sushilti80/datadog-mcp

# Automated incident detection and response
1. Monitor error rates: get_logs("status:error", minutes_back=5)
2. Analyze impact: get_metrics("error.rate", hours_back=1) 
3. Generate response plan: datadog-incident-commander prompt
4. Execute mitigation steps based on AI recommendations

# Proactive performance monitoring
1. Baseline analysis: get_metrics("response.time", hours_back=24)
2. Anomaly detection: Compare current vs historical patterns
3. Root cause analysis: datadog-performance-diagnosis prompt
4. Optimization recommendations with business impact

# Data-driven capacity decisions
1. Trend analysis: get_metrics("cpu,memory,disk", hours_back=720)
2. Growth forecasting: Historical pattern analysis
3. Resource optimization: Identify over/under-provisioned resources
4. Cost optimization: Resource efficiency recommendations

# Comprehensive service ecosystem monitoring
services = ["api-gateway", "user-service", "payment-service"]
for service in services:
    health = datadog://health-check/{service}
    # Aggregate health scores, identify dependencies

# Automated SLA compliance tracking
1. Error rate monitoring: get_logs("service:api status:error")
2. Performance tracking: get_metrics("p95.response.time")
3. Availability calculation: Uptime percentage analysis
4. Executive reporting: Business-friendly metrics translation

# Automated security incident response
1. Threat detection: get_logs("auth.failure OR 403 OR suspicious")
2. Impact assessment: Identify affected services and users
3. Timeline reconstruction: Correlate events across services
4. Remediation guidance: Security-focused recommendations

cd fastMCPserver
python3 -m venv .venv
source .venv/bin/activate  # On Windows: .venv\Scripts\activate
pip install -r requirements.txt

cp .env.example .env
# Edit .env with your Datadog credentials:
# DD_API_KEY=your_datadog_api_key
# DD_APP_KEY=your_datadog_app_key  
# DD_SITE=us3.datadoghq.com  # or your Datadog site

python3 datadog_mcp_server.py

// Basic CPU usage over last 30 minutes
{
  "name": "get_metrics",
  "arguments": {
    "query": "avg:system.cpu.user{*}",
    "minutes_back": 30
  }
}

// Memory usage for specific service over last 2 hours
{
  "name": "get_metrics", 
  "arguments": {
    "query": "avg:system.mem.used{service:api-gateway}",
    "hours_back": 2
  }
}

// Request rate trends over last week
{
  "name": "get_metrics",
  "arguments": {
    "query": "sum:trace.http.request.hits{env:production}",
    "hours_back": 168
  }
}

// Error rate by service over last 24 hours
{
  "name": "get_metrics",
  "arguments": {
    "query": "sum:trace.http.request.errors{*} by {service}",
    "hours_back": 24
  }
}

// Recent errors from API gateway (last 30 minutes)
{
  "name": "get_logs", 
  "arguments": {
    "query": "service:api-gateway AND status:error",
    "minutes_back": 30,
    "limit": 50,
    "sort": "-timestamp"
  }
}

// Deployment-related logs from last 2 hours
{
  "name": "get_logs",
  "arguments": {
    "query": "deploy OR release OR rollout",
    "hours_back": 2,
    "limit": 100
  }
}

// Critical errors from specific time window
{
  "name": "get_logs",
  "arguments": {
    "query": "status:critical OR level:critical",
    "from_time": "2025-09-24T10:00:00Z",
    "to_time": "2025-09-24T12:00:00Z",
    "limit": 200
  }
}

// Authentication failures from security index
{
  "name": "get_logs",
  "arguments": {
    "query": "auth.failure OR unauthorized OR 403",
    "hours_back": 24,
    "indexes": ["security", "audit"],
    "max_total_logs": 500
  }
}

// Performance issues with pagination
{
  "name": "get_logs",
  "arguments": {
    "query": "slow OR timeout OR performance",
    "hours_back": 6,
    "limit": 100,
    "max_total_logs": 1000
  }
}

// List all available metrics
{
  "name": "list_metrics",
  "arguments": {}
}

// Filter metrics for specific host
{
  "name": "list_metrics",
  "arguments": {
    "filter_query": "web-server-01"
  }
}

// Filter by environment tag
{
  "name": "list_metrics",
  "arguments": {
    "filter_query": "env:production"
  }
}

// Filter by service
{
  "name": "list_metrics",
  "arguments": {
    "filter_query": "service:api-gateway"
  }
}

// Get all monitors
{
  "name": "get_monitors",
  "arguments": {}
}

// Get only alerting monitors
{
  "name": "get_monitors",
  "arguments": {
    "group_states": "alert"
  }
}

// Get monitors in warning or alert state
{
  "name": "get_monitors", 
  "arguments": {
    "group_states": "alert,warn"
  }
}

// List all dashboards
{
  "name": "list_dashboards",
  "arguments": {}
}

// Continue pagination from previous search
{
  "name": "get_next_datadog_logs_page",
  "arguments": {
    "cursor": "eyJhZnRlciI6IjIwMjUtMDktMjRUMTU6MzA6MDBaIn0",
    "limit": 100
  }
}

// Get larger page size for batch processing
{
  "name": "get_next_datadog_logs_page",
  "arguments": {
    "cursor": "eyJhZnRlciI6IjIwMjUtMDktMjRUMTU6MzA6MDBaIn0",
    "limit": 500
  }
}

// Monitor key rotation system health
{
  "name": "get_key_pool_status",
  "arguments": {}
}

{
  "status": "success", 
  "total_keys": 3,
  "available_keys": 2,
  "rotation_strategy": "adaptive",
  "keys": [
    {
      "id": "primary",
      "health": "healthy", 
      "success_rate": 0.95,
      "total_requests": 150,
      "consecutive_failures": 0,
      "average_response_time": 0.245
    }
  ],
  "recommendations": [
    "ℹ️ 1 keys currently unavailable"
  ]
}

// Analyze CPU trends over last 24 hours
{
  "name": "datadog-metrics-analysis",
  "arguments": {
    "metric_query": "avg:system.cpu.user{env:production}",
    "time_range_hours": "24"
  }
}

// Analyze error rates with AI recommendations  
{
  "name": "datadog-metrics-analysis",
  "arguments": {
    "metric_query": "sum:trace.http.request.errors{*} by {service}",
    "time_range_hours": "168"
  }
}

// High response time investigation
{
  "name": "datadog-performance-diagnosis",
  "arguments": {
    "service_name": "api-gateway",
    "symptoms": "Response times increased by 300% in last hour",
    "severity": "high"
  }
}

// Memory leak investigation
{
  "name": "datadog-performance-diagnosis", 
  "arguments": {
    "service_name": "payment-processor",
    "symptoms": "Memory usage continuously increasing, occasional OOM errors",
    "severity": "critical"
  }
}

// Database performance issues
{
  "name": "datadog-performance-diagnosis",
  "arguments": {
    "service_name": "user-service",
    "symptoms": "Slow database queries, connection pool exhaustion",
    "severity": "medium"
  }
}

// Critical multi-service outage
{
  "name": "datadog-incident-commander",
  "arguments": {
    "severity": "critical",
    "affected_services": "api-gateway, payment-service, user-authentication",
    "symptoms": "Complete service outage, 100% error rate, users cannot login",
    "estimated_user_impact": "85%"
  }
}

// High severity database issue
{
  "name": "datadog-incident-commander",
  "arguments": {
    "severity": "high", 
    "affected_services": "database-cluster, reporting-service",
    "symptoms": "Database connection timeouts, slow query performance",
    "estimated_user_impact": "25%"
  }
}

// Deployment-related incident
{
  "name": "datadog-incident-commander",
  "arguments": {
    "severity": "medium",
    "affected_services": "api-gateway",
    "symptoms": "Increased error rate after deployment, partial functionality affected",
    "estimated_user_impact": "15%"
  }
}

// Performance analysis guidance
{
  "name": "datadog-time-range-advisor",
  "arguments": {
    "analysis_type": "performance",
    "suspected_timeframe": "recent",
    "incident_impact": "high"
  }
}

// Security investigation guidance
{
  "name": "datadog-time-range-advisor",
  "arguments": {
    "analysis_type": "security", 
    "suspected_timeframe": "hours",
    "incident_impact": "critical"
  }
}

// Capacity planning guidance
{
  "name": "datadog-time-range-advisor",
  "arguments": {
    "analysis_type": "capacity",
    "suspected_timeframe": "weeks",
    "incident_impact": "medium"
  }
}

// Deployment verification guidance
{
  "name": "datadog-time-range-advisor",
  "arguments": {
    "analysis_type": "deployment",
    "suspected_timeframe": "recent",
    "incident_impact": "low"
  }
}

// Get CPU metrics with analysis
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://metrics/avg:system.cpu.user{env:production}"
  }
}

// Get request rate trends
{
  "jsonrpc": "2.0", 
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://metrics/sum:trace.http.request.hits{service:api-gateway}"
  }
}

// Get recent errors with context
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read", 
  "params": {
    "uri": "datadog://logs/service:api-gateway status:error"
  }
}

// Get deployment-related logs
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://logs/deploy OR release OR rollout"
  }
}

// Detailed error analysis
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://logs-detailed/status:500 OR status:502 OR status:503"
  }
}

// Security incident analysis
{
  "jsonrpc": "2.0",
  "id": 1, 
  "method": "resources/read",
  "params": {
    "uri": "datadog://logs-detailed/auth.failure OR unauthorized OR 403"
  }
}

// API Gateway health assessment
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://health-check/api-gateway"
  }
}

// Database service health check
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read", 
  "params": {
    "uri": "datadog://health-check/database-primary"
  }
}

// Payment service comprehensive analysis
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://health-check/payment-processor"
  }
}

// Active incident (last 15 minutes)
{"query": "status:error", "minutes_back": 15}

// Deployment verification (last 2 hours)  
{"query": "deploy OR release", "hours_back": 2}

// Weekly performance trends
{"query": "slow OR timeout", "hours_back": 168}

// Monthly capacity planning
{"query": "cpu OR memory", "hours_back": 720}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list",
  "params": {}
}

{
  "jsonrpc": "2.0", 
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "get_metrics",
    "arguments": {
      "query": "avg:system.cpu.user{*}",
      "minutes_back": 30
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1, 
  "method": "tools/call",
  "params": {
    "name": "get_logs",
    "arguments": {
      "query": "status:error",
      "hours_back": 1,
      "limit": 50,
      "sort": "-timestamp"
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call", 
  "params": {
    "name": "datadog-time-range-advisor",
    "arguments": {
      "analysis_type": "performance",
      "suspected_timeframe": "recent",
      "incident_impact": "high"
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "datadog-performance-diagnosis", 
    "arguments": {
      "service_name": "api-gateway",
      "symptoms": "High response time, increased error rate",
      "severity": "high"
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "datadog-incident-commander",
    "arguments": {
      "severity": "critical",
      "affected_services": "api-gateway, database",
      "symptoms": "Service timeout, 500 errors",
      "estimated_user_impact": "25%"
    }
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read",
  "params": {
    "uri": "datadog://health-check/api-gateway"
  }
}

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "resources/read", 
  "params": {
    "uri": "datadog://metrics/avg:system.cpu.user{*}"
  }
}

// Step 1: Get recent errors
{"name": "get_logs", "arguments": {"query": "status:error", "minutes_back": 30}}

// Step 2: Check error rate metrics  
{"name": "get_metrics", "arguments": {"query": "sum:trace.http.request.errors{*}", "hours_back": 1}}

// Step 3: Get service health assessment
// Use resources/read with uri: "datadog://health-check/your-service-name"

// Step 1: Get time range advice
{"name": "datadog-time-range-advisor", "arguments": {"analysis_type": "performance"}}

// Step 2: Follow the recommended time ranges
{"name": "get_metrics", "arguments": {"query": "avg:trace.http.request.duration{*}", "minutes_back": 30}}

// Step 3: Get detailed performance diagnosis
{"name": "datadog-performance-diagnosis", "arguments": {"service_name": "api"}}

{
  "hours_back": 2,          // Number, not string
  "minutes_back": 30,       // Number, not string  
  "limit": 100,             // Number, not string
  "from_time": "2025-09-14T15:00:00Z",  // ISO string
  "indexes": ["main"],      // Array, not string
  "sort": "-timestamp"      // String
}

{
  "hours_back": "2",        // String instead of number
  "minutes_back": "",       // Empty string instead of null/number
  "from_time": "2h",        // Relative time instead of ISO
  "indexes": "main"         // String instead of array
}

# Check if port is in use
lsof -i :8080

# Check environment variables
echo $DD_API_KEY
echo $DD_APP_KEY

# Check logs for detailed errors
python3 datadog_mcp_server.py

# ✅ Efficient queries (fast responses)
get_logs("service:api status:error", minutes_back=15, limit=50)
get_metrics("avg:response.time{service:api}", hours_back=1)

# ❌ Inefficient queries (slow responses)  
get_logs("*", hours_back=168, limit=10000)  # Too broad, too much data
get_metrics("*", hours_back=720)            # Wildcard with long range

# Use pagination for large datasets
page_1 = get_logs("service:api", hours_back=24, limit=100)
if page_1.get("has_more"):
    page_2 = get_next_datadog_logs_page(page_1["next_cursor"], limit=100)

# Batch related queries efficiently
metrics_queries = [
    ("cpu", "avg:system.cpu.user{service:api}"),
    ("memory", "avg:system.mem.used{service:api}"),
    ("requests", "sum:trace.http.request.hits{service:api}")
]

# Match time range to use case
Real-time troubleshooting:    minutes_back=15-30
Recent issue investigation:   hours_back=1-6  
Trend analysis:              hours_back=24-168
Capacity planning:           hours_back=720-2160

# Use specific ranges instead of defaults
get_logs("deploy", hours_back=2)     # ✅ Specific to deployment window
get_logs("deploy")                   # ❌ Uses default 1 hour

# Implement client-side caching for repeated queries
cache_key = f"metrics:{query}:{hours_back}"
if cache_key not in cache or cache_expired(cache_key):
    result = get_metrics(query, hours_back=hours_back)
    cache[cache_key] = result

# Respect API rate limits with exponential backoff
import time
def get_metrics_with_retry(query, hours_back, max_retries=3):
    for attempt in range(max_retries):
        try:
            return get_metrics(query, hours_back=hours_back)
        except RateLimitError:
            time.sleep(2 ** attempt)  # Exponential backoff

# Enable full debug tracing
export MCP_DEBUG_LEVEL=TRACE
export MCP_DEBUG_REQUESTS=true
export MCP_DEBUG_RESPONSES=true
export MCP_DEBUG_TIMING=true
export MCP_DEBUG_PARAMETERS=true

# Start server with debug enabled
python3 datadog_mcp_server.py

# Build image
docker build -t datadog-mcp-server .

# Run container
docker run -p 8080:8080 \
  -e DD_API_KEY=your_api_key \
  -e DD_APP_KEY=your_app_key \
  -e DD_SITE=us3.datadoghq.com \
  datadog-mcp-server