Datadog Logs MCP Server

An MCP (Model Context Protocol) server for searching Datadog logs via HTTP.

Features

Search Datadog logs with customizable queries
Specify time ranges for log searches
Control result limits
Runs as an HTTP server on port 5000

Prerequisites

Docker and Docker Compose
Datadog API Key
Datadog Application Key

Setup

Copy the example environment file and add your Datadog credentials:

cp .env.example .env

Edit .env and add your actual Datadog keys:

DD_API_KEY=your_actual_api_key
DD_APPLICATION_KEY=your_actual_application_key
PORT=4000

Running with Docker Compose

Start the server:

docker-compose up

The server will be available at http://localhost:5000

To run in detached mode:

docker-compose up -d

To stop the server:

docker-compose down

API Endpoints

SSE Connection

GET /sse - Establish SSE connection for MCP communication

Message Endpoint

POST /messages - Send MCP protocol messages

MCP Tool: search_logs

Search Datadog logs with the following parameters:

query (required): Log search query (e.g., "env:prd AND service:pms-connectors")
from (required): Start time (e.g., "now-10m", "2024-01-01T00:00:00Z")
to (required): End time (e.g., "now", "2024-01-01T01:00:00Z")
limit (optional): Maximum number of logs to return (default: 10)

Example Usage

The server will search Datadog logs using the API endpoint:

POST https://api.datadoghq.com/api/v2/logs/events/search

With the query parameters provided through the MCP tool invocation.

Development

To build locally without Docker:

npm install
npm run build
npm start

Environment Variables

DD_API_KEY: Your Datadog API key (required)
DD_APPLICATION_KEY: Your Datadog application key (required)
PORT: Server port (default: 5000)