aggregate_events
ChatGPTAggregate Datadog events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as event counts by source, event frequency over time, or grouped summaries across tags. For raw event inspection, titles/messages, or tag exploration, use search_datadog_events.
aggregate_rum_events
ChatGPTAggregate Datadog RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis of RUM data such as session counts over time, error counts by page, or p95 loading times by browser or URL path. For raw event inspection or attribute discovery, use search_datadog_rum_events.
aggregate_spans
ChatGPTAggregate Datadog APM spans to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as request counts over time, p95 duration by service or resource, or error counts grouped by endpoint or status code. For raw span inspection or to discover fields to group by or aggregate on, first use search_datadog_spans and optionally request custom_attributes.
analyze_datadog_logs
ChatGPTAnalyze Datadog logs using SQL. Runs against a virtual 'logs' table filtered by your search query. Good for aggregations, counts, group-bys, or peeking at recent logs with LIMIT. To discover custom attributes for extra_columns, first call search_datadog_logs with extra_fields. If a query times out, try a shorter time range.
ask_widget_expert
ChatGPTGet targeted instructions for building a Datadog widget. Returns a concise how-to guide — widget type recommendations, required fields, schema patterns, and an annotated example — that you use to build the widget definition yourself. The expert has deep knowledge of all widget types and schemas but does NOT have access to real telemetry, live data, or the user's environment. Any examples in the response use PLACEHOLDER values for queries. You are responsible for discovering real metric names, log queries, or APM resource names through data exploration tools and substituting them — do not copy example queries directly into a widget without first validating them against real data. Returns focused instructions rather than a full schema dump, so it's cheaper than get_widget_reference. Useful at any stage: choosing a widget type, understanding schema requirements, or debugging an invalid widget.
create_datadog_notebook
ChatGPTCreates a new Datadog notebook. Include key findings, evidence, supporting data, and complete query documentation unless told otherwise. Do not start the first markdown cell with a heading that repeats the notebook name — it is already displayed as the title. Look up widget reference schemas before constructing graph cells.
edit_datadog_notebook
ChatGPTEdits an existing notebook. Can edit cells, metadata (name, template_variables, tags), or both. Look up widget reference schemas before constructing graph cells. Cell modes: (1) Full-replace (default) — replaces all cells; destroys existing comment marks. (2) Append (append_only=true) — adds cells to the end; preserves comment marks. To edit only metadata, omit the cells parameter and provide at least one of name/template_variables/tags. Metadata edits are done on a best effort basis and can be combined with either cell mode.
get_active_feature_flags
ChatGPTdo-not-call
get_change_stories
ChatGPTRetrieve change events for an APM service over a time range. Use to correlate changes with performance issues, errors or incidents. Tracked Change types: deployment (code/version), feature_flag, traffic_anomaly, watchdog (Datadog anomaly detection), kubernetes (k8s deployment manifest updates), scale (manual k8s scale events), crashloopbackoff (k8s crashloops), database (DB schema or setting changes), schema (data stream schemas only; not DB/API schema), configuration (limited to specific tracked sources — absence does not imply no config changed)
get_datadog_dashboard
ChatGPTRetrieves a custom or integration Datadog dashboard by ID, returning its title, description, tags, and widgets. Use search_datadog_dashboards first to find dashboard IDs.
get_datadog_incident
ChatGPTGet detailed information about a specific Datadog incident by ID, including status, severity, timeline, associated users, and attachments.
get_datadog_metric
ChatGPTQuery metrics data from Datadog. Use response_format='timeseries' (default) to get time-indexed data points for graphs and trend analysis. Use response_format='scalar' to get a single aggregated value per group, useful for current state, summaries, and comparisons. For response_format='scalar', use structured query objects; the aggregator field controls how the time window collapses to a single value and defaults to avg if omitted. The query prefix, such as avg: or sum:, is not the scalar aggregator field. Supports multiple queries in one call plus formula expressions. Query syntax: grouping must come before modifiers, e.g. 'sum:trace.http.request.errors{env:prod} by {service}.as_count()', not '.as_count() by {service}'. Within {...}, do not mix comma-separated tag filters with boolean filters; if any top-level filter uses AND, OR, NOT, or IN, join top-level filters with explicit AND and parenthesize OR groups, e.g. '{(service:api OR service:worker) AND datacenter:us1.prod.dog}', not '{service:api OR service:worker,datacenter:us1.prod.dog}'.
get_datadog_metric_context
ChatGPTGet metadata (description, type, unit, integration), available tags/dimensions, and optionally related assets for a metric. Useful for exploring metrics before querying them. Set use_cloud_cost=true for Cloud Cost Management metrics.
get_datadog_notebook
ChatGPTRetrieve information about a specific Datadog notebook by ID. This tool provides details including name, status, and associated author. The ID can also be extracted from a URL. The ID will be the last component, for example, <host>/notebook/<ID>.
get_datadog_trace
ChatGPTRetrieve a trace by trace ID from Datadog APM. This tool fetches all spans within a specific trace by default, providing detailed information about the request flow, timing, and service interactions. For large traces or to retrieve a summarized trace, set only_service_entry_spans=true to get a hierarchical condensed view that shows service boundaries, collapsing internal operations. The summarized view will indicate expandable spans with hidden_child_spans_count. The response includes a trace_deep_link_url in metadata that links directly to the trace flamegraph in the Datadog UI.
get_user_config
ChatGPTdo-not-call
get_widget
ChatGPTRetrieve and visualize Datadog metrics, traces, logs, and other data as interactive charts. Use this tool whenever users ask to see, show, graph, plot, visualize, or rank Datadog data — including ranking-style queries like 'which hosts/services/pods have the most/least X', 'top N by Y', or 'breakdown by Z'. Covers metrics timeseries, request counts, latency, error rates, toplists, and distributions. This tool renders the chart directly and does not require pre-fetched data — raw-data tools alone aren't sufficient for visualization requests. Input modes: Direct definition (write a new widget via widget_definition), By ID (existing widget via dashboard_id + widget_id), or By URL (Datadog widget_url). Supported interactive types: bar_chart, change, cohort, distribution, funnel, heatmap, list_stream, query_table, query_value, retention_curve, sankey, scatterplot, sunburst, timeseries, toplist, treemap. Before constructing widget_definition, load the datadog/visualizations skill for schema patterns, response shape, and recovery.
get_widget_data_fetcher
ChatGPTdo-not-call
get_widget_reference
ChatGPTGet TypeScript schemas and building instructions for widget types. Call before generating widget JSON. Note: "group" is a container for organizing related widgets — include both "group" and any intended child widget type/s in one call for deduplication.
get_widget_reference_compressed
ChatGPTGet compressed TypeScript schemas and building instructions for widget types. Call before generating widget JSON. Note: "group" is a container for organizing related widgets — include both "group" and any intended child widget type/s in one call for deduplication.
list_datadog_skills
ChatGPTList available Datadog skill guides. Skills document how to use Datadog's tools: the right attributes, query syntax, and common pitfalls. Call this before load_datadog_skill whenever you are not already certain of the exact skill name; skill names are not predictable from topic words. Use query for fuzzy search across name and description (results are ranked). Use include_header=true to see one-line summaries alongside names. Load skills proactively when starting work in a relevant Datadog domain, not after errors.
load_datadog_skill
ChatGPTLoad a Datadog skill guide before using related Datadog tools. Skills improve query quality by documenting the right attributes, syntax, and common pitfalls. Skill names depend on the visible toolsets; if you do not already know the exact skill name from a prior list_datadog_skills response, call list_datadog_skills first and do not guess names from topic keywords. Set header_only=true to preview a skill's summary, related skills, and bundled resources. Set resource_path to load a specific bundled reference.
search_datadog_dashboards
ChatGPTList and retrieve information about Datadog dashboards. This tool helps discover available dashboards, their IDs, titles, and underlying queries. Use this tool when you need to find specific dashboards, get an overview of all dashboards in your Datadog account, or find important logs+metrics queries in dashboards.
search_datadog_events
ChatGPTSearch and retrieve raw Datadog events (deployments, alerts, system activities, infrastructure changes, etc.). Do NOT use for counts, aggregations, or grouped analysis — use aggregate_events instead. Best for: inspecting individual events, reading event titles/messages/tags, and exploring event patterns before deciding how to aggregate them. Supports complex queries with boolean operators and tag filtering. Results include event titles, messages, timestamps, and tags.
search_datadog_hosts
ChatGPTExplore Datadog hosts inventory with SQL. Queries run against the virtual 'hosts' table backed by "dd.hosts" (Advanced Query API), which exposes hostname, hostname_aliases (text[]; use hostname_aliases[1]), tags (hstore map; use tags->'key'), cloud_provider, resource_type, instance_type, os, os_version, agent_version, memory_mib, cpu (hstore map; use cpu->'key'), kernel (hstore map; use kernel->'key'), sources (text[]; use sources[1]), modification_detected_at (timestamp). DDSQL notes: DDSQL (Datadog SQL) is a PostgreSQL subset: every non-aggregated SELECT column must appear in GROUP BY, SELECT aliases cannot be reused in WHERE/GROUP BY/HAVING (repeat the full expression instead, e.g., GROUP BY DATE_TRUNC('hour', timestamp) not GROUP BY hour), and only declared table columns may be referenced. Use the -> operator or json_extract_path_text (cast as needed) for JSON access. Avoid unsupported constructs like ANY(), ->>, QUALIFY, information_schema, and current_timestamp. Column names containing special characters like '@' must be quoted (e.g., SELECT "@foo" FROM logs).
search_datadog_incidents
ChatGPTSearch Datadog incidents. Default sort: newest first. Supports filtering by state, severity, title, team, creation time, and more. Use semantic_query for natural-language search over AI-generated incident summaries. Prefer query first; only add semantic_query when query by keyword and metadata filters aren't sufficient to answer the question.
search_datadog_logs
ChatGPTSearch and retrieve raw log entries or log patterns. Do NOT use for counting or aggregations — use analyze_datadog_logs instead. Best for: viewing raw logs, discovering patterns (use_log_patterns=true), and discovering custom attributes via extra_fields for use as extra_columns in analyze_datadog_logs. Response shape (when extra_fields is set, output is YAML): three buckets — (1) top-level fields like env/host/service queried bare (env:prod); (2) attributes: map with source-prefixed keys — custom.X and attributes.X are queried as @X (strip the bucket prefix), but error.X keeps its prefix as @error.X because error is a real top-level attribute; (3) tags: list of key:value strings queried bare. Load the datadog/logs skill for the full key-translation table.
search_datadog_metrics
ChatGPTList available metrics in Datadog with optional filtering by name and tags. Set use_cloud_cost=true to search Cloud Cost Management metrics.
search_datadog_monitors
ChatGPTList and retrieve information about Datadog monitors. This tool helps discover monitors, their status, configuration, and alerts. Use this tool when you need to find monitors for investigation, management, or analysis purposes.
search_datadog_notebooks
ChatGPTSearch Datadog notebooks. Use this tool when you need to find notebooks for investigation or monitoring purposes. Results can be filtered, for example by author, and sorted. This tool returns snippets of the original notebook. To fetch the entire notebook, use the get_datadog_notebook tool.
search_datadog_rum_events
ChatGPTSearch and retrieve raw Datadog RUM events using advanced query syntax. Do NOT use for counts, aggregations, or grouped analysis. Best for: inspecting individual RUM events, debugging specific user experience issues, exploring available event attributes in raw or detailed_output responses before deciding what to aggregate. Supports filtering by event types (session, view, action, error, resource, long_task, vital, operation), user attributes, performance metrics, and more. Results include detailed event data for analysis.
search_datadog_service_dependencies
ChatGPTRetrieve information about Datadog service dependencies. This tool helps discover upstream and downstream service dependencies in your environment as well as services owned by a given team. Use this tool when you need to find services for investigation, management, or analysis purposes. Either service or team must be supplied but not both; service for service dependencies, team for service ownership. If the capability exists, the service dependencies can be displayed visually as a graph, for example, as a Mermaid diagram. If outputting to them to a notebook, the mermaid markdown type can be used. If making any assumptions about service dependencies, ensure they are explicitly stated to the user.
search_datadog_services
ChatGPTList and retrieve information about Datadog services. This tool helps discover services in your environment, their descriptions, teams, and links. Use this tool when you need to find services for investigation, management, or analysis purposes. Each result includes both 'name' (the internal service identifier, e.g. used in APM/log queries as 'service:<identifier>') and 'display_name' (the human-readable label from the service catalog). For most services these are identical; they differ when a custom displayName is set in the catalog YAML.
search_datadog_spans
ChatGPTRetrieve raw Datadog APM spans matching a query. Do NOT use for counts, aggregations, or grouped analysis — use aggregate_spans instead. Best for: inspecting individual spans, debugging request flows and failures, and discovering span fields/attributes, including via custom_attributes, that you may want to aggregate or group by with aggregate_spans. IMPORTANT: When the user asks for 'security traces', 'AppSec traces', 'AAP traces', 'security activity', or 'security signals on traces', the query MUST start from @appsec.security_activity:*. Do NOT substitute keyword-based guesses like service:*security*, resource_name:*auth*, @http.status_code:401, etc. — those do not identify security traces. Application & API Protection (AAP) spans carry these standard attributes (all strings): @appsec.security_activity (<category>.<type>, e.g. attack_attempt.sql_injection, business_logic.users.login.failure; multi-valued when multiple rules match); @appsec.category (top-level classification, e.g. attack_attempt, business_logic); @appsec.type (specific threat/event type, e.g. sql_injection, xss, users.login.failure); @appsec.rule_id (AAP rule that matched, e.g. crs-942-100; multi-valued); @appsec.blocked (true/false, whether AAP blocked the request). Use these attributes to narrow AppSec queries (e.g. @appsec.category:attack_attempt, @appsec.type:sql_injection, @appsec.blocked:true). The response includes a traces_explorer_url for the overall query. To link to an individual trace in the Datadog UI, use the pattern: <base_url>/apm/trace/<trace_id> (e.g. https://app.datadoghq.com/apm/trace/abc123). The base_url for the user's org is available in the response metadata.
submit_mcp_feedback
ChatGPTSubmit feedback about capabilities provided by this Datadog MCP server only. Do NOT submit feedback about other MCP servers or plugins (e.g. Atlassian, CodeSandbox, Slack, GitHub). After completing a task, briefly consider whether any Datadog MCP capability was notably unhelpful or whether the workflow was harder than it should have been. If so, submit feedback so the MCP team can improve the experience. You should submit feedback when: - A Datadog MCP capability produced wrong, misleading, or unhelpful results that impacted your ability to help the user. - A Datadog MCP capability's output was missing key information that would have been useful. - You could not accomplish something the user asked for because no Datadog MCP capability exists for it. - A Datadog MCP workflow required many steps or workarounds that could be streamlined. - A Datadog MCP capability's interface was confusing or its parameters were unclear. Keep it to one submission per distinct issue per conversation. Skip transient errors (timeouts, rate limits) that resolved on retry.
upsert_datadog_dashboard
ChatGPTCreates or updates a Datadog ordered-grid dashboard. New dashboards are always ordered; widget updates are only supported on ordered dashboards. When updating widgets, prefer diff-style payloads to minimize tokens: send full definitions only for new or changed widgets, include {"id": N} for unchanged widgets to keep, and omit existing widgets only when deleting them.
validate_dashboard_widget
ChatGPTValidate a widget definition against the dashboard schema. Call when generating a widget JSON.
visualize_tabular_data
ChatGPTRender tabular data as an interactive visualization (sunburst, treemap, or toplist). WHEN TO USE: - After aggregating data from queries (GROUP BY, analytics, metrics) to visualize hierarchical relationships or rankings - For ad-hoc visualization of data you've already fetched and transformed - When you have grouped data and want to show proportional breakdowns or parent-child relationships ALTERNATIVES: - Use get_widget to directly render data from existing dashboard widgets - Use swap_widget_type to convert saved widget definitions between types
aap_onboarding
Claudeaggregate_datadog_ci_pipeline_events
Claudeaggregate_datadog_test_events
Claudeaggregate_dora_deployments
Claudeaggregate_events
Claudeaggregate_rum_events
Claudeaggregate_spans
Claudeanalyze_cloud_network_monitoring
Claudeanalyze_datadog_logs
Claudeanalyze_datadog_security_signals
Claudeanalyze_security_findings
Claudeappend_reference_table_rows
Claudeask_widget_expert
Claudebrowser_onboarding
Claudecheck-flag-implementation
Claudecheck_datadog_mcp_setup
Claudecode_coverage_onboarding
Claudeconfigure_toolsets
Claudecreate-feature-flag
Claudecreate_datadog_monitor
Claudecreate_datadog_notebook
Claudecreate_datadog_security_detection_rule
Claudecreate_datadog_security_suppression
Claudecreate_reference_table
Claudecws_agent_events_schema
Claudeddsql_create_link
Claudeddsql_get_spec
Claudeddsql_read_saved_query
Claudeddsql_run_query
Claudeddsql_schema_get_table_columns
Claudeddsql_schema_search_tables
Claudeddsql_schema_search_unstructured_fields
Claudeddsql_search_saved_queries
Claudeddsql_upsert_saved_query
Claudedelete_datadog_dashboard
Claudedelete_datadog_security_detection_rules
Claudedelete_datadog_security_suppression
Claudedelete_llmobs_evaluator
Claudedescribe_datadog_k8s_resource
Claudedevices_onboarding
Claudediff_network_device_configurations
Claudedocker_onboarding
Claudeecs_onboarding
Claudeedit_datadog_notebook
Claudeedit_synthetics_tests
Claudeexecute_datadog_workflow
Claudeexpand_llmobs_spans
Claudeexplore_profiling_call_graph
Claudeexplore_profiling_flame_graph
Claudeexplore_profiling_timeline
Claudefind_datadog_database_instances
Claudefind_llmobs_error_spans
Claudegenerate_monitor_definition
Claudegenerate_monitor_message
Claudeget-canary-results
Claudeget-feature-flag
Claudeget-guardrail-metric
Claudeget_datadog_code_coverage_branch_summary
Claudeget_datadog_code_coverage_commit_summary
Claudeget_datadog_dashboard
Claudeget_datadog_database_calling_services
Claudeget_datadog_database_explain_plans
Claudeget_datadog_database_health_signals
Claudeget_datadog_database_query_performance
Claudeget_datadog_database_query_statement
Claudeget_datadog_database_recommendations
Claudeget_datadog_database_schemas
Claudeget_datadog_error_tracking_issue
Claudeget_datadog_flaky_tests
Claudeget_datadog_flaky_tests_management_policies
Claudeget_datadog_incident
Claudeget_datadog_k8s_manifest
Claudeget_datadog_metric
Claudeget_datadog_metric_context
Claudeget_datadog_notebook
Claudeget_datadog_security_detection_rule
Claudeget_datadog_security_detection_rules_schema
Claudeget_datadog_security_signal
Claudeget_datadog_security_signals_schema
Claudeget_datadog_security_suppressions
Claudeget_datadog_test_optimization_settings
Claudeget_datadog_trace
Claudeget_datadog_workflow
Claudeget_datadog_workflow_instance
Claudeget_kafka_client_configuration
Claudeget_kafka_schema_registry_subject_versions
Claudeget_llmobs_agent_loop
Claudeget_llmobs_eval_aggregate_stats
Claudeget_llmobs_eval_config
Claudeget_llmobs_evaluator
Claudeget_llmobs_experiment_dimension_values
Claudeget_llmobs_experiment_event
Claudeget_llmobs_experiment_metric_values
Claudeget_llmobs_experiment_summary
Claudeget_llmobs_span_content
Claudeget_llmobs_span_details
Claudeget_llmobs_trace
Claudeget_monitor_coverage
Claudeget_monitor_templates
Claudeget_ndm_device
Claudeget_network_device_configuration
Claudeget_network_path_test_runs
Claudeget_notification_handles
Claudeget_profiling_field_values
Claudeget_profiling_fields
Claudeget_profiling_profile_types
Claudeget_profiling_runtime_ids
Claudeget_profiling_service_insights
Claudeget_profiling_services
Claudeget_profiling_tag_names
Claudeget_profiling_tag_values
Claudeget_profiling_timeseries
Claudeget_prs_by_head_branch
Claudeget_reference_table_rows
Claudeget_synthetics_tests
Claudeget_widget
Claudeget_widget_reference
Claudekubernetes_onboarding
Claudelaunch_llmobs_experiment
Claudelinux_onboarding
Claudelist-allocations-for-feature-flag
Claudelist-environments
Claudelist-feature-flags
Claudelist-guardrail-metrics
Claudelist_datadog_security_detection_rules
Claudelist_datadog_skills
Claudelist_datadog_workflows
Claudelist_kafka_broker_configuration_versions
Claudelist_kafka_schema_registry_schemas
Claudelist_kafka_topic_configuration_versions
Claudelist_llmobs_evals
Claudelist_llmobs_evals_by_ml_app
Claudelist_llmobs_experiment_events
Claudelist_mcp_feedback
Claudelist_reference_table_rows
Claudelist_reference_tables
Claudellm_observability_onboarding
Claudeload_datadog_skill
Claudemonitor_groups_search
Claudeoptimize_datadog_database_query
Clauderead_kafka_messages
Clauderecommend_monitor_threshold
Clauderetry_datadog_ci_job
Claudesearch_cws_agent_events
Claudesearch_datadog_ci_pipeline_events
Claudesearch_datadog_dashboards
Claudesearch_datadog_database_plans
Claudesearch_datadog_database_samples
Claudesearch_datadog_dbm_plans
Claudesearch_datadog_dbm_samples
Claudesearch_datadog_error_tracking_issues
Claudesearch_datadog_events
Claudesearch_datadog_hosts
Claudesearch_datadog_incidents
Claudesearch_datadog_k8s_resources
Claudesearch_datadog_logs
Claudesearch_datadog_metrics
Claudesearch_datadog_monitors
Claudesearch_datadog_notebooks
Claudesearch_datadog_rum_events
Claudesearch_datadog_security_signals
Claudesearch_datadog_service_dependencies
Claudesearch_datadog_services
Claudesearch_datadog_slos
Claudesearch_datadog_spans
Claudesearch_datadog_test_events
Claudesearch_dora_deployments
Claudesearch_llmobs_spans
Claudesearch_ndm_devices
Claudesearch_ndm_interfaces
Claudesearch_network_device_configurations
Claudesearch_pr_insights
Claudesearch_security_findings
Claudesecurity_findings_schema
Claudesecurity_signals_schema
Claudeserverless_onboarding
Claudesource_map_uploads
Claudestudio_onboarding
Claudesubmit_mcp_feedback
Claudesync-allocations-for-feature-flag-environment
Claudesynthetics_test_wizard
Claudetest_optimization_onboarding
Claudeupdate-feature-flag-environment
Claudeupdate_datadog_error_tracking_issue
Claudeupdate_datadog_flaky_test_states
Claudeupdate_datadog_security_detection_rule
Claudeupdate_datadog_security_signals_triage
Claudeupdate_datadog_security_suppression
Claudeupdate_datadog_workflow_with_agent_trigger
Claudeupsert_datadog_dashboard
Claudeupsert_llmobs_evaluator
Claudevalidate_dashboard_widget
Claudevalidate_monitor_definition
Claudevisualize_tabular_data
Claude
