Datadog MCP

Check whether Datadog App and API Protection (AAP) can be enabled for a service via Remote Configuration (RC), with no code changes. Use when the user asks to install, set up, enable, or onboard AAP for a service and environment. Returns a verdict with a recommended navigation action: the Service Inventory side-panel when RC is available, or the AAP setup page otherwise.

Step-by-step instructions for enabling Datadog App and API Protection (AAP) to monitor and secure your application. AAP detects security threats, vulnerabilities, and attacks in real time by using Datadog tracing libraries for application deployments, the Datadog security processor for Envoy deployments, the Datadog SPOA for HAProxy deployments, or the Datadog nginx module for nginx deployments. You MUST first review the user's project and fill out as many arguments as possible before calling this tool. You MUST NOT call this tool without first examining the project's codebase to determine the correct argument values.

Create records in a dataset. **Two-step**: PREVIEW (`confirmed=false`) → INSERT (`confirmed=true`). - `confirmed=false`: does NOT insert. Validates that the (project_id, dataset_id) pair exists, then returns `AddDatasetRecordsPreview` with the resolved IDs, planned record count, tag union, first-record content, and a `confirmation_prompt` string. If the dataset does not exist, returns `DatasetRecordToolError(reason="unknown_dataset")` — re-resolve by NAME via get_llmobs_project + list_llmobs_datasets and retry rather than telling the user the dataset was deleted. Show the preview to the user, ask for explicit approval, then re-call with `confirmed=true`. - `confirmed=true`: validates UUIDs, issues the API call. Author is recorded automatically as the human user from the forwarded JWT — do not pass an author ID. `create_new_version=true` (default) bumps the dataset version on insert (the typical "save as a new versioned snapshot" — what experimentation needs). Set false only for in-place batched edits where the user explicitly asked to keep the current version. On failure returns `DatasetRecordToolError` with `reason`, `recovery_hint`, and the offending value. Reasons: `invalid_project_id`, `invalid_dataset_id`, `unknown_dataset`, `forbidden_action_dataset`, `record_size_exceeded`, `invalid_request`, `transport_error`. Once `confirmed=true` succeeds, do NOT retry the call (the work is committed). If a network error makes the result ambiguous, call **get_llmobs_dataset_records** to verify before retrying. When the user wants to append records, sample existing records via **get_llmobs_dataset_records** first, read the `schema_summary`, and construct matching new records before this tool. Always preview (`confirmed=false`) and confirm with the user before writing.

Aggregate and analyze CI pipeline events to produce statistics, metrics, and grouped analytics. Use for answering questions like 'What's the average pipeline duration?' or 'How many failed builds per pipeline?' For individual event details or error messages, use search_datadog_ci_pipeline_events instead. aggregation is required — provide one of: count, avg, sum, min, max, pc50, pc75, pc90, pc95, pc99. If no data is available, try a wider time range. Note: sort is not a parameter for this tool — results are returned ordered by aggregation value descending. Use search_datadog_ci_pipeline_events for sorted individual event listings.

Aggregate Datadog Test events. aggregation is required — provide one of: count, avg, sum, min, max, pc50, pc75, pc90, pc95, pc99. Quantifies reliability, performance, and execution trends. For individual event details or error messages, use search_datadog_test_events instead. If no data is available, try a wider time range. Note: sort is not a parameter for this tool — results are returned ordered by aggregation value descending. Use at most 2–3 facets in group_by; add query filters to stay within the 10,000 group combinations limit. Common prompts: • Failure volume by branch: aggregation=count query=@test.status:fail group_by=@git.branch • Pass/fail split by owner: aggregation=count group_by=@test.codeowners query="(@test.status:pass OR @test.status:fail)" • Slowest suites: aggregation=pc95 metric=@duration test_level=suite group_by=@test.suite • Retry hotspots: aggregation=count group_by=@test.retry_reason query=@test.is_retry:true • Service-level performance: query=@test.service:"checkout" aggregation=avg metric=@duration group_by=@git.branch • Repository-scoped failures: query=@git.repository.id_v2:"github.com/org/repo" @test.status:fail aggregation=count group_by=@test.suite • Failures by commit: aggregation=count query=@test.status:fail group_by=@git.commit.sha • Failures by author: aggregation=count query=@test.status:fail group_by=@git.commit.author.email

Aggregate DORA events into scalar values or timeseries using composable 'queries' + 'formulas', like get_datadog_metric — delivery-performance analytics across deployments, commits, and pull requests. Each entry in 'queries' picks an 'index', an optional numeric 'metric' to aggregate (omit to count events), an 'aggregation', an optional single-string Lucene 'query' filter, and optional 'group_by' facets. Combine queries by referencing their 'name' in 'formulas' (e.g. ratios). 'aggregation' defaults to count when 'metric' is omitted, pc50 (median) otherwise; 'group_by' allows up to 100 values per facet; custom tags via @<tag_key>. Examples: - Change lead time (median): [{index:"commit", metric:"commits.change_lead_time_sec", aggregation:"pc50"}] - Change failure rate: [{index:"deployment", name:"total"}, {index:"deployment", query:"change_failure:true", name:"failures"}] with formulas ["failures / total"] - PR cycle time (median): [{index:"pull_request", metric:"pull_requests.pr_cycle_time_sec", aggregation:"pc50"}] - Distinct PR count: [{index:"pull_request", metric:"pull_requests.id_v2", aggregation:"cardinality"}] Load the 'datadog/dora-metrics' skill for the full recipe catalog (stage breakdowns, PR throughput, combining queries with formulas). Call get_dora_fields to discover the valid indexes, metrics, facets, and aggregations.

Aggregate Datadog events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as event counts by source, event frequency over time, or grouped summaries across tags. For raw event inspection, titles/messages, or tag exploration, use search_datadog_events.

Aggregate Datadog RUM events to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis of RUM data such as session counts over time, error counts by page, or p95 loading times by browser or URL path. For raw event inspection or attribute discovery, use search_datadog_rum_events.

Aggregate Datadog APM spans to compute counts, sums, averages, min, max, cardinality, and percentiles (P50, P75, P90, P95, P99), with optional grouping by fields or time intervals. Use this for aggregated analysis such as request counts over time, p95 duration by service or resource, or error counts grouped by endpoint or status code. For raw span inspection or to discover fields to group by or aggregate on, first use search_datadog_spans and optionally request custom_attributes.

Queries Cloud Network Monitoring (CNM) data to view network/transport level information. Use to investigate netork latency, packet loss, TCP failed connections, dial timeouts, or spikes in TCP throughput. Each query accepts a 'scope' field to select which slice of CNM data to query: - 'tcp' (default): service-to-service L4/TCP flows. Use for investigating connection errors between workloads. - 'tcp-eudm': endpoint/device-centric L4 flows. Use for investigating networking issues originating from end-user devices rather than between services. Scenario 1: clearsky is encountering "failed to connect" errors. Find the unhealthy pods: ```json { "from": "now-1h", "queries": [ {"client_tags": ["service:clearsky"], "client_group_by": "pod_name", "order_by": "retransmits"}, {"client_tags": ["service:clearsky"], "client_group_by": "pod_name", "order_by": "tcp_failed_conns"} ] } ``` Scenario 2: Cloud storage is rate-limiting clients with HTTP 429. View which services are pulling too much data: ```json { "from": "now-1h", "group_limit": 100, "time_buckets": 1, "queries": [ {"server_tags": ["service:aws.s3"], "client_group_by": "service", "order_by": "bytes_server_to_client"}, {"server_tags": ["service:gcp.storage"], "client_group_by": "service", "order_by": "bytes_server_to_client"} ] } ``` Scenario 3: An end-user device reports slow/failing connections. Investigate the destinations it is reaching using EUDM data: ```json { "from": "now-1h", "queries": [ {"scope": "tcp-eudm", "client_tags": "host:i-abc123", "server_group_by": "service", "order_by": "tcp_failed_conns"}, {"scope": "tcp-eudm", "client_tags": "host:i-abc123", "server_group_by": "service", "order_by": "retransmits"} ] } ```

Analyze Datadog Error Tracking error samples with SQL — aggregations, breakdowns by tag/service/version, or raw sample inspection. Runs against a virtual 'errors' table of individual error events (not Issues, which are groups of errors). Column names: no @ = root/tag attribute (e.g. usr.id, service), @ = custom attribute (e.g. @my.field). For ranked Issues by priority/volume use search_datadog_error_tracking_issues — do not GROUP BY issue.id as a substitute. Over wide time ranges, add LIMIT or a narrow GROUP BY; shorten the range if it times out.

Analyze Datadog logs using SQL. Runs against a virtual 'logs' table filtered by your search query. Good for aggregations, counts, group-bys, or peeking at recent logs with LIMIT. To discover custom attributes for extra_columns, first call search_datadog_logs with extra_fields. If a query times out, try a shorter time range. MUST load the datadog/ddsql skill before calling this tool.

Primary tool for analyzing security findings. Use this for all security findings analysis tasks. REQUIRED: Call get_datadog_security_findings_schema FIRST to get available fields and their types before writing SQL. Queries live data from the last 24 hours using flexible SQL aggregations, filtering, and grouping. IMPORTANT: When users ask 'what should I fix?' or 'what are my top vulnerabilities?', prioritize by RISK ATTRIBUTES (@risk.*) not just severity. DEEP LINKS: Always link to findings when you have the id — format: <deep_link_base_url>/security/finding/<finding_id>. The correct base URL is in every response as 'deep_link_base_url'. Read the sql_query parameter description carefully — it explains risk-based prioritization, deep link generation, function syntax, common pitfalls, and includes examples. Only fall back to search_datadog_security_findings if you need full finding details or this tool fails. To create a case, Jira issue, or ServiceNow ticket for findings, use create_datadog_security_findings_ticket.

Count, group, or trend security signals using DDSQL — for any aggregate question: 'how many', 'top N', 'by severity', 'over time', or breakdown. Do NOT use for listing, retrieving, or checking existence of specific signals — use search_datadog_security_signals instead. IMPORTANT: When constructing the SQL query, ALWAYS use the table-valued function syntax — FROM dd.security_signals(columns => ARRAY[...], filter => '...'). IMPORTANT: If the user has NOT specified a signal product (Cloud SIEM / Log Detection, App & API Protection / Application Security, or Workload Protection / Workload Security), ASK them if they want to specify the product or rule type before calling this tool. Workflow: ALWAYS call get_datadog_security_signals_schema first to discover available fields, then use this tool with SQL.

Primary tool for analyzing security findings. (Also available as analyze_datadog_security_findings.) Use this for all security findings analysis tasks. REQUIRED: Call security_findings_schema FIRST to get available fields and their types before writing SQL.

Create a new RUM retention filter, appended at the end of the evaluation order. Retention filters control which RUM events are indexed and retained. **This changes data-retention configuration and directly affects billing.** Adding a filter or enabling cross-product sampling increases indexed volume and cost. **Always confirm the exact change with the user before calling. Never create a filter speculatively.** name, event_type, and sample_rate are required. event_type: one of session, view, action, error, resource, long_task, vital, operation. sample_rate: 0.1 to 100 (percent of matching events retained). cross_product_sampling: optional extra retention for session replays and APM traces of matching sessions; session_replay_sample_rate and trace_sample_rate are both required within it. The new filter is appended at the end of the evaluation order. Filters are evaluated top-down, so a broad catch-all already at the end may capture matching events before this filter applies; reorder afterwards with reorder_rum_retention_filters to place specific filters above broad ones. Creates are idempotent: a retried create that matches an existing filter exactly is not duplicated. To change an existing filter use update_rum_retention_filter; to remove one use delete_rum_retention_filter. Find existing filters with search_rum_retention_filters.

Append (add) new rows to an existing reference table. Prefer upsert_reference_table_rows when you may need to update existing rows — it handles both inserts and updates. Use this tool only when you are certain all rows are new. Each row must include all required fields from the table's schema, including the primary key field. Use list_reference_tables to discover table IDs and schemas first. Example: rows: [{"user_id": "user001", "name": "Alice", "age": 25}, {"user_id": "user002", "name": "Bob", "age": 30}]

Archive a single feature flag by ID or key; pair with list-stale-feature-flags to discover candidates. Provide featureFlagID or featureFlagKey (if both are given, featureFlagID wins).

Archive a saved filter (reversible via unarchive-saved-filter).

Get targeted instructions for building a Datadog widget. Returns a concise how-to guide — widget type recommendations, required fields, schema patterns, and an annotated example — that you use to build the widget definition yourself. The expert has deep knowledge of all widget types and schemas but does NOT have access to real telemetry, live data, or the user's environment. Any examples in the response use PLACEHOLDER values for queries. You are responsible for discovering real metric names, log queries, or APM resource names through data exploration tools and substituting them — do not copy example queries directly into a widget without first validating them against real data. Returns focused instructions rather than a full schema dump, so it's cheaper than get_widget_reference. Useful at any stage: choosing a widget type, understanding schema requirements, or debugging an invalid widget.

Assign or unassign security findings to a user. Assignment cascades to linked cases — assigning a finding auto-assigns its linked case. Use analyze_datadog_security_findings or search_datadog_security_findings to find specific finding IDs first. To unassign, omit assignee. IMPORTANT: Always confirm with the user before calling this tool — it changes finding state.

Insert, update, and delete dataset records in one versioned operation. Use this to edit or remove existing records; **add_llmobs_dataset_records** is the append-only path and is preferable when you are only adding. **Two-step**: PREVIEW (`confirmed=false`) → APPLY (`confirmed=true`). - `confirmed=false`: writes nothing. Verifies the dataset exists and returns the per-operation counts plus a `confirmation_prompt`. Show it to the user and get explicit approval. - `confirmed=true`: applies the whole batch atomically. Do not retry a successful call; verify with **get_llmobs_dataset_records** if a network error left the outcome ambiguous. Resolve record IDs for `update_records` / `delete_record_ids` with **get_llmobs_dataset_records** first, and read its `schema_summary` so inserted records match the existing shape. At most 500 mutations per call. On invalid input or API failure returns a `DatasetRecordToolError` with `reason` + `recovery_hint`.

Step-by-step instructions for adding initial Datadog setup to a frontend browser-based project environment. You must first review the user's project and this tool's arguments (including nested arguments) and fill out as many of them as possible before calling this tool. Check project files and dependencies to determine the argument values, focusing on dependency files and imports. Only provide values you can substantiate from the user's files. If you are not sure about file content or codebase structure pertaining to the user's request, use your tools to read files and gather the relevant information: do NOT guess or make up an answer. Before calling this tool, you must first check if the user's project has already been configured for Datadog on the frontend. If it has, you should not call this tool. Use CLI utilities, such as `ls` and `cat` when checking if the project contains existing env files and viewing their contents, respectively. For projects with client- and server-side logic, you must check if the client side has already been configured for Datatdog, and if not, you must call this tool to configure the client side.

Translates a natural-language description into a correct Audit Trail query string. Returns query/from/to fields (plus optional visualization hints) that can be used wherever an Audit Trail query is needed — e.g. feed them to search_audit_events, link the user to the Audit Trail Explorer, or use them in any other Audit Trail query consumer. Call this tool only when unsure of Audit Trail query syntax; if you already know the correct syntax, query directly via search_audit_events or list_audit_events (this tool runs an LLM and adds latency).

Cancel a running Datadog Workflow Automation execution instance. Invoke only when the user intends to stop the run. The instanceId can come from execute_datadog_workflow or list_datadog_workflow_instances. Cancellation cannot be resumed. On success, the result contains `cancelled: true`, `workflowId`, and `instanceId`.

PRIMARY TOOL FOR EXISTING FLAGS! This tool should be used to check how a feature flag should be implemented in codebase. Use this when asked: - Check my flags are used properly? - Use an existing flag to control some functionality in my code? - Use the flag 'some-flag' to control something in my code? (This implies there is an existing feature flag with key 'some-flag') - Debug why this flag is not serving the variant I think it should. This tool is used to ensure the flag is - being used as the correct type - being passed all the context attributes it needs to evaluate - providing an appropriate default value This is helpful because these things can't be verified by normal static analysis, so this tool is needed. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools.

Clean up a stale feature flag by key — auto-archives if no code references are known, otherwise returns the repos and files where the flag is still referenced plus a Datadog UI link and instructs the user to use Bits dev in the UI to remove those references (archiving stays blocked until they are gone).

Clone an existing Datadog form. Creates a copy of the form with all its current settings and latest version definition. Returns the cloned form's metadata including its new ID and datastore_id.

Copy a dataset's current records into a new dataset in the same project. The source dataset is left untouched. This is the safe way to try edits against a real dataset: clone it, mutate the clone with **batch_update_llmobs_dataset_records**, and run experiments against the clone. Returns the new `dataset` and `source_dataset_id`. On invalid input or API failure returns a `DatasetRecordToolError`. Only the source's current version is copied; the clone starts its own version history.

Configure Datadog Code Coverage for a project by adding coverage report uploads to the CI pipeline. Call this tool to set up code coverage, add code coverage, enable code coverage uploads, or integrate Datadog Code Coverage into a repository. This tool returns all the instructions needed — do NOT search the web, fetch documentation, or read external resources. Only inspect local project files to determine this tool's argument values, then call this tool immediately. Check CI config files (e.g. .github/workflows/), dependency files, and coverage tool configs to fill in the arguments. Only provide values you can substantiate from the user's files. Use CLI utilities such as `ls` and `cat` to inspect project files. Do not guess or make up values.

Lists an organization's Cloud Cost Management (CCM) cost-saving recommendations. By default, recommendations are ranked by estimated potential savings (highest first); CCM analyzes cloud and SaaS resource usage and surfaces opportunities to cut spend. Use it to answer questions like 'what are my top cost-saving opportunities?', 'how much could I save per month?', 'how much could I save this year?', 'how many recommendations do I have?', or 'show me aws recommendations for my Kubernetes clusters'. Recommendations carry a status (Open, In Progress, Completed, Dismissed); scope to the right one(s) through the query — see the status guidance on the query argument. For a neutral request, filter to @status:Open (the recs still worth acting on). Output is JSON with three blocks. (1) recommendations: this page's array; each item has cloud_provider, potential_monthly_savings and potential_yearly_savings (estimated dollars saved per month and per year if the recommended action is taken), recommendation_type, resource_type, resource_id, risk, and effort, when classified. The resource_id field is the recommendation's stable handle (e.g. 'k8s_cluster|spheal-b') that you can pass back as an @id: filter to re-fetch that exact recommendation. When a resource has several recommended actions, only the best one is promoted to these fields; set full_output=true to also get full_event, the recommendation's complete payload (all actions, status, resource metadata, and every field usable for @-filtering). (2) summary: total_items plus potential_monthly_savings and potential_yearly_savings, as described above; plus complete, which is false when the matching set was too large to fully scan (making those totals lower bounds you should report as 'at least'). (3) pagination: displayed_items (the count in this page) and next_cursor (pass it back as cursor to fetch the next page; absent on the last page). This tool is visible to every user, but only Cloud Cost Management (CCM) customers have recommendation data. When the organization is not a CCM customer or has no recommendations, the tool returns a short plain-text message saying so as a normal (non-error) result instead of the JSON blocks above; relay that message to the user as-is and do not retry.

Create a new Datadog form with a name. The form is created in draft state with a linked datastore auto-provisioned. The schema is unique, you must retrieve it using the `get_form_definition_schema` tool before attempting to create a form. Returns the new form's metadata including its ID and datastore_id.

Creates a Datadog monitor in DRAFT mode (no notifications sent, priority 5). Must be manually published in the Datadog UI. Use validate_monitor_definition first to check the definition. Use get_monitor_templates for query syntax examples.

Creates a new Datadog notebook. Include key findings, evidence, supporting data, and complete query documentation unless told otherwise. Do not start the first markdown cell with a heading that repeats the notebook name — it is already displayed as the title. Look up widget reference schemas before constructing graph cells.

Creates a published analysis (also called a published dataset) from a notebook cell. A published analysis is a snapshot of a computational notebook's cells, exposed as a queryable dataset. Use this to publish a notebook cell as a dataset for the first time.

Create a new Cloud SIEM detection rule by POSTing the supplied payload to POST /api/v2/security_monitoring/rules. The payload must follow the schema returned by `get_datadog_security_detection_rules_schema` — call that tool first to fetch the grammar, then construct a payload that matches the detection method you need. The tool automatically appends the `datadog_mcp:created` tag to the rule payload. For now, `payload.type` must be `log_detection`; other rule types are not supported yet. On success, returns the full created rule (including the server-assigned `id`).

Create a security findings automation rule. Specify rule_type to choose the type of rule: mute (suppress findings), due_date (set remediation deadlines), severity_modifier (adjust finding severity), or ticket_creation (auto-create Jira/Case Management tickets). Each rule_type requires different parameters — see parameter descriptions for which apply.

Create a case, Jira issue, ServiceNow ticket, or Linear issue for security findings. Jira/ServiceNow/Linear targets automatically create and link a Case Management case. Title, description, and priority are auto-generated by the backend if omitted — only provide them if the user specifies custom values. project_id is required for jira/servicenow/linear targets — call get_datadog_security_findings_ticket_suggestions first if you don't know which project to use. If the create request fails, the error response includes ranked project suggestions to help the user pick the right one. IMPORTANT: Always confirm with the user before calling this tool — it creates external tickets.

Create a new security monitoring suppression rule in Datadog. Suppressions prevent detection rules from generating signals for specific conditions. This operation is destructive: once active, future matching signals will be silenced. Call get_datadog_security_detection_rules first to inspect the target rule(s) and build an accurate rule_query. At least one of suppression_query or data_exclusion_query must be provided.

Create an unpublished Datadog Workflow Automation workflow from a complete spec. Each step must use a catalog actionId and follow its action contract, and the spec must satisfy trigger and graph invariants. Use publish_datadog_workflow when it is ready to run automatically. The result contains the generated workflowId and URL. A successful response confirms that the workflow was saved; it does not establish successful runtime behavior. Omit every step's display to request automatic layout; if preserving a manual layout, provide display data consistently for all steps.

Create a new Feature Management environment. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools. Use when reconciliation against list-environments shows a detected DD_ENV value has no covering environment ("will create" outcome), or when a user explicitly wants a new environment. WRITE OPERATION. Before calling, show the user the exact plan (name, queries, is_production, require_feature_flag_approval) and get explicit approval. Production environments have serious operational impact — confirm intent for is_production=true. queries are the DD_ENV values this environment covers (e.g. ["dev"], ["staging","stg"]). Wildcards are rejected by the service; DD_ENV values already used in another environment also cause a 409 Conflict.

Create a new feature flag with a FEATURE_GATE allocation linked to a standard experiment. Use this tool instead of create-feature-flag when an allocation has experiment_id. The allocation schema and environment requirements are otherwise identical to create-feature-flag. MANDATORY: If the user did not specify an environment, ask the user to specify one before creating allocations. This allocation's exposure_schedule.rollout_options.scheduled_start cannot be a future value ('relative:<duration>' or a future 'absolute:<RFC3339>') because a standard experiment allocation cannot be auto-started — use 'none' and start the experiment through its lifecycle instead. *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools. This is a secondary tool - use after determining flag exists and implementation approach.

PRIMARY TOOL FOR NEW FLAGS in a project that already has Datadog feature flags wired up! *** FEATURE FLAG DETECTION *** If users mention: flags, toggles, feature switches, A/B tests, experiments, gradual rollouts, canary releases, or say they want to 'flag' something, this is feature flag work and should use feature flag tools. Use create-feature-flag when users need to create a new flag that doesn't exist yet. This tool creates a new feature flag with variants and optional FEATURE_GATE or CANARY allocations. For a FEATURE_GATE allocation linked to a standard experiment with experiment_id, use create-experiment-feature-flag. IMPORTANT: If the project has NO existing feature flags yet (check with list-feature-flags) or the user is asking to set up/add/onboard feature flags for the first time (e.g. "set up feature flags", "add feature flags to my app", "onboard this app onto feature flags", "get started with feature flags", "start using Datadog feature flags", "install Datadog feature flags"), use the onboarding flow instead — start with get-onboarding-step rather than this tool. That flow enforces non-production safety gates and real end-to-end CDN verification via verify-onboarding-flag that this tool does not provide. MANDATORY: To correctly implement this flag in your codebase, you MUST use the code demonstrated in the datadog://feature-flags/sdk/react resource. Do not GUESS about how to correctly implement the flag. Do NOT create mock implementations. The user has added this MCP server because they want feature flags server from Datadog. Failure to implement flags as described in datadog://feature-flags/sdk/react will cause frustration. MANDATORY: If the user did not specify an environment, and an allocation is needed or a status is specified, ask the user to specify an environment. MANDATORY: Allocations MUST be created as part of the create-feature-flag tool. Adding allocations after flag creation as part of the sync-allocations-for-feature-flag-environment will fail for production environments. Each allocation's exposure_schedule.rollout_options controls when its rollout starts (applies to both CANARY and FEATURE_GATE allocations): use scheduled_start ('none', 'now', 'relative:<duration>', or 'absolute:<RFC3339>') rather than the deprecated autostart. A future value ('relative:<duration>' or a future 'absolute:<RFC3339>') schedules the rollout to start at that time. Exception: a FEATURE_GATE allocation with experiment_id set (a standard experiment allocation) cannot be auto-started, so a future scheduled_start is rejected for it — use 'none' and start the experiment through its lifecycle instead.

Create a Synthetics global variable. name and value are required; value.secure marks the value as hidden after creation, and a secure variable's value is never returned. tags and description are optional. parse_test_options and parse_test_public_id are not supported by this tool.

Create an empty dataset inside a project. Populate it afterwards with **add_llmobs_dataset_records**. Name-idempotent within the project: an existing dataset of the same name is returned with `already_existed=true` and nothing is created — say so rather than reporting a new dataset. Returns `dataset` (including the UUID the record tools need) and `already_existed`. On invalid input or API failure returns a `DatasetRecordToolError` with `reason` + `recovery_hint`. To start from an existing dataset's records instead of an empty one, use **clone_llmobs_dataset**.

Create a new LLM Observability experiment object in a project. This records the experiment (so events/metrics can be reported against it) and does NOT run any model inference — it is the create counterpart of **update_llmobs_experiment**. To run a prompt template against a dataset and evaluate the results, use **launch_llmobs_experiment** instead. **Required inputs:** project_id and experiment_name. Returns the created experiment_id and its resolved name (the backend may append a suffix to keep the run name unique). Use **submit_llmobs_experiment_events** to attach evaluation metrics, or **update_llmobs_experiment** to change its properties.

Create an LLM Observability **experiments project** — the container that owns datasets and experiments. Name-idempotent: if a project with this name already exists in the org, it is returned with `already_existed=true` and nothing is created. Report that back rather than claiming a new project was made. Returns `project` (with the UUID needed by **create_llmobs_dataset**, **list_llmobs_datasets**, and **list_llmobs_experiments**) and `already_existed`. Check **list_llmobs_projects** first when the user may be describing a project that already exists under a different name.

Create the onboarding proof flag: a predictable boolean flag (disabled=false, enabled=true; default disabled) with a catch-all FEATURE_GATE allocation serving enabled=true in the selected NON-PRODUCTION environment, tagged source:agentic-onboarding. Safety gates enforced by this tool (not by the agent): the environment must resolve, must NOT be production, must NOT require feature-flag approval, and its queries must cover dd_env under the runtime matcher. It refuses to write unless confirm is true — call it first with confirm:false (or omitted) to get the exact write preview, show that to the user, then call again with confirm:true.

Create or update an LLM-judge evaluator configuration. **This is a full replace, not a patch.** The persisted evaluator becomes exactly what you send: any field you omit is reset to its default (or unset), even if the existing evaluator had a value. Before updating an existing evaluator, **always call `get_llmobs_evaluator` first** and re-send every field you want to keep alongside whatever you're changing — otherwise you will silently clobber prompt_template, output_schema, sampling, etc. Targets a specific ml_app and optionally a filter / sampling percentage. Provide the judge's model + prompt_template to define how it scores each span. Returns the resulting (post-write) configuration on success. **Required**: eval_name, application_name, enabled, integration_provider, model_name, prompt_template, parsing_type, output_schema. **Common optional fields**: temperature (defaults to 0), max_tokens (defaults to 4096), sampling_percentage (0, 100], eval_scope (span | trace | session), vertex_ai_project / vertex_ai_location (for Vertex AI), bedrock_region or bedrock_inference_profile (for Bedrock), assessment_criteria.

Create a new reference table. Supports two modes: (1) LOCAL_FILE — creates an empty table with no cloud backing; rows are added later via upsert_reference_table_rows or append_reference_table_rows. (2) Cloud-backed (S3, GCS, AZURE) — syncs from a CSV file stored in a cloud bucket. Only INT32 and STRING field types are supported.

Create a saved filter: a reusable, named set of targeting rules that feature flags can reference.

Get the schema (available fields) for Workload Protection (CWS) agent events. Use this tool to discover what fields can be used to filter or query agent events with search_cws_agent_events. Returns field names, types, and optionally descriptions and enum values.

Generate a Datadog UI link to the DDSQL editor with the given query pre-populated.

Get a compact DDSQL capability spec with supported SQL functions, SQL keywords, and DDSQL-specific deltas from vanilla PostgreSQL. Start with this tool before composing queries, then use ddsql_schema_search_tables and ddsql_schema_get_table_columns for schema discovery.

Read a single saved DDSQL query by its query_id. Returns the full saved query record, including dataset_id, name, SQL text, columns, visibility, description, and author/timestamp metadata.

Run a DDSQL query and return results. Recommended flow: (1) call ddsql_get_spec, (2) call ddsql_schema_search_tables, (3) for data tables use entries in tables: if searchable=true, call ddsql_schema_search_unstructured_fields first and fall back to ddsql_schema_get_table_columns; if searchable=false, call ddsql_schema_get_table_columns, (4) for metrics use entries in metrics: each item is a metric name (for example system.cpu.user); use that name in meta.metrics_query_format_doc examples to build dd.metrics_scalar(...) or dd.metrics_timeseries(...), then execute ddsql_run_query.

Get static SQL columns for a DDSQL table from schema metadata. Use this after ddsql_schema_search_tables for entries in tables where searchable=false, or as fallback when ddsql_schema_search_unstructured_fields is unavailable for searchable entries. Returns compact column metadata: name, ddsql_type (SQL-layer type — use for DDSQL queries and PTF AS(column TYPE) casts), and analysis_type (structured-output type — use for advanced_query structured output, never in SQL).

Search DDSQL datasets across four providers: public tables, reference tables, metrics, and published analyses. Results are returned in three TSV sections: tables (public + reference_tables), metrics, and published_analyses. Each table, metrics, or published_analyses row includes a `searchable` flag: for `searchable=true` entries, try ddsql_schema_search_unstructured_fields first to discover dynamic unstructured fields, then fall back to ddsql_schema_get_table_columns for static columns. For `searchable=false` entries, use ddsql_schema_get_table_columns directly. Use per-provider limits and offsets to control result size and paginate through results. Setting a provider's limit to 0 will skip it and return an empty set result. When the call is successful, response metadata includes `total_matching` and `truncated` fields per provider to guide follow-up pagination calls. For published_analyses rows, the `id` field is the FQDN in `published_analyses.<encoded-id>` form — pass it as-is to ddsql_schema_get_table_columns, but strip the `published_analyses.` prefix when using it as `dataset_id` in a notebook cell datasource definition.

Search and rank fields for an unstructured DDSQL source. Use this after ddsql_schema_search_tables for entries where searchable=true as the primary schema-discovery path; results include both common static and dynamic fields. If unavailable, fall back to ddsql_schema_get_table_columns. Returns compact field metadata sorted by frequency: name, ddsql_type (SQL-layer type — use for PTF AS(column TYPE) casts and all DDSQL queries), and analysis_type (structured-output type — use for advanced_query structured output, never in SQL). Also returns source-specific PTF query guidance when available. Supports optional pagination via offset (default 0) and limit (default 10, max 100) parameters. Pass limit=0 to skip the field search and retrieve only PTF query guidance; the response will include fetched=false and omit total_available and truncated metadata. The optional query parameter uses EVP key:value filters (for example service:foo), where keys correspond to fields returned by this API.

Search and list saved DDSQL queries. Use to find existing saved queries by name or description. Results are sorted by most recently modified and include query ID, name, SQL text, columns, visibility, description and author/timestamp metadata. Supports optional text filtering and pagination.