How to set up the Datadog MCP server

Datadog monitors infrastructure, applications, logs, and observability signals. Use OAuth for a user-delegated connection or a dedicated service account with scoped API and application keys for unattended automation.

This guide covers Datadog-side prerequisites for an MCP server. The Datadog agent template is a separate Dome deployment.

Choose a connection method

Choose OAuth when the MCP connection should represent an individual Datadog user and use the hosted MCP authorization flow. Choose a dedicated service account with an API key and application key for an unattended connection. Datadog's MCP setup guide and API/application-key guide document both paths.

Recommended: OAuth

Use OAuth when the MCP server is user-delegated. The authorizing user's Datadog role and underlying dashboard, monitor, log, and metric permissions continue to constrain the connection.

1. Confirm the Datadog site (US1, US3, US5, EU, or another site) that owns the target data.

2. An organization administrator must open Organization Settings → MCP OAuth Redirect URLs and add this exact URL:

   https://api.domesystems.ai/oauth/callback

   Dome registers its OAuth client dynamically and requests Datadog's published mcp_all MCP scope; do not create a separate client or client secret. Datadog will return Mismatching redirect URI until this URL is allow-listed.

3. In Organization Settings, enable MCP Access. Then give the OAuth test user MCP Read plus the underlying resource permissions it needs (for example, Monitors Read). A Datadog Standard Role includes the MCP permissions by default; custom roles must add them explicitly.

4. Start OAuth with that test user and the smallest Datadog role required for the intended dashboards, monitors, and logs. Start with the generally available core toolset. The apm toolset is Preview, so add it only after requesting its Datadog access.

5. Read a known monitor or dashboard, then verify that an asset outside the permitted team or account is unavailable.

Alternative: Service-account API and application keys

Use a dedicated Datadog service account for non-interactive monitoring automation. Create an API key and application key for that service account—not a human administrator—and limit its roles to the intended dashboards, monitors, logs, and metrics.

1. Confirm the Datadog site that owns the target data; API and application keys must belong to that same account.
2. Create the service account with the smallest role required for the MCP workflow.
3. Create its API key and application key, then configure the MCP client with both values using its documented authentication fields.
4. Store both secrets in the MCP client's secret storage, record their owner and rotation dates, and test a permitted monitor or dashboard plus a denied resource.

See Datadog's MCP server overview for the service and toolset model, its MCP setup guide for OAuth and role permissions, and its authentication documentation for API/application keys.

Verify Datadog MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that Datadog MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved Datadog boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

• Mismatching redirect URI: an organization administrator must add https://api.domesystems.ai/oauth/callback under Organization Settings → MCP OAuth Redirect URLs. Start OAuth again after saving it.
• Authorization server declined the request: verify that MCP Access is enabled organization-wide and the authorizing user has MCP Read and the underlying resource permissions. If the connection requests apm, confirm the user has the required APM Preview access or retry with the core toolset only.
• Other authentication failures commonly come from using the wrong Datadog site or pairing an API key with an application key from a different account. Valid keys with forbidden operations indicate role or restriction-policy configuration.

Next steps

Deploy the Datadog agent template to create a governed agent in Dome that can inspect the approved observability data, with the template's included model, tools, and rules.