Datadog MCP

Check whether Datadog App and API Protection (AAP) can be enabled for a service via Remote Configuration (RC), with no code changes. Use when the user asks to install, set up, enable, or onboard AAP for a service and environment. Returns a verdict with a recommended navigation action: the Service Inventory side-panel when RC is available, or the AAP setup page otherwise.

Step-by-step instructions for enabling Datadog App and API Protection (AAP) to monitor and secure your application. AAP detects security threats, vulnerabilities, and attacks in real time by using Datadog tracing libraries for application deployments, the Datadog security processor for Envoy deployments, the Datadog SPOA for HAProxy deployments, or the Datadog nginx module for nginx deployments. You MUST first review the user's project and fill out as many arguments as possible before calling this tool. You MUST NOT call this tool without first examining the project's codebase to determine the correct argument values.

Queue traces, sessions, or spans for human review in an annotation queue. This is how findings become review work: use **search_llmobs_spans** or **find_llmobs_error_spans** to identify the traces worth grading, then queue them here. Returns `interactions` — each with the `id` that **upsert_llmobs_annotations** writes labels against — and an `errors` array for the items that did not land. Re-adding content the queue already holds is not an error: the existing interaction comes back with `already_existed: true`. Queueing content does not annotate it. Grade it with **upsert_llmobs_annotations**.

Create records in a dataset. **Two-step**: PREVIEW (`confirmed=false`) → INSERT (`confirmed=true`). - `confirmed=false`: does NOT insert. Validates that the (project_id, dataset_id) pair exists, then returns `AddDatasetRecordsPreview` with the resolved IDs, planned record count, tag union, first-record content, and a `confirmation_prompt` string. If the dataset does not exist, returns `DatasetRecordToolError(reason="unknown_dataset")` — re-resolve by NAME via get_llmobs_project + list_llmobs_datasets and retry rather than telling the user the dataset was deleted. Show the preview to the user, ask for explicit approval, then re-call with `confirmed=true`. - `confirmed=true`: validates UUIDs, issues the API call. Author is recorded automatically as the human user from the forwarded JWT — do not pass an author ID. `create_new_version=true` (default) bumps the dataset version on insert (the typical "save as a new versioned snapshot" — what experimentation needs). Set false only for in-place batched edits where the user explicitly asked to keep the current version. On failure returns `DatasetRecordToolError` with `reason`, `recovery_hint`, and the offending value. Reasons: `invalid_project_id`, `invalid_dataset_id`, `unknown_dataset`, `forbidden_action_dataset`, `record_size_exceeded`, `invalid_request`, `transport_error`. Once `confirmed=true` succeeds, do NOT retry the call (the work is committed). If a network error makes the result ambiguous, call **get_llmobs_dataset_records** to verify before retrying. When the user wants to append records, sample existing records via **get_llmobs_dataset_records** first, read the `schema_summary`, and construct matching new records before this tool. Always preview (`confirmed=false`) and confirm with the user before writing.

Aggregate and analyze CI pipeline events to produce statistics, metrics, and grouped analytics. Use it for questions such as average pipeline duration or failed builds per pipeline. For individual event details or error messages, use search_datadog_ci_pipeline_events instead. aggregation is required and must be one of count, cardinality, avg, sum, min, max, pc50, pc75, pc90, pc95, or pc99. Use cardinality with metric set to a facet (such as @ci.pipeline.id) to count distinct values. If no data is available, try a wider time range. Results are ordered by aggregation value descending; use search_datadog_ci_pipeline_events for sorted individual event listings. If unsure whether a facet exists or needs an @ prefix, read the datadog://mcp/ci-pipeline-facets resource.

Aggregate Datadog test events for reliability, performance, and execution trends. Use search_datadog_test_events for individual event details. aggregation is required and must be one of count, cardinality, avg, sum, min, max, pc50, pc75, pc90, pc95, or pc99. Use cardinality with metric set to a facet (such as @test.name) to count distinct values. Use at most two or three group_by facets and add filters to stay within the 10,000-group limit. If unsure whether a facet exists or needs an @ prefix, read the datadog://mcp/ci-test-facets resource.

Aggregate DORA events into scalar values or timeseries using composable queries and formulas. Each query selects a DORA index, optional metric, aggregation, filter, and group_by facets. Use get_dora_fields to discover valid indexes, measures, facets, cardinality fields, and aggregations.

Aggregate Datadog events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P98, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as event counts by source, event frequency over time, or grouped summaries across tags. For raw event inspection, titles/messages, or tag exploration, use search_datadog_events.

Aggregate Datadog RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P98, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis of RUM data such as session counts over time, error counts by page, or p95 loading times by browser or URL path. For raw event inspection or attribute discovery, use search_datadog_rum_events.

Aggregate Datadog APM spans to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P98, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as request counts over time, p95 duration by service or resource, or error counts grouped by endpoint or status code. For raw span inspection or to discover fields to group by or aggregate on, first use search_datadog_spans and optionally request custom_attributes.

Assemble a Kubernetes Deployment rollout in one call: status, progress, timing (ETA while in progress, duration once finished), the new/previous/old ReplicaSet split by revision, and before/after impact series (RED, resource utilization, log counts). Prefer this over stitching together search_datadog_k8s_resources and describe_datadog_k8s_resource for rollout questions. Values are already computed; do not re-derive them. Only reports on Deployments whose kube_rollout_status is inprogress, recentlycompleted or recentlyfailed. Any other Deployment returns its own fields plus a warning, because a rollout that finished long ago has nothing to analyse. Load the datadog/analyze-kubernetes-rollout skill to turn this output into an answer. It carries the summary format to present, how to read the impact series, pacing and maxSurge/maxUnavailable advice, and how to name the blocker when a rollout is stuck — none of which is derivable from this payload. Do not hand back the raw JSON. IMPORTANT: Either uid OR resource_identifiers MUST be provided. If both are provided, uid takes precedence and resource_identifiers is ignored. - Use resource_identifiers when you know the Deployment details (cluster, namespace, name) - DO NOT search first - Use uid ONLY if you obtained it from a previous search

Queries Cloud Network Monitoring (CNM) data to view network/transport level information. Use to investigate netork latency, packet loss, TCP failed connections, dial timeouts, or spikes in TCP throughput. Each query accepts a 'scope' field to select which slice of CNM data to query: - 'tcp' (default): service-to-service L4/TCP flows. Use for investigating connection errors between workloads. - 'tcp-eudm': endpoint/device-centric L4 flows. Use for investigating networking issues originating from end-user devices rather than between services. Scenario 1: clearsky is encountering "failed to connect" errors. Find the unhealthy pods: ```json { "from": "now-1h", "queries": [ {"client_tags": ["service:clearsky"], "client_group_by": "pod_name", "order_by": "retransmits"}, {"client_tags": ["service:clearsky"], "client_group_by": "pod_name", "order_by": "tcp_failed_conns"} ] } ``` Scenario 2: Cloud storage is rate-limiting clients with HTTP 429. View which services are pulling too much data: ```json { "from": "now-1h", "group_limit": 100, "time_buckets": 1, "queries": [ {"server_tags": ["service:aws.s3"], "client_group_by": "service", "order_by": "bytes_server_to_client"}, {"server_tags": ["service:gcp.storage"], "client_group_by": "service", "order_by": "bytes_server_to_client"} ] } ``` Scenario 3: An end-user device reports slow/failing connections. Investigate the destinations it is reaching using EUDM data: ```json { "from": "now-1h", "queries": [ {"scope": "tcp-eudm", "client_tags": "host:i-abc123", "server_group_by": "service", "order_by": "tcp_failed_conns"}, {"scope": "tcp-eudm", "client_tags": "host:i-abc123", "server_group_by": "service", "order_by": "retransmits"} ] } ``` Each result's 'query' includes 'analytics_url', a deep link to the Network Analytics view for that query's filter, group-by, order-by, and time window. Always present this link to the user alongside the answer.

Analyze Datadog Error Tracking error samples with SQL — aggregations, breakdowns by tag/service/version, or raw sample inspection. Runs against a virtual 'errors' table of individual error events (not Issues, which are groups of errors). Column names: no @ = root/tag attribute (e.g. usr.id, service), @ = custom attribute (e.g. @my.field). For ranked Issues by priority/volume use search_datadog_error_tracking_issues — do not GROUP BY issue.id as a substitute. Over wide time ranges, add LIMIT or a narrow GROUP BY; shorten the range if it times out.

Analyze Datadog logs using SQL. Runs against a virtual 'logs' table filtered by your search query. Good for aggregations, counts, group-bys, or peeking at recent logs with LIMIT. To discover custom attributes for extra_columns, first call search_datadog_logs with extra_fields. If a query times out, try a shorter time range. MUST load the datadog/ddsql skill before calling this tool.

Primary tool for analyzing security findings. Use this for all security findings analysis tasks. REQUIRED: Call get_datadog_security_findings_schema FIRST to get available fields and their types before writing SQL. Queries live data from the last 24 hours using flexible SQL aggregations, filtering, and grouping. IMPORTANT: When users ask 'what should I fix?' or 'what are my top vulnerabilities?', prioritize by RISK ATTRIBUTES (@risk.*) not just severity. DEEP LINKS: Always link to findings when you have the id — format: <deep_link_base_url>/security/finding/<finding_id>. The correct base URL is in every response as 'deep_link_base_url'. Read the sql_query parameter description carefully — it explains risk-based prioritization, deep link generation, function syntax, common pitfalls, and includes examples. Only fall back to search_datadog_security_findings if you need full finding details or this tool fails. To create a case, Jira issue, or ServiceNow ticket for findings, use create_datadog_security_findings_ticket.

Count, group, or trend security signals using DDSQL — for any aggregate question: 'how many', 'top N', 'by severity', 'over time', or breakdown. Do NOT use for listing, retrieving, or checking existence of specific signals — use search_datadog_security_signals instead. IMPORTANT: When constructing the SQL query, ALWAYS use the table-valued function syntax — FROM dd.security_signals(columns => ARRAY[...], filter => '...'). IMPORTANT: If the user has NOT specified a signal product (Cloud SIEM / Log Detection, App & API Protection / Application Security, or Workload Protection / Workload Security), ASK them if they want to specify the product or rule type before calling this tool. Workflow: ALWAYS call get_datadog_security_signals_schema first to discover available fields, then use this tool with SQL.

Primary tool for analyzing security findings. (Also available as analyze_datadog_security_findings.) Use this for all security findings analysis tasks. REQUIRED: Call security_findings_schema FIRST to get available fields and their types before writing SQL.

Create a new RUM retention filter, appended at the end of the evaluation order. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects billing.** Adding a filter or enabling cross-product sampling increases indexed volume and cost. **Always confirm the exact change with the user before calling. Never create a filter speculatively.** name, event_type, and sample_rate are required. event_type: one of session, view, action, error, resource, long_task, vital, operation. sample_rate: 0.1 to 100 (percent of matching events retained). cross_product_sampling: optional extra retention for session replays and APM traces of matching sessions; session_replay_sample_rate and trace_sample_rate are both required within it. The new filter is appended at the end of the evaluation order. Filters are evaluated top-down, so a broad catch-all already at the end may capture matching events before this filter applies; reorder afterwards with reorder_rum_retention_filters to place specific filters above broad ones. Creates are idempotent: a retried create that matches an existing filter exactly is not duplicated. To change an existing filter use update_rum_retention_filter; to remove one use delete_rum_retention_filter. Find existing filters with search_rum_retention_filters.

Append (add) new rows to an existing reference table. Prefer upsert_reference_table_rows when you may need to update existing rows — it handles both inserts and updates. Use this tool only when you are certain all rows are new. Each row must include all required fields from the table's schema, including the primary key field. Use list_reference_tables to discover table IDs and schemas first. Example: rows: [{"user_id": "user001", "name": "Alice", "age": 25}, {"user_id": "user002", "name": "Bob", "age": 30}]

Archive a single feature flag by ID or key; pair with list-stale-feature-flags to discover candidates. Provide featureFlagID or featureFlagKey (if both are given, featureFlagID wins).

Archive a saved filter (reversible via unarchive-saved-filter).

Get targeted instructions for building a Datadog widget. Returns a concise how-to guide — widget type recommendations, required fields, schema patterns, and an annotated example — that you use to build the widget definition yourself. The expert has deep knowledge of all widget types and schemas but does NOT have access to real telemetry, live data, or the user's environment. Any examples in the response use PLACEHOLDER values for queries. You are responsible for discovering real metric names, log queries, or APM resource names through data exploration tools and substituting them — do not copy example queries directly into a widget without first validating them against real data. Returns focused instructions rather than a full schema dump, so it's cheaper than get_widget_reference. Useful at any stage: choosing a widget type, understanding schema requirements, or debugging an invalid widget.

Assign or unassign security findings to a user. Assignment cascades to linked cases — assigning a finding auto-assigns its linked case. Use analyze_datadog_security_findings or search_datadog_security_findings to find specific finding IDs first. To unassign, omit assignee. IMPORTANT: Always confirm with the user before calling this tool — it changes finding state.

Insert, update, and delete dataset records in one versioned operation. Use this to edit or remove existing records; **add_llmobs_dataset_records** is the append-only path and is preferable when you are only adding. **Two-step**: PREVIEW (`confirmed=false`) → APPLY (`confirmed=true`). - `confirmed=false`: writes nothing. Verifies the dataset exists and returns the per-operation counts plus a `confirmation_prompt`. Show it to the user and get explicit approval. - `confirmed=true`: applies the whole batch atomically. Do not retry a successful call; verify with **get_llmobs_dataset_records** if a network error left the outcome ambiguous. Resolve record IDs for `update_records` / `delete_record_ids` with **get_llmobs_dataset_records** first, and read its `schema_summary` so inserted records match the existing shape. At most 500 mutations per call. On invalid input or API failure returns a `DatasetRecordToolError` with `reason` + `recovery_hint`.

Step-by-step instructions for adding initial Datadog setup to a frontend browser-based project environment. You must first review the user's project and this tool's arguments (including nested arguments) and fill out as many of them as possible before calling this tool. Check project files and dependencies to determine the argument values, focusing on dependency files and imports. Only provide values you can substantiate from the user's files. If you are not sure about file content or codebase structure pertaining to the user's request, use your tools to read files and gather the relevant information: do NOT guess or make up an answer. Before calling this tool, you must first check if the user's project has already been configured for Datadog on the frontend. If it has, you should not call this tool. Use CLI utilities, such as `ls` and `cat` when checking if the project contains existing env files and viewing their contents, respectively. For projects with client- and server-side logic, you must check if the client side has already been configured for Datatdog, and if not, you must call this tool to configure the client side.

Translates a natural-language description into a correct Audit Trail query string. Returns query/from/to fields (plus optional visualization hints) that can be used wherever an Audit Trail query is needed — e.g. feed them to search_audit_events, link the user to the Audit Trail Explorer, or use them in any other Audit Trail query consumer. Call this tool only when unsure of Audit Trail query syntax; if you already know the correct syntax, query directly via search_audit_events or list_audit_events (this tool runs an LLM and adds latency).

Cancel a running Datadog Workflow Automation execution instance. Invoke only when the user intends to stop the run. The instanceId can come from execute_datadog_workflow or list_datadog_workflow_instances. Cancellation cannot be resumed. On success, the result contains `cancelled: true`, `workflowId`, and `instanceId`.

PRIMARY TOOL FOR EXISTING FLAGS! This tool should be used to check how a feature flag should be implemented in codebase. Use this when asked: - Check my flags are used properly? - Use an existing flag to control some functionality in my code? - Use the flag 'some-flag' to control something in my code? (This implies there is an existing feature flag with key 'some-flag') - Debug why this flag is not serving the variant I think it should. This tool is used to ensure the flag is - being used as the correct type - being passed all the context attributes it needs to evaluate - providing an appropriate default value This is helpful because these things can't be verified by normal static analysis, so this tool is needed. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools.

Clean up a stale feature flag by key — auto-archives if no code references are known, otherwise returns the repos and files where the flag is still referenced plus a Datadog UI link and instructs the user to use Bits dev in the UI to remove those references (archiving stays blocked until they are gone).

Clone an existing Datadog form. Creates a copy of the form with all its current settings and latest version definition. Returns the cloned form's metadata including its new ID and datastore_id.

Copy a dataset's current records into a new dataset in the same project. The source dataset is left untouched. This is the safe way to try edits against a real dataset: clone it, mutate the clone with **batch_update_llmobs_dataset_records**, and run experiments against the clone. Returns the new `dataset` and `source_dataset_id`. On invalid input or API failure returns a `DatasetRecordToolError`. Only the source's current version is copied; the clone starts its own version history.

Configure Datadog Code Coverage for a project by adding coverage report uploads to the CI pipeline. Call this tool to set up code coverage, add code coverage, enable code coverage uploads, or integrate Datadog Code Coverage into a repository. This tool returns all the instructions needed — do NOT search the web, fetch documentation, or read external resources. Only inspect local project files to determine this tool's argument values, then call this tool immediately. Check CI config files (e.g. .github/workflows/), dependency files, and coverage tool configs to fill in the arguments. Only provide values you can substantiate from the user's files. Use CLI utilities such as `ls` and `cat` to inspect project files. Do not guess or make up values.

Lists an organization's Cloud Cost Management (CCM) cost-saving recommendations. By default, recommendations are ranked by estimated potential savings (highest first); CCM analyzes cloud and SaaS resource usage and surfaces opportunities to cut spend. Use it to answer questions like 'what are my top cost-saving opportunities?', 'how much could I save per month?', 'how much could I save this year?', 'how many recommendations do I have?', or 'show me aws recommendations for my Kubernetes clusters'. Recommendations carry a status (Open, In Progress, Completed, Dismissed); scope to the right one(s) through the query — see the status guidance on the query argument. For a neutral request, filter to @status:Open (the recs still worth acting on). Output is JSON with three blocks. (1) recommendations: this page's array; each item has cloud_provider, potential_monthly_savings and potential_yearly_savings (estimated dollars saved per month and per year if the recommended action is taken), recommendation_type, resource_type, resource_id, risk, and effort, when classified. The resource_id field is the recommendation's stable handle (e.g. 'k8s_cluster|spheal-b') that you can pass back as an @id: filter to re-fetch that exact recommendation. When a resource has several recommended actions, only the best one is promoted to these fields; set full_output=true to also get full_event, the recommendation's complete payload (all actions, status, resource metadata, and every field usable for @-filtering). (2) summary: total_items plus potential_monthly_savings and potential_yearly_savings, as described above; plus complete, which is false when the matching set was too large to fully scan (making those totals lower bounds you should report as 'at least'). (3) pagination: displayed_items (the count in this page) and next_cursor (pass it back as cursor to fetch the next page; absent on the last page). This tool is visible to every user, but only Cloud Cost Management (CCM) customers have recommendation data. When Event Query reports that the organization has no valid recommendation index (normally because it is not a CCM customer), the tool returns a short plain-text message as a normal non-error result; relay that message as-is and do not retry. A valid index with no recommendations, or a filter with no matches, returns the normal JSON blocks with an empty recommendations array and zero-valued summary.

Create a new Datadog form with a name. The form is created in draft state with a linked datastore auto-provisioned. The schema is unique, you must retrieve it using the `get_form_definition_schema` tool before attempting to create a form. Returns the new form's metadata including its ID and datastore_id.

Creates a Datadog monitor in DRAFT mode (no notifications sent, priority 5). Must be manually published in the Datadog UI. Use validate_monitor_definition first to check the definition. Use get_monitor_templates for query syntax examples.

Creates a new Datadog notebook. Include key findings, evidence, supporting data, and complete query documentation unless told otherwise. Do not start the first markdown cell with a heading that repeats the notebook name — it is already displayed as the title. Look up widget reference schemas before constructing graph cells.

Creates a published analysis (also called a published dataset) from a notebook cell. A published analysis is a snapshot of a computational notebook's cells, exposed as a queryable dataset. Use this to publish a notebook cell as a dataset for the first time.

Create a new Cloud SIEM detection rule by POSTing the supplied payload to POST /api/v2/security_monitoring/rules. The payload must follow the schema returned by `get_datadog_security_detection_rules_schema` — call that tool first to fetch the grammar, then construct a payload that matches the detection method you need. The tool automatically appends the `datadog_mcp:created` tag to the rule payload. For now, `payload.type` must be `log_detection`; other rule types are not supported yet. On success, returns the full created rule (including the server-assigned `id`).

Create a security findings automation rule. Specify rule_type to choose the type of rule: mute (suppress findings), due_date (set remediation deadlines), severity_modifier (adjust finding severity), or ticket_creation (auto-create Jira/Case Management tickets). Each rule_type requires different parameters — see parameter descriptions for which apply.

Create a case, Jira issue, ServiceNow ticket, or Linear issue for security findings. Jira/ServiceNow/Linear targets automatically create and link a Case Management case. Title, description, and priority are auto-generated by the backend if omitted — only provide them if the user specifies custom values. project_id is required for jira/servicenow/linear targets — call get_datadog_security_findings_ticket_suggestions first if you don't know which project to use. If the create request fails, the error response includes ranked project suggestions to help the user pick the right one. IMPORTANT: Always confirm with the user before calling this tool — it creates external tickets.

Create a new security monitoring suppression rule in Datadog. Suppressions prevent detection rules from generating signals for specific conditions. This operation is destructive: once active, future matching signals will be silenced. Call get_datadog_security_detection_rules first to inspect the target rule(s) and build an accurate rule_query. At least one of suppression_query or data_exclusion_query must be provided.

Create a new library skill in your organization's Skills Library — a separate, user-authored set of task guides, distinct from any built-in "Skills" your own agent tooling may already have. This library skill is always created as private and owned by you, and does not modify or interact with Datadog's own first-party skills, which are a separate, built-in set you cannot edit through this tool. It is always created private and visible only to its owner: this tool cannot make a library skill Shared with the organization — to share it, the user must open the skill in the Datadog UI and mark it as Shared. Tell the user this after creating a skill they intend to share. Provide a short, unique slug (the identifier), a human-readable name, a one-line description, and the library skill body as content.

Create an unpublished Datadog Workflow Automation workflow from a complete spec. Each step must use a catalog actionId and follow its action contract, and the spec must satisfy trigger and graph invariants. Use publish_datadog_workflow when it is ready to run automatically. The result contains the generated workflowId and URL. A successful response confirms that the workflow was saved; it does not establish successful runtime behavior. Omit every step's display to request automatic layout; if preserving a manual layout, provide display data consistently for all steps.

Create a new Feature Management environment. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools. Use when reconciliation against list-environments shows a detected DD_ENV value has no covering environment ("will create" outcome), or when a user explicitly wants a new environment. WRITE OPERATION. Before calling, show the user the exact plan (name, queries, is_production, require_feature_flag_approval) and get explicit approval. Production environments have serious operational impact — confirm intent for is_production=true. queries are the DD_ENV values this environment covers (e.g. ["dev"], ["staging","stg"]). Wildcards are rejected by the service; DD_ENV values already used in another environment also cause a 409 Conflict.

Create a new feature flag with a FEATURE_GATE allocation linked to a standard experiment. Use this tool instead of create-feature-flag when an allocation has experiment_id. The allocation schema and environment requirements are otherwise identical to create-feature-flag. MANDATORY: If the user did not specify an environment, ask the user to specify one before creating allocations. This allocation's exposure_schedule.rollout_options.scheduled_start cannot be a future value ('relative:<duration>' or a future 'absolute:<RFC3339>') because a standard experiment allocation cannot be auto-started — use 'none' and start the experiment through its lifecycle instead. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools. This is a secondary tool - use after determining flag exists and implementation approach.

PRIMARY TOOL FOR NEW FLAGS in a project that already has Datadog feature flags wired up! *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools. Use create-feature-flag when users need to create a new flag that doesn't exist yet. This tool creates a new feature flag with variants and optional FEATURE_GATE or CANARY allocations. For a FEATURE_GATE allocation linked to a standard experiment with experiment_id, use create-experiment-feature-flag. IMPORTANT: If the project has NO existing feature flags yet (check with list-feature-flags) or the user is asking to set up/add/onboard feature flags for the first time (e.g. "set up feature flags", "add feature flags to my app", "onboard this app onto feature flags", "get started with feature flags", "start using Datadog feature flags", "install Datadog feature flags"), use the onboarding flow instead — start with get-onboarding-step rather than this tool. That flow enforces non-production safety gates and real end-to-end CDN verification via verify-onboarding-flag that this tool does not provide. MANDATORY: To correctly implement this flag in your codebase, you MUST use the code demonstrated in the datadog://feature-flags/sdk/react resource. Do not GUESS about how to correctly implement the flag. Do NOT create mock implementations. The user has added this MCP server because they want feature flags server from Datadog. Failure to implement flags as described in datadog://feature-flags/sdk/react will cause frustration. MANDATORY: If the user did not specify an environment, and an allocation is needed or a status is specified, ask the user to specify an environment. When the allocation is already known, prefer creating it atomically with the flag. Later allocation changes use sync-allocations-for-feature-flag-environment, including in production. Each allocation's exposure_schedule.rollout_options controls when its rollout starts (applies to both CANARY and FEATURE_GATE allocations): use scheduled_start ('none', 'now', 'relative:<duration>', or 'absolute:<RFC3339>') rather than the deprecated autostart. A future value ('relative:<duration>' or a future 'absolute:<RFC3339>') schedules the rollout to start at that time. Exception: a FEATURE_GATE allocation with experiment_id set (a standard experiment allocation) cannot be auto-started, so a future scheduled_start is rejected for it — use 'none' and start the experiment through its lifecycle instead. For an APM Canary, set exposure_schedule.apm_retention to {"mode":"TEMPORARY","rate":1} for a bounded synthetic test. This exercises the deployed retention lifecycle; do not create or override retention filters directly. To enable the new flag before starting its Canary, create with scheduled_start='none', call update-feature-flag-environment with status ENABLED, then call start-canary with the exposure-schedule ID returned by list-allocations-for-feature-flag.

Create a Synthetics global variable. name and value are required; value.secure marks the value as hidden after creation, and a secure variable's value is never returned. tags and description are optional. parse_test_options and parse_test_public_id are not supported by this tool.

Create an Agent Observability **annotation queue** and, optionally, its label schema in the same call. Returns `queue` with the `queue_id` every other annotation tool needs, plus the schema with server-assigned label ids. Not name-idempotent — calling twice makes two queues. Check **list_llmobs_annotation_queues** first if a queue for this purpose may already exist. Defining `label_schemas` here saves a follow-up **update_llmobs_annotation_label_schema** call. Next: **add_llmobs_annotation_queue_interactions** to fill the queue.

Create an empty dataset inside a project. Populate it afterwards with **add_llmobs_dataset_records**. Name-idempotent within the project: an existing dataset of the same name is returned with `already_existed=true` and nothing is created — say so rather than reporting a new dataset. Returns `dataset` (including the UUID the record tools need) and `already_existed`. On invalid input or API failure returns a `DatasetRecordToolError` with `reason` + `recovery_hint`. To start from an existing dataset's records instead of an empty one, use **clone_llmobs_dataset**.

Create a new LLM Observability experiment object in a project. This records the experiment (so events/metrics can be reported against it) and does NOT run any model inference — it is the create counterpart of **update_llmobs_experiment**. To run a prompt template against a dataset and evaluate the results, use **launch_llmobs_experiment** instead. **Required inputs:** project_id and experiment_name. Returns the created experiment_id and its resolved name (the backend may append a suffix to keep the run name unique). Use **submit_llmobs_experiment_events** to attach evaluation metrics, or **update_llmobs_experiment** to change its properties.

Create an LLM Observability **experiments project** — the container that owns datasets and experiments. Name-idempotent: if a project with this name already exists in the org, it is returned with `already_existed=true` and nothing is created. Report that back rather than claiming a new project was made. Returns `project` (with the UUID needed by **create_llmobs_dataset**, **list_llmobs_datasets**, and **list_llmobs_experiments**) and `already_existed`. Check **list_llmobs_projects** first when the user may be describing a project that already exists under a different name.

Create the onboarding proof flag: a predictable boolean flag (disabled=false, enabled=true; default disabled) with a catch-all FEATURE_GATE allocation serving enabled=true in the selected NON-PRODUCTION environment, tagged source:agentic-onboarding. Safety gates enforced by this tool (not by the agent): the environment must resolve, must NOT be production, must NOT require feature-flag approval, and its queries must cover dd_env under the runtime matcher. It refuses to write unless confirm is true — call it first with confirm:false (or omitted) to get the exact write preview, show that to the user, then call again with confirm:true.

Create or update an LLM-judge evaluator configuration. **This is a full replace, not a patch.** The persisted evaluator becomes exactly what you send: any field you omit is reset to its default (or unset), even if the existing evaluator had a value. Before updating an existing evaluator, **always call `get_llmobs_evaluator` first** and re-send every field you want to keep alongside whatever you're changing — otherwise you will silently clobber prompt_template, output_schema, sampling, etc. Targets a specific ml_app and optionally a filter / sampling percentage. Provide the judge's model + prompt_template to define how it scores each span. Returns the resulting (post-write) configuration on success. **Required**: eval_name, application_name, enabled, integration_provider, model_name, prompt_template, parsing_type, output_schema. **Common optional fields**: temperature (defaults to 0), max_tokens (defaults to 4096), sampling_percentage (0, 100], eval_scope (span | trace | session), vertex_ai_project / vertex_ai_location (for Vertex AI), bedrock_region or bedrock_inference_profile (for Bedrock), assessment_criteria.

Create a new reference table. Supports two modes: (1) LOCAL_FILE — creates an empty table with no cloud backing; rows are added later via upsert_reference_table_rows or append_reference_table_rows. (2) Cloud-backed (S3, GCS, AZURE) — syncs from a CSV file stored in a cloud bucket. Only INT32 and STRING field types are supported.

Create a web-UI-configured RUM operation: the same object created by clicking "Create Operation" in the RUM Operations UI. An operation tracks a user journey (e.g. checkout) between a start event and a success, failure, or abandonment event, matched by search queries against RUM events. This tool does NOT create SDK-instrumented operations — those are defined in application code via startFeatureOperation(...) and have no backend object; this tool cannot create or affect them. **For SDK-instrumented operations, load the datadog/rum skill (load_datadog_skill) for the SDK instrumentation guidance** — this tool only configures web-UI operations. Use this tool only when the ask is to configure an operation from the RUM Operations UI's perspective (e.g. "set up an operation for checkout using these queries"), not "help me instrument my app's code." application_id scopes the operation to a RUM application and is required — find it with search_rum_applications. Before writing a query from a free-text description of a user journey, use search_datadog_rum_events to confirm the real facet values (view names, action names, URL paths) rather than guessing them. An operation name must be unique; the backend rejects a duplicate (409), so the create call itself surfaces a name conflict — a pre-check via search_rum_operations is optional, not required. Each of start/success/failure requires a query (<step>_query + <step>_event_type). The "update" step type is a UI-only feature this tool does not expose. abandonment requires start_query to target exactly one view via @view.name: (see its description) — the tool rejects the call otherwise. If the user asks to track abandonment or drop-off, set abandonment: true (requires start_query to target exactly one view). Every step query must carry the facets its event type requires (see start_query), and @view.name: may never be a bare wildcard ("*"). category — including the default, component_loading — restricts which event types are valid per step (see category); a view start is only valid under page_load, page_navigation, custom, or custom_operation (never under component_loading or form_submission), and a view success is only valid under page_navigation, form_submission, custom, or custom_operation (never under component_loading or page_load). A failure step never accepts view, under any category. Example — "track checkout as an operation, from the checkout page to order confirmation, failing on a declined payment": call with name="checkout", category="page_navigation", start_query="@view.name:/checkout", start_event_type="view", success_query="@view.name:/checkout/complete", success_event_type="view", failure_query="@view.name:/checkout @error.message:*declined*", failure_event_type="error", application_id="<uuid from search_rum_applications>", confirm=true. **Always confirm the exact operation (name, queries, event types) with the user before calling. Never create an operation speculatively.** Re-invoke with confirm: true once confirmed.

Create a saved filter: a reusable, named set of targeting rules that feature flags can reference.

Get the schema (available fields) for Workload Protection agent events — the raw runtime security events (process, file, network, and DNS activity) collected by the Datadog Agent. Workload Protection is also known as Cloud Workload Security (CWS) or CSM Threats; "runtime security" and "agent events" refer to the same data. Use this tool to discover what fields can be used to filter or query agent events before running an agent events search. Returns field names, types, and optionally descriptions and enum values.

do-not-call

do-not-call

do-not-call