Datadog MCP | API Key Datadog connector for AI agents

Tools your monitoring agent reaches for on Datadog, scoped per user.

CALL ANY TOOL

Query metrics, list monitors and incidents, search logs, and surface events from across your stack.

datadog_api_key_validate

Validate api key

Validate the current Datadog API key.

Parameters

Name

Type

Required

Description

—

No parameters required

datadog_audit_logs_search

Search audit logs

datadog_containers_list

List containers

datadog_current_user_get

Get current user

datadog_dashboard_create

Create dashboard

datadog_dashboard_delete

Delete dashboard

datadog_dashboard_update

Update dashboard

datadog_downtime_cancel

Cancel downtime

datadog_event_get

Get event

datadog_events_query

Query events

datadog_host_tags_create

Create host tags

datadog_host_unmute

Host unmute

datadog_incident_update

Update incident

datadog_ip_ranges_list

List ip ranges

datadog_metric_metadata_get

Get metric metadata

datadog_metric_tag_configuration_delete

Delete metric tag configuration

datadog_metrics_submit

Submit metrics

datadog_monitor_create

Create monitor

datadog_permissions_list

List permissions

datadog_rum_application_get

Get rum application

datadog_service_check_submit

Submit service check

datadog_slo_correction_create

Create slo correction

datadog_slo_correction_delete

Delete slo correction

datadog_slo_correction_update

Update slo correction

datadog_synthetics_browser_test_get

Get synthetics browser test

datadog_synthetics_global_variables_list

List synthetics global variables

datadog_synthetics_private_location_create

Create synthetics private location

datadog_synthetics_test_trigger

Trigger synthetics test

datadog_team_membership_add

Add team membership

datadog_team_membership_remove

Remove team membership

For more tools, view docs.

Build your Agent

Drop the toolkit in, point it at the user, and your monitoring agent can use Datadog from the first run.

import { ScalekitClient } from "@scalekit-sdk/node";
import { DynamicStructuredTool } from "@langchain/core/tools";
import { createReactAgent } from "@langchain/langgraph/prebuilt";
import { z } from "zod";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["datadog"], toolNames: ["datadog_metrics_query", "datadog_monitors_list", "datadog_monitor_get"] },
  pageSize: 100,
});

const lcTools = tools.map((t) => new DynamicStructuredTool({
  name: t.tool.definition.name,
  description: t.tool.definition.description,
  schema: z.object({}).passthrough(),
  func: async (args) => {
    const { data } = await sk.tools.executeTool({
      toolName: t.tool.definition.name,
      identifier: "user_123",
      params: args,
    });
    return JSON.stringify(data);
  },
}));

const agent = createReactAgent({ llm, tools: lcTools });

import { ScalekitClient } from "@scalekit-sdk/node";
import OpenAI from "openai";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);
const openai = new OpenAI();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["datadog"], toolNames: ["datadog_metrics_query", "datadog_monitors_list", "datadog_monitor_get"] },
  pageSize: 100,
});

const llmTools = tools.map((t) => ({
  type: "function",
  function: {
    name: t.tool.definition.name,
    description: t.tool.definition.description,
    parameters: t.tool.definition.input_schema,
  },
}));

const resp = await openai.responses.create({
  model: "gpt-4o", input: prompt, tools: llmTools,
});

import { ScalekitClient } from "@scalekit-sdk/node";
import Anthropic from "@anthropic-ai/sdk";

const sk = new ScalekitClient(envUrl, clientId, clientSecret);
const anthropic = new Anthropic();

const { tools } = await sk.tools.listScopedTools("user_123", {
  filter: { connectionNames: ["datadog"], toolNames: ["datadog_metrics_query", "datadog_monitors_list", "datadog_monitor_get"] },
  pageSize: 100,
});

const llmTools = tools.map((t) => ({
  name: t.tool.definition.name,
  description: t.tool.definition.description,
  input_schema: t.tool.definition.input_schema,
}));

const msg = await anthropic.messages.create({
  model: "claude-sonnet-4-6", max_tokens: 1024,
  tools: llmTools,
  messages: [{ role: "user", content: prompt }],
});

import { Agent } from "@google/adk/agents";
import {
  MCPToolset, StreamableHTTPConnectionParams,
} from "@google/adk/tools/mcp";

const toolset = new MCPToolset({
  connectionParams: new StreamableHTTPConnectionParams({
    url: "https://mcp.scalekit.com/datadog",
    headers: { Authorization: `Bearer ${userScopedToken}` },
  }),
});

const agent = new Agent({
  name: "agent", model: "gemini-2.0-flash",
  tools: await toolset.getTools(),
});

Try these prompts

Paste any prompt into your agent to start using Datadog.

Search & recall

Copy the prompt

Copied

List all monitors in ALERT state.

Copy the prompt

Copied

Show me error-rate metrics for the last hour.

Copy the prompt

Copied

Find monitors tagged with [service].

Copy the prompt

Copied

Get the latest incident SEV-1 details.

Metrics & analysis

Copy the prompt

Copied

Query p99 latency for [service] last 7 days.

Copy the prompt

Copied

Show me request rate by endpoint today.

Copy the prompt

Copied

Daily error count for [tag] this week.

Copy the prompt

Copied

Compare CPU usage across [host group].

Incidents & logs

Copy the prompt

Copied

List active incidents right now.

Copy the prompt

Copied

Search logs for [error message] in last 30m.

Copy the prompt

Copied

Which hosts triggered disk-usage alerts today?

Copy the prompt

Copied

Show event stream for [service] last 2 hours.

SEE HOW AUTH WORKS

Users authorize Datadog once. Their credentials stay vaulted, every call is checked, and every action is logged.

Authorize

Your user connects

Datadog

once. We tie it to their identity and the meetings they approved — no shared bot account, no org-wide access

Who:

user ‘A’

when:

Once per user

access:

Limited to user

Store

Their

Datadog

token lives in a vault scoped to them. User A's meetings are never reachable by an agent acting for user B, even on the same connection

vault:

encrypted

scope:

per-user

tokens:

auto-refreshed

Resolve

When your agent calls a

Datadog

tool, we fetch the right token server-side. It never touches your agent, never appears in the LLM context, never shows up in your logs

speed:

~40ms

check:

before every call

seen by:

nobody

Audit

Every

Datadog

tool call is logged — who triggered it, which meeting was fetched, what came back. 90 days of history, tied to the user who authorized it

history:

90 days

export:

SIEM-ready

logged:

every call

Test other agents

Same per-user auth pattern across other monitoring agents and MCP connectors. Working code, live demos, fork what fits.

Engineering Teams

DevOps assistant agent

Polls GitHub for failing checks and stale PRs, opens Linear issues for the ones that need work, and posts a daily digest to Slack. It acts as the engineer, not a shared service account.

Engineering Teams

Slack triage

Polls Slack for new messages, classifies bugs and support requests with a LangGraph router, files GitHub issues or Zendesk tickets, and confirms in the thread.

Engineering Teams

Engineering standup agent

Pulls commits from GitHub and GitLab, tracks issue movement in Jira, and posts a per-engineer standup brief to Slack. Each engineer's activity is read on their own delegated OAuth.

Engineering Teams

Auto release notes agent

Reads merged GitHub PRs, groups them into structured release notes, publishes the page to Notion, and announces the release in Slack. Every call runs on the engineer's own delegated OAuth.

Why Scalekit

Secure your agent's access. Connectors ship in minutes

01.

Metrics queried from the wrong org identity

A shared Datadog API key looks fine in a demo. In production, every metric query and log search is attributed to the service account. Org-level scope collapses. Scalekit resolves the user's key so queries run under the right identity.

// shared API key
key = "dd_api_shared_xxx"
audit → bot_service_account
org_filter → broken

// scalekit · per-user
key = resolve(user_id)
audit → user_abc
scope → enforced ✓

02.

Authentication is not authorization

03.

Multi-tenancy is architectural

04.

Datadog today. Others tomorrow.

“Our agents act across Salesforce, Gong, Google Drive, and more, on behalf of every customer. Scalekit behind the scenes meant we can keep adding tools without ever rebuilding how credentials or tool calling work.”

Venu Madhav Kattagoni

Head of Engineering / Von

FAQs

Frequently Asked Questions

Does the agent access Datadog as the user or as a shared key?

As the user. Each workspace member authorizes once and Scalekit resolves their credential at request time. Audit logs attribute every action to that user, not a shared service account.

Where is the Datadog api key stored?

In Scalekit's managed AES-256 token vault, namespaced per tenant. Refresh is automatic. Revocation is a single dashboard action. Tokens never appear in prompts, logs, or LLM context.

Can I limit what the agent is allowed to do in Datadog?

Yes. Pass a tool name filter to listScopedTools so the monitoring agent only sees the subset you authorize. Pre-API-call scope checks block out-of-policy actions before the request reaches Datadog.

What happens when a user revokes Datadog access?

The connection is invalidated on the next tool call. Subsequent requests for that user fail closed with a clear error. Other users in the tenant remain unaffected. The event is logged for audit.

Can the agent query metrics from other Datadog organizations in a multi-org setup?

Only the organization the authorizing user's API key belongs to. Multi-org setups require a separate API key and connected account per org. Cross-org metric or log access is denied by default.

On this page

Tool and actions Framework Compatibility Starter Prompt Auth Lifecycle Try Other Agents Why Scalekit