enabled state for each.

• Show me all active logpoints in this session.
• Which logpoints are enabled for the checkout service in this session?

get_datadog_debugger_snapshot

Toolset: live-debugger
Permissions Required: Logs Read Data and Logs Read Index Data
Retrieves captured variables from a Live Debugger snapshot. Use variable_path to select a nested value and depth to control how many levels it expands. To aggregate the same captured value across multiple snapshots, pass the node’s extra_columns block, when present, to analyze_datadog_logs.

• Show me the captured variables from snapshot event abc123.
• Expand the nested order object in that snapshot to a depth of 3.

disable_datadog_logpoints

Toolset: live-debugger
Permissions Required: Live Debugger Read and Live Debugger Write
Disables all logpoints in a Live Debugger session. The session stays active so new logpoints can be added.

• Disable all logpoints in session session-12345.
• Stop all the logpoints in this debugging session.

Logs Configuration

Tools for managing the configuration of log pipelines, indexes, and archives:

• Pipelines parse and enrich incoming logs.
• Indexes control indexing and retention.
• Archives route logs to your cloud storage.

Tools that update, delete, or reorder an existing resource return a preview first and apply the change only after you confirm it. Creating a resource does not require confirmation.

To search and analyze logs, use search_datadog_logs and analyze_datadog_logs in the Core tools section.

list_datadog_log_pipelines

Toolset: logs-configuration
Permissions Required: Logs Read Config
Lists your organization’s log pipelines in evaluation order. Returns each pipeline’s ID, name, filter query, enabled state, and processor count.

• List my log pipelines in evaluation order.

get_datadog_log_pipeline

Toolset: logs-configuration
Permissions Required: Logs Read Config
Retrieves a pipeline’s complete configuration by ID, including its ordered processors.

• Show the configuration and processors for pipeline <PIPELINE_ID>.

upsert_datadog_log_pipeline

Toolset: logs-configuration
Permissions Required: Logs Write Pipelines or Logs Write Processors
Creates a pipeline or updates an existing pipeline’s configuration. To update a pipeline, provide pipeline_id; omit it to create one. Updated pipelines preserve fields you omit. When you provide a list field, such as processors or tags, the new list replaces the existing one. Integration-managed, read-only pipelines cannot be updated.

• Create a pipeline for service:checkout with a Grok parser for these sample logs.

delete_datadog_log_pipeline

Toolset: logs-configuration
Permissions Required: Logs Write Pipelines
Permanently removes a pipeline from your organization, including its processors and position in the evaluation order. Integration-managed, read-only pipelines cannot be deleted.

• Delete pipeline <PIPELINE_ID>.

move_datadog_log_pipeline

Toolset: logs-configuration
Permissions Required: Logs Write Pipelines
Places a pipeline immediately before or after another pipeline in the evaluation order. Changing this order affects the sequence in which matching pipelines process logs.

• Move the parsing pipeline before the enrichment pipeline.

list_datadog_log_indexes

Toolset: logs-configuration
Permissions Required: Logs Read Config
Lists your organization’s log indexes in evaluation order. Returns each index’s name, filter query, retention settings, daily limit, and exclusion filter count.

• List my log indexes with their retention settings and daily limits.

get_datadog_log_index

Toolset: logs-configuration
Permissions Required: Logs Read Config
Retrieves an index’s complete configuration by name, including its filter query, retention settings, daily limit, and exclusion filters.

• Show the configuration and exclusion filters for the production index.

upsert_datadog_log_index

Toolset: logs-configuration
Permissions Required: Logs Modify Indexes
Creates or updates an index by name. If an index with that name exists, the tool updates it; otherwise, it creates the index. Updated indexes preserve fields you omit. When you provide a list field, such as exclusion filters or tags, the new list replaces the existing one. Creating an index requires a filter query, and the index name cannot be changed after creation.

• Set the daily limit for the staging index to one million logs.

delete_datadog_log_index

Toolset: logs-configuration
Permissions Required: Logs Modify Indexes
Permanently removes an index from your organization. The index name cannot be reused. Logs that would have matched the deleted index go to the next index in evaluation order whose filter matches them. Logs that match no remaining index are not indexed.

• Delete the obsolete-staging index.

move_datadog_log_index

Toolset: logs-configuration
Permissions Required: Logs Modify Indexes
Places an index immediately before or after another index in the evaluation order. Logs are indexed in the first index whose filter matches, so changing the order can change their destination.

• Move the production-errors index before the production index.

list_datadog_log_archives

Toolset: logs-configuration
Permissions Required: Logs Read Archives
Lists your organization’s log archives. Returns each archive’s ID, name, filter query, state, and destination type.

• List my log archives and their destination types.

get_datadog_log_archive

Toolset: logs-configuration
Permissions Required: Logs Read Archives
Retrieves an archive’s complete configuration by ID, including its filter query, cloud storage destination, and rehydration settings.

• Show the destination and rehydration settings for archive <ARCHIVE_ID>.

upsert_datadog_log_archive

Toolset: logs-configuration
Permissions Required: Logs Write Archives
Creates an archive or updates an existing archive’s configuration. To update an archive, provide archive_id; omit it to create one. Updated archives preserve fields you omit. An archive’s destination cannot be changed after creation.

• Update archive <ARCHIVE_ID> to archive logs matching env:prod.

delete_datadog_log_archive

Toolset: logs-configuration
Permissions Required: Logs Write Archives
Permanently removes an archive’s configuration and stops routing logs to that destination. Logs already stored in the cloud storage bucket remain intact.

• Delete archive <ARCHIVE_ID>.

move_datadog_log_archive

Toolset: logs-configuration
Permissions Required: Logs Write Archives
Places an archive immediately before or after another archive in the evaluation order. Logs are routed to the first archive whose filter matches, so changing the order can change their destination.

• Move the production archive before the catch-all archive.

Networks

Tools for Cloud Network Monitoring analysis, Network Device Monitoring, and Network Path.

analyze_cloud_network_monitoring

Toolset: networks
Permissions Required: Network Connections Read
Investigates network-level issues using Cloud Network Monitoring data, analyzing network flow data to detect anomalies like elevated retransmission rates.

• Analyze network traffic between my web servers and the database cluster.
• Are there any retransmission issues between service:api and service:payments?
• Investigate network flow data for anomalies in the production environment.

search_ndm_devices

Toolset: networks
Permissions Required: NDM Read
Searches network devices (routers, switches, firewalls) monitored by Datadog Network Device Monitoring.

• Show me all network devices in the us-east-1 datacenter.
• Find firewalls that are reporting errors.
• List all monitored switches and their statuses.

get_ndm_device

Toolset: networks
Permissions Required: NDM Read
Retrieves detailed information about a specific network device by its device ID.

• Get details for network device device:abc123.
• Show me the configuration and status of this router.

search_ndm_interfaces

Toolset: networks
Permissions Required: NDM Read
Retrieves all network interfaces for a specific device.

• Show me all interfaces on device device:abc123.
• List the interface statuses for my core router.

get_network_path_test_runs

Toolset: networks
Permissions Required: Network Path Data Read and Built-in Features
Searches and retrieves Network Path test runs with hop-by-hop traceroute data, including a link to the path in the Network Path view.

• Show me the latest Network Path test runs to api.example.com.
• Which hops are adding the most latency on the path from web-01 to 8.8.8.8?
• Find Network Path test runs with packet loss in the last hour.

get_autonomous_system_status

Toolset: networks
Permissions Required: Network Path Data Read and Built-in Features
Checks the health of an Autonomous System (AS) using Network Path data, comparing latency, packet loss, and visibility against a 7-day baseline.

• Is AS 15169 experiencing elevated latency compared to last week?
• Check the health of the ISP that carries traffic to our us-east-1 endpoints.

list_autonomous_system_statuses

Toolset: networks
Permissions Required: Network Path Data Read and Built-in Features
Lists degraded Autonomous Systems (ASes) using Network Path data, without requiring a specific AS number. An AS is degraded when its latency, packet loss, or visibility is worse than its own 7-day baseline. Results cover the highest-traffic ASes for the selected time frame, not every AS in your organization. To check one specific AS, use get_autonomous_system_status.

• Are there any Autonomous System issues in the last hour?
• Which ASes are degraded in the last 4 hours?
• Show me the top three degraded ASes with packet loss.

run_network_path

Toolset: networks
Permissions Required: Connections Resolve and Private Action Runner Contribute
Runs a live Network Path traceroute test from a Datadog Agent host to a destination, through the Private Action Runner (PAR). Supports UDP (default), TCP, and ICMP. For TCP, specify the destination port. To retrieve historical results without running a new test, use get_network_path_test_runs.

• Run a traceroute from host prod-web-01 to api.example.com.
• Run a TCP traceroute on port 443 from db-replica-3 to 10.0.4.12.

Observability Pipelines

Tools for Observability Pipelines, including inspecting existing pipelines and building, validating, and creating new pipelines. The toolset cannot update or delete existing pipelines.

list_observability_pipelines

Toolset: observability-pipelines
Permissions Required: Observability Pipelines Read
Lists all pipelines in your organization, including drafts, with each pipeline’s ID, name, type, and creation and modification timestamps. Supports filtering by pipeline type.

• How many pipelines do we have, and how many of them are metrics pipelines?
• Find the ID of the “Prod Agent Logs” pipeline.
• Which pipelines were modified in the last week?

describe_observability_pipeline

Toolset: observability-pipelines
Permissions Required: Observability Pipelines Read
Retrieves the full configuration of a pipeline by ID: its sources, processors, and destinations, and how they connect. For a deployed pipeline, returns the running configuration in the Observability Pipelines API format. For a draft, the agent describes the configuration but does not output it. To get a draft’s configuration as JSON, export the draft from the pipeline builder. Use list_observability_pipelines to find pipeline IDs if needed.

• Explain what the “Prod Agent Logs” pipeline does.
• Where are logs dropped in my Splunk forwarding pipeline?
• Are there redundant or expensive processors in pipeline abc-123-def?

get_observability_pipeline_component_schema

Toolset: observability-pipelines
Permissions Required: Observability Pipelines Read
Without arguments, returns the available source, processor, and destination types. With types, returns the fields of each requested component, including which are required, their types, and allowed values. The schema can lag behind the server, so check assembled configurations with validate_observability_pipeline.

• Which sources and destinations are available in Observability Pipelines?
• What fields are required for the splunk_hec source and the amazon_s3 destination?
• What options does the sample processor support?

validate_observability_pipeline

Toolset: observability-pipelines
Permissions Required: Observability Pipelines Read
Validates a pipeline configuration in the Observability Pipelines API format without creating or deploying anything. Returns all validation errors so the agent can fix the configuration and validate it again.

• Validate this pipeline configuration before I create it.
• Check this pipeline configuration for errors.

create_observability_pipeline

Toolset: observability-pipelines
Permissions Required: Observability Pipelines Deploy
Creates a pipeline from a name and a configuration in the Observability Pipelines API format, and returns the new pipeline’s ID and a link to it in Datadog. Creating a pipeline does not affect existing pipelines. The new pipeline does not process data until you install the Observability Pipelines Worker for it. Use validate_observability_pipeline to check the configuration first. If the configuration fails validation, the tool returns the validation errors.

• Create a logs pipeline that receives logs from the Datadog Agent, drops debug logs, and sends the rest to Datadog.
• Build a pipeline that collects Splunk HEC logs, redacts credit card numbers, and routes them to Amazon S3 and Splunk.

Onboarding

Agentic onboarding tools for guided Datadog setup and configuration.

browser_onboarding

Toolset: onboarding
Permissions Required: RUM Apps Read
Guides you through onboarding Browser RUM to Datadog.

• Help me set up Browser RUM monitoring for my web application.

devices_onboarding