Developer Tools & Devops · Datadog + Claude
Datadog MCP with Claude: Faster Incident Investigation and Monitoring
The short answer
Claude works with Datadog through the Model Context Protocol, an open standard that lets Claude securely read information and take approved actions in the tool. Once connected, teams can ask Claude questions in plain language about logs, metrics, traces and alerts. Access is limited by permissions the organisation sets, and consequential actions can require human approval.
What is Datadog?
Datadog is a cloud monitoring and observability platform for applications and infrastructure. It brings together metrics, logs and traces in one place so teams can spot problems early and tune performance. Engineering, site reliability, DevOps and IT operations teams typically use it to watch live systems, set alerts and investigate incidents when something goes wrong.
How Claude connects to Datadog through MCP
The Model Context Protocol, or MCP, is an open standard that acts like a universal adapter between Claude and other software. It lets Claude use a tool securely, reading information and taking actions, with permissions the organisation controls. Datadog offers its own MCP server, and where that is not the right fit, a secure managed connector can be used instead.
Once connected, Claude can typically search logs, fetch metrics for a given service or time period, review alerts and help follow a trace through a request. A team member might ask, in plain English, why checkout response times rose last night, and Claude can gather the relevant data and summarise what it finds.
Permissions and approvals keep people in charge. Access is set using the sign-in method Datadog supports, such as OAuth sign-in, an API key or an access token, and it is limited to only what each workflow needs. Actions that change alerts or systems can be routed to a named person for approval before anything happens, and every request is logged for review.
What you can automate
Overnight incident triage
When an alert fires out of hours, Claude can gather related logs, metrics and recent traces and produce a short summary of likely causes. The on-call engineer starts from a clear picture rather than searching several screens. People still decide on the fix and whether to escalate.
Plain-language log questions
Operations managers and support leads often need an answer, not a query. Claude can translate a question such as how many payment errors happened this week into the right search, then explain the result. This reduces the wait for busy engineers and widens access to useful data.
Performance review reports
Each week, teams can ask Claude to pull metrics for key services and compare them with the previous period. Claude can draft a readable report highlighting trends, slow endpoints and rising error rates, which the team reviews before sharing with leaders.
Alert noise reduction
Where alerts fire too often, Claude can review which ones were triggered, how often, and whether they led to real action. It can suggest which thresholds or conditions to review. Changes are proposed for a person to approve, so no alert is altered without oversight.
Post-incident reviews
After an outage, Claude can help assemble the timeline from alerts, logs and metrics, saving hours of manual collection. Teams can then focus on learning and prevention. The final review remains the responsibility of the people involved.
An end-to-end workflow: Checkout slowdown to customer support update
TriggerA Datadog alert shows a sustained rise in checkout response time.
Claude receives the alert and, through the Datadog connection, fetches metrics and recent error logs for the checkout service.
Claude identifies the endpoints and time window most affected and summarises the likely pattern.
The summary is posted to the incident channel in Microsoft 365 Teams for the on-call engineer to review.
The engineer approves a draft status note, which Claude creates in the ticketing system and links to the Datadog dashboard.
Once metrics return to normal, Claude prepares a closing summary for the post-incident review file.
OutcomeTeams typically reach a clear diagnosis faster, support staff receive accurate updates sooner, and the record of the incident is complete without manual note-taking.
How we set it up
Free automation audit
We review how your teams use Datadog today, where alerts and investigations take the most time, and which workflows are worth automating first. The audit is free and carries no obligation.
Secure connection
We connect Claude to Datadog using the sign-in method your account supports, whether OAuth sign-in, an API key or an access token. Access is set to the least permissions each workflow needs.
Workflow design
We design the end-to-end flow across Datadog and your other systems such as Microsoft 365, your CRM, ERP or ticketing tool. We agree which actions run automatically and which need a person's approval.
Testing against real cases
We test the workflow against past incidents and real questions from your team. Results are checked for accuracy, and we adjust prompts, permissions and approval steps until the output is reliable.
Launch, monitoring and training
We launch with audit logs and monitoring in place, then train your engineers, operations staff and managers on how to use the connection safely and effectively.
Who benefits
- Site reliability and DevOps engineers
- Faster triage and fewer manual steps when investigating alerts and incidents.
- IT operations managers
- Clearer weekly reporting on service health, with a documented record of each action taken.
- Engineering leaders
- Better visibility of performance trends and alert quality, without waiting on ad hoc data requests.
- Support and customer success leads
- Accurate, timely updates during incidents, drawn from real monitoring data.
Security and control
- Least-privilege access, so Claude sees only the data and actions each workflow requires.
- Human approval for any action that changes alerts, configurations or live systems.
- Full audit logs of every request Claude makes and every action taken.
- Clear sign-in control using OAuth, API keys or access tokens managed by your own administrators.
- Regular review of permissions and workflows as your systems and team change.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can have their workflows designed to meet their own data protection and security requirements. In India, we work within the Digital Personal Data Protection Act, 2023. For organisations in the UAE and Saudi Arabia, we account for local data protection laws. Custom applications can be hosted in India, the United States, the United Kingdom or the European Union, and the hosting region is chosen to meet your compliance needs.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the Datadog MCP server do?
The Datadog MCP server is the connector that lets AI tools such as Claude reach Datadog in a controlled way. It makes it possible to read logs, metrics and alerts, and to carry out permitted actions, using the Model Context Protocol. Datadog also offers a direct API route, and we choose the option that suits your setup.
Is connecting Claude to Datadog secure?
Security depends on how the connection is set up, which is why we focus on it. We use the sign-in method Datadog supports, limit access to least privilege, and route consequential actions to a person for approval. Every request is logged, so your team can see exactly what was accessed and why.
What can Claude do with Datadog once connected?
Typically, Claude can search logs, fetch metrics for a service or time period, review alerts and help follow traces. It can summarise findings, draft reports and suggest alert changes. Whether it can take any action depends on the permissions you grant, and sensitive changes can be kept behind an approval step.
How long does setup take?
Timelines vary with the size of your environment and the number of workflows. A focused first workflow is often ready within a few weeks, following the free audit, secure connection, testing and training. We confirm a realistic schedule during the audit so there are no surprises.
Which plan or permissions do I need?
Requirements depend on your Datadog account setup and on the sign-in method you choose, such as OAuth sign-in, an API key or an access token. In general, the connection needs permissions that match the workflows you want. We confirm what your account supports during the free audit and recommend the least access that does the job.