{{< region-pa
This opens your browser to complete the OAuth flow. Codex stores the resulting credentials so you don't need to log in again until the token expires.
+1. Verify that you have the required [permissions](#required-permissions) for the Datadog resources you want to access.
+
[2]: /bits_ai/mcp_server#toolsets
{{< /site-region >}}
@@ -159,6 +166,7 @@ Datadog's [Cursor and VS Code extension][1] includes built-in access to the mana
1. Confirm the Datadog MCP Server is available and the [tools][3] are listed: Open the chat panel, select agent mode, and click the **Configure Tools** button.
{{< img src="bits_ai/mcp_server/vscode_configure_tools_button.png" alt="Configure Tools button in VS Code" style="width:70%;" >}}
1. If you previously installed the Datadog MCP Server manually, remove it from the IDE's configuration to avoid conflicts. Open the command palette (`Shift` + `Cmd/Ctrl` + `P`) and run `MCP: Open User Configuration`.
+1. Verify that you have the required [permissions](#required-permissions) for the Datadog resources you want to access.
[2]: /ide_plugins/vscode/?tab=vscode#installation
[3]: /bits_ai/mcp_server#available-tools
@@ -181,48 +189,52 @@ Point your plugin to the MCP Server endpoint for your regional [Datadog site][3]
Selected endpoint ({{< region-param key="dd_site_name" >}}): {{< region-param key="mcp_server_endpoint" >}}.
{{% collapse-content title="Junie" level="h4" expanded=false id="jetbrains-junie" %}}
-Go to **Tools** > **Junie** > **MCP Settings** and add the following block:
+1. Go to **Tools** > **Junie** > **MCP Settings** and add the following block:
-{
- "mcpServers": {
- "datadog": {
- "type": "http",
- "url": "{{< region-param key="mcp_server_endpoint" >}}"
+ {
+ "mcpServers": {
+ "datadog": {
+ "type": "http",
+ "url": "{{< region-param key="mcp_server_endpoint" >}}"
+ }
+ }
}
- }
-}
-
+
+
+1. To enable [product-specific tools][1], include the `toolsets` query parameter at the end of the endpoint URL. For example, this URL enables _only_ APM and LLM Observability tools:
-To enable [product-specific tools][1], include the `toolsets` query parameter at the end of the endpoint URL. For example, this URL enables _only_ APM and LLM Observability tools:
+ {{< region-param key="mcp_server_endpoint" >}}?toolsets=apm,llmobs
-{{< region-param key="mcp_server_endpoint" >}}?toolsets=apm,llmobs
+1. You are prompted to login through OAuth. The status indicator in the settings displays a green tick when the connection is successful.
-You are prompted to login through OAuth. The status indicator in the settings displays a green tick when the connection is successful.
+1. Verify that you have the required [permissions](#required-permissions) for the Datadog resources you want to access.
[1]: /bits_ai/mcp_server#toolsets
{{% /collapse-content %}}
{{% collapse-content title="JetBrains AI Assistant" level="h4" expanded=false id="jetbrains-ai-assistant" %}}
-Go to **Tools** > **AI Assistant** > **Model Context Protocol (MCP)** and add the following block:
+1. Go to **Tools** > **AI Assistant** > **Model Context Protocol (MCP)** and add the following block:
-{
- "mcpServers": {
- "datadog": {
- "url": "{{< region-param key="mcp_server_endpoint" >}}"
- "headers": {
- "DD_API_KEY": "<YOUR_API_KEY>",
- "DD_APPLICATION_KEY": "<YOUR_APP_KEY>"
+ {
+ "mcpServers": {
+ "datadog": {
+ "url": "{{< region-param key="mcp_server_endpoint" >}}"
+ "headers": {
+ "DD_API_KEY": "<YOUR_API_KEY>",
+ "DD_APPLICATION_KEY": "<YOUR_APP_KEY>"
+ }
+ }
}
}
- }
-}
-
+
+
+1. To enable [product-specific tools][1], include the `toolsets` query parameter at the end of the endpoint URL. For example, this URL enables _only_ APM and LLM Observability tools:
-To enable [product-specific tools][1], include the `toolsets` query parameter at the end of the endpoint URL. For example, this URL enables _only_ APM and LLM Observability tools:
+ {{< region-param key="mcp_server_endpoint" >}}?toolsets=apm,llmobs
-{{< region-param key="mcp_server_endpoint" >}}?toolsets=apm,llmobs
+1. The status indicator in the settings displays a green tick when the connection is successful.
-The status indicator in the settings displays a green tick when the connection is successful.
+1. Verify that you have the required [permissions](#required-permissions) for the Datadog resources you want to access.
[1]: /bits_ai/mcp_server#toolsets
{{% /collapse-content %}}
@@ -273,6 +285,8 @@ Selected endpoint ({{< region-param key="dd_site_name" >}}): {{< region-pa
{{< region-param key="mcp_server_endpoint" >}}?toolsets=apm,llmobs
+1. Verify that you have the required [permissions](#required-permissions) for the Datadog resources you want to access.
+
Example configuration file locations:
| Client | Configuration file |
@@ -306,6 +320,26 @@ Example configuration file locations:
The Datadog MCP Server is under significant development, and additional supported clients may become available.
+## Required permissions
+
+MCP Server tools require the following [Datadog user role permissions][22]:
+
+| Permission | Required for |
+|------------|-------------|
+| mcp_read | Tools that read data from Datadog (for example, querying monitors, searching logs, retrieving dashboards) |
+| mcp_write | Tools that create or modify resources in Datadog (for example, creating monitors, muting hosts) |
+
+In addition to `mcp_read` or `mcp_write`, users need the standard Datadog permissions for the underlying resource. For example, using an MCP tool that reads monitors requires both `mcp_read` and the [Monitors Read][24] permission. See [Datadog Role Permissions][25] for the full list of resource-level permissions.
+
+Users with the **Datadog Standard Role** have both MCP Server permissions by default. If your organization uses [custom roles][23], add the permissions manually:
+1. Go to [**Organization Settings > Roles**][26] as an administrator, and click the role you want to update.
+1. Click **Edit Role** (pencil icon).
+1. Under the permissions list, select the **MCP Read** and **MCP Write** checkboxes.
+1. Select any other resource-level permissions you need for the role.
+1. Click **Save**.
+
+Organization administrators can manage global MCP access and write capabilities from [Organization Settings][27].
+
## Authentication
The MCP Server uses OAuth 2.0 for [authentication][14]. If you cannot go through the OAuth flow (for example, on a server), you can provide a Datadog [API key and application key][1] as `DD_API_KEY` and `DD_APPLICATION_KEY` HTTP headers.
@@ -409,3 +443,9 @@ Local authentication is recommended for Cline and when remote authentication is
[19]: https://claude.ai
[20]: https://coterm.datadoghq.com/mcp-cli/datadog_mcp_cli.exe
[21]: /getting_started/site/
+[22]: /account_management/rbac/permissions/#mcp
+[23]: /account_management/rbac/?tab=datadogapplication#custom-roles
+[24]: /account_management/rbac/permissions/#monitors
+[25]: /account_management/rbac/permissions/
+[26]: https://app.datadoghq.com/organization-settings/roles
+[27]: https://app.datadoghq.com/organization-settings/preferences