Monitoring · 1 skill

Datadog MCP and Claude skills

Pull monitors in alert, open incidents, error logs and SLO status from Datadog, and report what is firing and what changed since yesterday.

Connect Datadog to your agent (MCP)

Datadog MCP Server, Datadog's official remote server at https://mcp.datadoghq.com/v1/mcp for US1. Other sites have their own host, such as https://mcp.datadoghq.eu/v1/mcp or https://mcp.us5.datadoghq.com/v1/mcp, and US government sites aren't supported. In Claude Code, install the Datadog plugin with /plugin install datadog@claude-plugins-official and run /ddsetup, or run claude mcp add --transport http datadog-mcp https://mcp.datadoghq.com/v1/mcp. In Codex, add the URL under [mcp_servers.datadog] in ~/.codex/config.toml and run codex mcp login datadog; in Cursor, install the Datadog plugin. Only the core toolset is on by default; add ?toolsets= to the URL for more (setup).
API with an API key and an application key. Store them in DD_API_KEY and DD_APP_KEY with DD_SITE (datadoghq.com, datadoghq.eu and so on) and send them as the DD-API-KEY and DD-APPLICATION-KEY headers. Scope the application key to what the report reads, such as monitors_read, incident_read and slos_read. The MCP server also accepts a key pair from a scoped service account for clients without OAuth.

People need the mcp_read permission to use the server; leave out mcp_write, or keep MCP Write Access off for the organization, and the agent can't create or edit monitors or notebooks.

1 Datadog skill

Datadog monitors in alert

Every hour of the working day: Datadog monitors in Alert or Warn, how long each has been there, and what is new or recovered since the hour before.

DevOpsHourly, 8:00 to 18:00 on weekdaysReport card

What agents do with Datadog

Datadog's API is split by product, and reports lean on a few endpoints. GET /api/v1/monitor/search?query=status:alert (or status:warn, muted:false, tag:team:payments) finds monitors by state, and GET /api/v1/monitor with group_states=alert returns which groups, such as hosts or services, are triggering. Incidents come from GET /api/v2/incidents, logs from POST /api/v2/logs/events/search with a query like service:checkout status:error, metrics from GET /api/v1/query, and SLOs with their status and remaining error budget from GET /api/v1/slo and its history endpoint. Requests go to your site's host, such as api.datadoghq.com or api.datadoghq.eu.

On-call and platform teams schedule a morning list of monitors in alert or warn with how long each has been firing, the week's incidents by severity and time to resolve, SLOs burning error budget faster than planned, and the noisiest monitors of the week.

datadoghq.com

Teams that use these

Your Datadog numbers, on one board with everything else

Skills are free to use with any agent. Briefkin is where their results land: one board for every report, number and question your agents send, with a ping when something needs you.

Join the open beta Browse all skills

Free during the open beta. No card.