--- title: "Datadog MCP server for AI agents - actionlake" description: "Give Claude 586 Datadog actions through one MCP server: users, incidents, hosts, teams. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/datadog updated: 2026-10-11 --- Connectors · Observability & analytics # Datadog MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Datadog and the rest of your systems. It gives your agent 586 Datadog actions (282 reads, 215 writes and 89 that wait for a confirmation) and holds the Datadog credential itself, so the agent never does. It paces Datadog's limits and records every call. [Connect Datadog free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "datadog.users.list_users_v2", intent: "check which Datadog account is connected" } # List all users. · read · 1 upstream call ``` - 586 actions in one signed file - 282 read look, never change - 215 write create and update - 89 wait for a yes destructive, confirmed first Set up ## Connect Datadog in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Datadog. Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` Datadog API key - `app_key` Datadog application key - `site_host` Where your Datadog lives: your site host ``` account { op: "connections.requirements", service: "datadog" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "datadog.users.list_users_v2" } # list all users. · read · 1 upstream call check { action: "datadog.users.disable_user_v1", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Datadog at a glance **Sign-in** Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` `app_key` **Setup fields** `site_host` **Limits we pace to** 1,000 calls a minute, per connection **API covered** Datadog API v1+v2, at your Datadog instance's API base URL, which you enter when connecting **Built from** Datadog's documentation, read 18 September 2026[OpenAPI spec (GitHub)](https://raw.githubusercontent.com/DataDog/datadog-api-client-go/master/.generator/schemas/v1/openapi.yaml) [OpenAPI spec (GitHub)](https://raw.githubusercontent.com/DataDog/datadog-api-client-go/master/.generator/schemas/v2/openapi.yaml) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 266 of 282 reads, for up to an hour; a write clears what it affects **Ready-made plans** 10 in the store **Shared entities** 3, so ask can line Datadog up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Datadog. 586 actions in 1 area. Every one carries its effect, so a key can allow the reads and hold the rest. - **282** read look, never change - **215** write create and update - **89** destructive wait for a confirmation 1. ### Monitoring 586 282 read · 215 write · 89 destructive List all users. · Get a list of incidents. · List Slack user bindings. · List all users. Datadog's own MCP server ## Datadog's MCP server, or actionlake? Datadog runs a remote MCP server that acts with the signed-in user's own Datadog permissions. Use Datadog's server when one person wants to work in Datadog from their own AI client. Use actionlake when you also want Datadog behind the same endpoint as your other systems: a key per agent with allowed actions and a spending cap, a named person's approval before destructive actions, a sealed record of every call, and one ask across Datadog and another system. Source: [Datadog's documentation](https://docs.datadoghq.com/bits_ai/mcp_server/), checked 22 October 2026. Top actions ## The Datadog API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 280 of Datadog's 296 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `datadog.users.list_users_v2` List all users. | List all users. | read | `identity.user.list` 474 connectors | | `datadog.incidents.list_incidents` Get a list of incidents. | Get a list of incidents. | read | `monitoring.incident.list` 19 connectors | | `datadog.users.list_users_v1` List all users. | List all users. | read | `identity.user.list` 474 connectors | | `datadog.hosts.list_hosts` Get all hosts for your organization. | Get all hosts for your organization. | read | `device.endpoint.list` 65 connectors | | `datadog.users.disable_user_v1` Disable a user. | Disable a user. | destructive | `identity.user.delete` 253 connectors | | `datadog.incidents.create_incident` Create an incident. | Create an incident. | write | `monitoring.incident.create` 13 connectors | | `datadog.teams.list_teams` Get all teams. | Get all teams. | read | `identity.group.list` 262 connectors | | `datadog.teams.create_team` Create a team. | Create a team. | write | `identity.group.create` 205 connectors | | `datadog.roles.list_roles` List roles. | List roles. | read | `identity.role.list` 184 connectors | | `datadog.roles.list_role_templates` List role templates. | List role templates. | read | `identity.role.list` 184 connectors | | `datadog.monitors.list_monitors` Get all monitors. | Get all monitors. | read | `monitoring.monitor.list` 32 connectors | | `datadog.monitors.create_monitor` Create a monitor. | Create a monitor. | write | `monitoring.monitor.create` 27 connectors | Try it ## Prompts to paste into Claude. Each one names the Datadog actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Datadog incidents are open, and how long has each been open? calls `datadog.incidents.list_incidents` 2. Plan write Onboard a new team with a role, keys and membership in Datadog. Ask me before anything is sent or changed. calls `datadog.authentication.validate` `datadog.roles.clone_role` `datadog.users.send_invitations` `datadog.teams.update_team_membership` `datadog.service_accounts.create_service_account_application_key` +2 more 3. Plan write Connect a new AWS account to Datadog in Datadog. Ask me before anything is sent or changed. calls `datadog.aws_integration.list_aws_accounts` `datadog.aws_integration.list_aws_namespaces` `datadog.aws_integration.create_new_aws_external_id` `datadog.aws_integration.create_aws_account` `datadog.aws_integration.create_aws_account_ccm_config` +1 more 4. Write write Create an incident in Datadog. Show me exactly what you will send before you save it. calls `datadog.incidents.create_incident` The plan store ## Ready-made plans for Datadog. 10 plans in the store. Install one and your agent runs it by name; the reply says which connections are still missing. A schedule can run a plan on a timetable. There are no triggers or webhooks, by design. 1. ### Build the monthly Datadog cost attribution report Use it when Finance or platform engineering wants a month-end breakdown of Datadog spend by team or product. **Effect** read **Steps** 5 **Needs** end month, start hr, start month and tag keys **Install** `datadog-monthly-cost-attribution-report` 2. ### Triage open security signals and escalate the real ones Use it when A security analyst is working the Datadog signal queue and needs noise archived and real findings escalated. A person decides Archive _number of data_ reviewed signals and escalate signal _escalate signal id_ to an incident. **Effect** write **Steps** 5 **Needs** bulk edit, escalate signal id, incident link and search **Install** `datadog-security-signal-triage` 3. ### Investigate an SLO that has burned its error budget Use it when An SLO has breached and someone needs the burn history plus the metric and event context behind it. A person decides Apply an SLO correction to _slo id_ covering the maintenance window, rewriting its recorded history. **Effect** write **Steps** 6 **Needs** correction, correction id, from ts, metric query, slo id, slo query and to ts **Install** `datadog-slo-breach-investigation` 4. ### Pause synthetic tests for a deploy window Use it when A release window needs Datadog synthetic tests quiet and then restored automatically. **Effect** write **Steps** 6 · loops **Needs** downtime and window **Install** `datadog-synthetic-test-maintenance-window` 5. ### Connect a new AWS account to Datadog Use it when A new AWS account needs connecting to Datadog with cost collection and a checked metric filter. A person decides Connect a new AWS account to Datadog using external id _data_, starting billable metric collection. **Effect** write **Steps** 7 **Needs** account and ccm config **Install** `datadog-aws-account-integration-setup` 6. ### Open an incident and wire up its first responders Use it when A new Datadog incident has been declared and needs impact, responders and triage todos attached. **Effect** write **Steps** 7 **Needs** impact, incident id, page and responder **Install** `datadog-incident-triage-kickoff` 7. ### Onboard a new team with a role, keys and membership Use it when A new team is joining Datadog and needs a role, invitations, membership and a service account key. A person decides Send Datadog invitations for the new team and grant them the role cloned from _template role id_ as _data_. **Effect** write **Steps** 8 **Needs** app key, invitations, membership, role body, service account id, team id, template role id and user id **Install** `datadog-onboard-team-to-datadog` 8. ### Review and revoke stale application keys Use it when An access review needs old Datadog application keys revoked after sign-off. A person decides Revoke every Datadog application key created before _cutoff_. **Effect** destructive **Steps** 5 · loops **Install** `datadog-stale-application-key-cleanup` 9. ### Audit unused dashboards and dashboard lists Use it when Someone wants to find and clear out Datadog dashboards and lists nobody looks at any more. A person decides Delete the empty Datadog dashboard lists found in this audit; _number of data_ cold dashboards are reported only. **Effect** destructive **Steps** 6 · loops **Install** `datadog-dashboard-usage-audit` 10. ### Safely decommission monitors for a retired service Use it when A service is being retired and its Datadog monitors must be removed without breaking composites. A person decides Delete _number of monitors_ Datadog monitors matching '_service query_'. **Effect** destructive **Steps** 6 · loops **Needs** service query **Install** `datadog-monitor-decommission-sweep` install a plan ``` account { op: "plans.install", slug: "datadog-monthly-cost-attribution-report" } # then ask for it by name; a schedule can run it on a timetable ``` Governance for Datadog ## Destructive actions wait for a yes. 89 Datadog actions are destructive. The first 10: - Disable a user. `datadog.users.disable_user_v1` - Disable a user. `datadog.users.disable_user_v2` - Delete an existing incident. `datadog.incidents.delete_incident` - Remove a team. `datadog.teams.delete_team` - Delete a monitor. `datadog.monitors.delete_monitor` - Delete role. `datadog.roles.delete_role` - Delete an API key. `datadog.key_management.delete_api_key_v1` - Delete an API key. `datadog.key_management.delete_api_key_v2` - Delete an On-Call notification channel for a user. `datadog.on_call.delete_user_notification_channel` - Remove a Slack integration channel. `datadog.slack_integration.remove_slack_integration_channel` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do datadog.incidents.delete_incident confirm_policy: **human** Delete an existing incident.? **intent:** the user asked me to delete an existing incident. run suspended · waiting for a named person · key _datadog-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "datadog-agent", allowed_actions: ["datadog.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "datadog.users.disable_user_v1", approver: "lead@example.com" }, { match: "datadog.users.disable_user_v2", approver: "lead@example.com" }, { match: "datadog.incidents.delete_incident", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Datadog only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Datadog costs on actionlake. Every Datadog action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Datadog refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 586 Datadog actions - 586 actions page each page of a long list is one call - 266 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Datadog action. 586 actions by area: the id your agent calls, what it does, and its effect. **Monitoring 586** - `datadog.incidents.list_incidents` Get a list of incidents. read - `datadog.slack_integration.list_slack_user_bindings` List Slack user bindings. read - `datadog.users.list_users_v1` List all users. read - `datadog.users.list_users_v2` List all users. read - `datadog.audit.list_audit_logs` Get a list of Audit Logs events. read - `datadog.audit.search_audit_logs` Search Audit Logs events. read - and 580 more in this area This index shows a sample of each area. All 586 actions, with their inputs and prices, are in the [catalogue](https://actionlake.com/console/catalogue), which a free sandbox key can search. Questions ## The Datadog MCP server, answered. **Is there a Datadog MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 586 Datadog actions, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Datadog. **Does Datadog have its own MCP server?** Datadog runs a remote MCP server that acts with the signed-in user's own Datadog permissions. (Datadog's documentation, checked 22 October 2026.) Use Datadog's server when one person wants to work in Datadog from their own AI client. Use actionlake when you also want Datadog behind the same endpoint as your other systems: a key per agent with allowed actions and a spending cap, a named person's approval before destructive actions, a sealed record of every call, and one ask across Datadog and another system. **What do I need to connect Datadog?** Datadog API key and Datadog application key. Plus your site host. The free call account { op: "connections.requirements", service: "datadog" } lists exactly what to paste. **Can an AI agent delete or change things in Datadog?** Only if its key allows it, and only with an explicit confirmation. 89 Datadog actions are destructive, including disable a user., delete an existing incident. and remove a team.. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Datadog API limit?** actionlake paces every call to the limits in the Datadog service file: 1,000 calls a minute per connection. Repeated reads are answered from cache (266 Datadog actions can be), which never reaches Datadog. **What does a Datadog action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (586 Datadog actions page). Cache hits, searches, dry runs and calls Datadog refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Datadog API does it cover?** The Datadog API v1+v2 at your Datadog instance's API base URL, which you enter when connecting. It is built from Datadog's documentation as read on 18 September 2026. 586 actions in 1 area, each one in the signed service file (version 1.0.0). **Does actionlake keep my Datadog data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to an hour, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Datadog credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Datadog Shares the most action names with - [Grafana 99](https://actionlake.com/connectors/grafana) - [PostHog 90](https://actionlake.com/connectors/posthog) - [New Relic 68](https://actionlake.com/connectors/new-relic) - [Axiom 47](https://actionlake.com/connectors/axiom) - [Dynatrace 39](https://actionlake.com/connectors/dynatrace) - [Google Cloud Monitoring 36](https://actionlake.com/connectors/google-cloud-monitoring) Joins with, on shared entities - [Acronis Cyber Protect Cloud 3](https://actionlake.com/connectors/acronis-cyber-protect-cloud) - [Rapid7 InsightIDR 3](https://actionlake.com/connectors/rapid7-insightidr) - [Bitdefender GravityZone 3](https://actionlake.com/connectors/bitdefender-gravityzone) - [ESET Connect 3](https://actionlake.com/connectors/eset-connect) - [Palo Alto Networks Cortex XDR 3](https://actionlake.com/connectors/palo-alto-networks-cortex-xdr) - [Microsoft 365 Users 2](https://actionlake.com/connectors/microsoft-365-users) Browse - [All Observability & analytics connectors](https://actionlake.com/connectors/category/observability-and-analytics) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Datadog; the name is the vendor's own. Counts are from the Datadog service file, version 1.0.0. ## Give your agent Datadog today. [Connect Datadog free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/datadog More: https://actionlake.com/llms.txt