Datadog MCP server: setup & sharing

Metrics, logs, and incidents for remote teammates — host mutes and downtimes need your approval.

Run on your machine

Start the server on your host machine. Tools not listed in --allow are completely hidden from the agent.

Terminal · Host machine

npx -y @mcpwire/cli share \
  --name datadog \
  --allow "list_incidents,get_incident,query_metrics,get_logs,get_all_services,get_monitors,list_dashboards,get_dashboard,list_traces,list_hosts,get_active_hosts_count,list_downtimes,get_rum_applications,get_rum_events,get_rum_grouped_event_count,get_rum_page_performance" \
  --redact-secrets \
  -- npx -y @winor30/mcp-server-datadog@1.8.0

Exposes 16 default tools with pattern-based secret redaction. Optionally set an expiry with --ttl 30m, prompt for approvals with --confirm, or limit calls with --max-calls 20.

Connect your teammate’s agent

MCPWire prints a unique wire://... ticket in your terminal. Send it privately to your teammate to paste into their MCP client:

Claude Desktop · Cursor · Windsurf config

{
  "mcpServers": {
    "datadog": {
      "command": "npx",
      "args": [
        "-y",
        "@mcpwire/cli",
        "join",
        "wire://<TICKET_FROM_HOST>"
      ]
    }
  }
}

Replace <TICKET_FROM_HOST> with the active session ticket. The agent can only discover and call the tools exposed above.

Scoped tool permissions

MCPWire acts as a Layer 7 JSON-RPC firewall. Requests for blocked tools are dropped on the wire before ever touching your machine.

Tool	Default Policy	Notes
`list_incidents`	Allowed	Lists incidents.
`get_incident`	Allowed	Reads incident details.
`query_metrics`	Allowed	Runs metric queries.
`get_logs`	Allowed	Searches logs — log contents flow to the guest.
`get_all_services`	Allowed	Lists monitored services.
`get_monitors`	Allowed	Searches monitors.
`list_dashboards`	Allowed	Lists dashboards.
`get_dashboard`	Allowed	Reads a dashboard definition.
`list_traces`	Allowed	Searches APM traces.
`list_hosts`	Allowed	Lists reporting hosts.
`get_active_hosts_count`	Allowed	Reports the active host count.
`list_downtimes`	Allowed	Lists scheduled downtimes.
`get_rum_applications`	Allowed	Lists RUM applications.
`get_rum_events`	Allowed	Searches Real User Monitoring events.
`get_rum_grouped_event_count`	Allowed	Groups RUM event counts.
`get_rum_page_performance`	Allowed	Reads page performance metrics.
`mute_host`	Blocked (High risk)	Silences monitoring for a host.
`unmute_host`	Blocked (High risk)	Resumes monitoring for a host.
`schedule_downtime`	Blocked (High risk)	Schedules monitor downtime.
`cancel_downtime`	Blocked (High risk)	Cancels scheduled downtime.

Test and verify

Try these recommended prompts to confirm the agent receives expected outputs and that restricted actions fail safely.

Try Datadog

Create Datadog API and application keys with read-only permissions and set DATADOG_API_KEY and DATADOG_APP_KEY in the host environment (DD_SITE for non-US1 sites). Datadog ships an official MCP server, but it is remote-only and outside this catalog’s stdio support, so this entry uses a maintained community server.

Ask the agent what is happening with list_incidents, then dig into a metric with query_metrics, a log search with get_logs, or a slow request with list_traces. Logs and traces carry real production payloads, so the key scope is what limits disclosure. The alert-acting tools (mute_host, schedule_downtime, and friends) stay outside the default allowlist — a guest muting a monitor could mask an outage.

The generated command above contains the catalog’s explicit default allowlist. Check the guest’s tool list before making calls and use the server’s argument schema for required fields. See the CLI guide for guest configuration and session controls for approvals, redaction, and expiry.

Review the session in your browser: Add --record session.wirelog to your host command. Drop the resulting file into the Session Replay Viewer to inspect timestamps, latency, blocked attempts, and secret scrubbing.

← All server guides Open in command builder