During an incident the cost is not reading Datadog, it is getting to the right view. Monitors, logs, events and the incident record all land in the same thread as the theory you are testing — and the key can be scoped read-only, so the agent cannot change what it finds.
An MCP server over the Datadog API, v1 and v2. It reads monitors, dashboards, metric metadata, events, logs and incidents, with support for separate endpoints where your Datadog site uses different ones for logs and metrics.
- Monitors listed and read individually, with their configurations and states
- Dashboards listed and their definitions retrieved
- Available metrics listed, with metadata for any one of them
- Events searched and retrieved within a timeframe
- Logs searched with filtering and sorting, and aggregated
- Incident management data read
A recent Node.js, a Datadog API key from Organization Settings → API Keys, and an Application key from Organization Settings → Application Keys. Application keys inherit every permission of the user who created them, so make a scoped one instead: `monitors_read`, `dashboards_read`, `metrics_read`, `events_read`, `logs_read_data` and `incident_read` cover everything here, and nothing in the server needs write access.
One command plus a key — npm install -g datadog-mcp-server, then supply credentials