Developer Tools & Devops · Datadog MCP + Claude
Datadog MCP with Claude: Faster Incident Investigation and Service Health Checks
The short answer
Claude works with Datadog through the Model Context Protocol (MCP), an open standard that gives Claude secure, permission-controlled access to Datadog. Once connected, Claude can query metrics, investigate incidents, inspect dashboards and check service health when someone asks in natural language. Your organisation controls which data Claude can see and which actions it can take.
What is Datadog MCP?
Datadog is a monitoring and observability platform used by engineering, DevOps and site reliability teams to watch cloud-scale applications and infrastructure. It gathers telemetry such as metrics, logs and traces, shows them on dashboards, links related events together and alerts people when something looks wrong. Teams use it to spot problems early, understand what caused an incident and keep customer-facing services running smoothly.
How Claude connects to Datadog MCP through MCP
The Model Context Protocol (MCP) is an open standard that lets Claude use other software securely. Think of it as a universal adapter between Claude and a tool. Datadog MCP lets Claude reach your Datadog environment using the sign-in method Datadog supports, which is DCR OAuth, so access is granted through a standard, controlled login rather than shared passwords.
Once connected, Claude can read information such as metrics, dashboard contents, incident details and service health status. For example, an on-call engineer can ask, "What changed in checkout latency in the last hour?" and receive a summary drawn from live telemetry. Claude can also help correlate events across services, which typically speeds up the first stage of an investigation.
Permissions and approvals keep people in charge. Access is scoped to the least privilege the job requires, so Claude sees only what it needs. Consequential actions, such as changing monitors or triggering workflows, can be set to require human approval. Every interaction is logged, giving your team a clear audit trail of what was queried and by whom.
What you can automate
Natural-language incident triage
When an alert fires, an on-call engineer can ask Claude to summarise related errors, latency spikes and recent deployments across services. Instead of building queries by hand under pressure, the engineer gets a clear starting point within minutes. Claude points to likely areas to investigate, while the engineer makes the final call.
Service health check-ins
Operations leads can ask for a plain-English status of key services before a shift handover or a release. Claude can review service health and recent trends and report what looks normal and what needs attention. This gives non-specialist managers a reliable view without learning the dashboard layout.
Dashboard review and explanation
Product and engineering teams often struggle to interpret busy dashboards. Claude can inspect a dashboard and explain what each panel shows, which trends matter and what has changed since the last review. This helps new team members get up to speed faster and keeps reviews focused.
Post-incident reporting
After an incident, teams need an accurate timeline. Claude can gather the relevant metrics and events from the incident window and draft a first-pass timeline for the post-incident review. The team checks and refines the draft, which typically saves considerable time on documentation.
Capacity and cost awareness
Engineering leaders can ask questions such as which services have grown fastest over the past month or where resource use is consistently high. Claude can surface these patterns from telemetry so planning conversations start from evidence rather than memory.
An end-to-end workflow: Incident response with ticket and chat follow-up
TriggerA Datadog monitor fires for elevated error rates on the payments service.
Claude, connected to Datadog through MCP, pulls the error rate, latency and recent deployment events for the payments service.
Claude correlates the spike with changes in upstream services and summarises the most likely contributing factors.
The on-call engineer reviews the summary and asks Claude to inspect the related dashboard for further detail.
Claude drafts an incident ticket in the organisation's ticketing system with the timeline, affected services and initial findings.
The engineer approves the ticket, which is created and posted to the incident channel in Microsoft Teams.
Claude records the closing summary once the service recovers, ready for the post-incident review.
OutcomeIncident triage starts faster, the ticket and team channel stay up to date, and the post-incident review begins with an accurate timeline. Typical results vary by environment, and people approve every action.
How we set it up
Free automation audit
We review how your teams monitor services today and identify the incident and reporting workflows worth automating first. You leave with a clear, prioritised list and no obligation.
Secure connection with DCR OAuth
We connect Claude to Datadog using DCR OAuth, the sign-in method Datadog supports. Access is granted through a standard, controlled login, and we configure it with least-privilege permissions.
Workflow design
We design the end-to-end workflow across Datadog and your other systems, such as Microsoft 365, ticketing or CRM. Approval points are placed around any action that changes state.
Testing against real cases
We test the workflow against past incidents and real service data from your environment. We refine prompts, permissions and approval steps until the outputs match what your engineers need.
Launch, monitoring and training
We launch with audit logs and monitoring in place, then train your on-call, operations and management teams on how to use Claude with Datadog safely and effectively.
Who benefits
- On-call and site reliability engineers
- Faster first-pass investigation of alerts, with correlated context gathered in one conversation.
- Engineering and DevOps leads
- Consistent, auditable incident records and clearer post-incident timelines.
- Operations and service managers
- Plain-English service health updates without needing to navigate complex dashboards.
- Product and platform teams
- Easier interpretation of dashboards and telemetry trends when planning releases and capacity.
Security and control
- Least-privilege access so Claude sees only the data each role requires.
- DCR OAuth sign-in, so access is controlled through a standard login rather than shared credentials.
- Human approval before any consequential action, such as changing monitors or triggering workflows.
- Audit logs that record queries and actions for review by your security and engineering teams.
- Regular review of permissions as teams, services and responsibilities change.
For teams in the US, UK, India and the Middle East
Organisations in the United States and the United Kingdom can host Claude in their chosen region to align with their data residency and security requirements. Indian organisations can design their workflows to support obligations under the Digital Personal Data Protection Act, 2023. Organisations in the UAE and Saudi Arabia can address local data protection laws through regional hosting and access controls. Hosting region is chosen during design to meet each organisation's specific requirements.
Learn more about Claude and MCP
Anthropic's AI model and assistant.
Secure links between Claude and business tools.
How engineers build and change software with Claude.
Hosted agents that run multi-step work.
The open standard Claude uses to connect to tools.
Frequently asked questions
What does the Datadog MCP server do?
The Datadog MCP server is the connector that lets AI tools such as Claude reach your Datadog environment in a controlled way. It allows the AI to query metrics, inspect dashboards, investigate incidents and check service health when asked in natural language. It uses the access permissions you set, so the AI can only work with the data you allow.
Is connecting Datadog to Claude secure?
Security depends on how the connection is designed. Using DCR OAuth, access is granted through a standard sign-in process rather than shared passwords. We apply least-privilege permissions, require human approval for consequential actions and keep audit logs of activity. We review your security requirements before launch.
What can Claude actually do with Datadog?
Typically, Claude can read metrics, logs-related events, dashboard contents and service health, then summarise them and explain patterns. It can help correlate events during an incident and draft reports. Any action that changes your environment can be restricted or set to require approval, depending on your policies.
How long does setup take?
Timelines vary with the size of your environment and the number of workflows involved. A focused first workflow often moves from audit to launch in a few weeks, including testing and team training. We confirm a realistic schedule during the free automation audit.
What plan or permissions do I need?
Generally, you need a Datadog account with access permissions that allow the data and actions you want Claude to use, and an administrator who can approve the DCR OAuth connection. The exact requirements depend on your Datadog setup and your internal policies, so we confirm them during the audit.