What's the difference between the API key and the application key?

The API key identifies which Datadog account is being billed; the application key authorizes what that specific integration is allowed to call. Both are required together for most endpoints.

Can this tool trigger or acknowledge alerts?

The client supports it via v1.MonitorsApi, but that's a write operation and should be a separate, explicitly-approved tool rather than bundled with read-only queries.

Is there an India-region Datadog deployment?

Datadog's regions are US and EU; there is no dedicated India region as of this writing, which is worth factoring into a DPDP-sensitive monitoring setup.

monitoringTechArticle

Query Datadog Metrics and Logs from an MCP Server

Expose Datadog metric queries and log search as MCP tools, with both an API key and an application key.

Quick Answer / TL;DR

A Datadog MCP server uses the official @datadog/datadog-api-client SDK, authenticated with both an API key and an application key, to expose metric queries and log search as read-only tools.

Key Takeaways

Datadog requires two credentials, not one: an API key identifies the account, an application key authorizes the specific API call.
Metric and log-search endpoints are rate-limited separately from each other, so cache repeated queries within a session where possible.
Keep the tool read-only - dashboard and monitor mutation endpoints exist in the same client and should not be wired up without a separate approval step.

Querying metrics and logs

The v1.MetricsApi and v1.LogsApi clients from @datadog/datadog-api-client cover the two most common agent requests: a time-series metric query and a log search. Both need explicit from/to time bounds - an unbounded query is the easiest way to accidentally scan a huge amount of data.

typescript

import { client, v1 } from "@datadog/datadog-api-client";

const configuration = client.createConfiguration({
  authMethods: {
    apiKeyAuth: process.env.DD_API_KEY!,
    appKeyAuth: process.env.DD_APP_KEY!,
  },
});

const metricsApi = new v1.MetricsApi(configuration);
const logsApi = new v1.LogsApi(configuration);

async function queryMetrics(query: string, fromSeconds: number, toSeconds: number) {
  return metricsApi.queryMetrics({ query, from: fromSeconds, to: toSeconds });
}

async function searchLogs(query: string, from: string, to: string, limit = 100) {
  return logsApi.listLogs({
    body: { filter: { query, from, to }, page: { limit }, sort: "-timestamp" },
  });
}