Datadog

Connect Datadog so CloudThinker can triage alerting monitors, search logs, query metrics, follow traces, and read incidents, hosts, and dashboards. CloudThinker reaches Datadog through the Datadog MCP server, authenticated with an API key plus an application key scoped to read permissions. Datadog has two separate setups. For automatic root cause analysis on Datadog alerts, you need both.

Setup	What it does	When you need it
Investigate (this connection)	Lets agents read logs, metrics, traces, and monitors	Always. Without it, agents can’t look inside Datadog.
Receive alerts (webhook)	Opens a Resolve incident when a monitor fires	When you want incidents to open on their own. See Send Datadog alerts to Resolve.

Prerequisites

A Datadog organization on one of these sites: US1, US3, US5, EU1, AP1, or AP2. Government sites (ddog-gov.com) aren’t supported by the Datadog MCP server.
MCP Access turned on in Datadog Organization Settings. A Datadog admin does this once per organization.
Datadog permission to create API keys and application keys.
Permission to add connections in your CloudThinker workspace.

Setup

Find your site

Look at the address bar when you’re signed in to Datadog:

Your Datadog URL	Pick in CloudThinker
`app.datadoghq.com`	US1 (datadoghq.com)
`us3.datadoghq.com`	US3 (us3.datadoghq.com)
`us5.datadoghq.com`	US5 (us5.datadoghq.com)
`app.datadoghq.eu`	EU1 (datadoghq.eu)
`ap1.datadoghq.com`	AP1 (ap1.datadoghq.com)
`ap2.datadoghq.com`	AP2 (ap2.datadoghq.com)

Create an API key

In Datadog, go to Organization Settings → API Keys, click New Key, name it cloudthinker, and copy the value.

Create a scoped application key

Recommended: create the key on a Datadog service account with the Datadog Read Only Role, so it isn’t tied to a person’s permissions. Go to Organization Settings → Service Accounts, create cloudthinker with that role, and add an application key on it.Otherwise, go to Organization Settings → Application Keys and click New Key.Either way, name the key cloudthinker and select the scopes in Required permissions. Save and copy the key right away.

An application key with no scopes inherits every permission of its owner, including writes. Always pick scopes.

Success state: the key’s scope list shows only read permissions, with no _write entries.

Add the connection

Open More → Workspace settings → Connections, stay on the Builtin Connections tab, and select Datadog. Fill in:

Alias (optional): a short name such as datadog-prod. Lowercase letters, numbers, and hyphens.
Description (optional): which org or environment this is. Agents read it to pick the right instance.
DD_API_KEY: the API key.
DD_APPLICATION_KEY: the application key.
DD_SITE: your site from step 1.

Click Connect. CloudThinker shows Connecting and Verifying, then a Connected status. Verifying opens a session with the Datadog MCP server for your site and lists its tools. It doesn’t run a data query, so a missing scope shows up later as a 403 on that kind of question. If verification fails, it shows Failed and an error message appears. Match the message to Troubleshooting.

Connection details

Field	Description	Example
DD_API_KEY	Datadog API key for your organization
DD_APPLICATION_KEY	Scoped Datadog application key. Its scopes decide what CloudThinker can read
DD_SITE	Datadog site of your organization. Defaults to US1	`EU1 (datadoghq.eu)`

You need both keys. CloudThinker sends them to the Datadog MCP server for your site on every call.

Required permissions

The Datadog MCP server checks Datadog’s own permissions on every call. Pick the rows for the data you want CloudThinker to see.

Scope ID	Name in Datadog	What it unlocks
`mcp_read`	`mcp_read`	Any use of the Datadog MCP server. Required
`monitors_read`	Monitors Read	Monitor search and alert triage
`logs_read_data`, `logs_read_index_data`	Logs Read Data, Logs Read Index Data	Log search
`timeseries_query`	Timeseries	Log analytics, host metrics, events
`metrics_read`	Metrics	Metric search and queries
`hosts_read`	Hosts Read	Host inventory
`incident_read`	Incidents Read	Datadog incidents
`dashboards_read`, `user_access_read`	Dashboards Read, User Access Read	Dashboard search
`apm_read`	APM Read	Spans and traces
`events_read`	Events	Event search
`notebooks_read`	Notebooks Read	Notebook search

Leave out mcp_write and every _write scope. CloudThinker’s Datadog investigations only read.

Agent capabilities

Capability	What CloudThinker does
Discovery	Summarizes monitors by state (OK, Alert, Warn, No Data), hosts, active incidents, dashboards, and services
Monitors	Finds monitors by state, name, or tag and explains what’s alerting
Logs	Searches and groups logs in Datadog query syntax, such as `service:web status:error`, starting at the last 15 minutes
Metrics	Finds metrics and queries them with an aggregation, such as `avg:system.cpu.user{host:web-1}`
Traces	Searches spans by service and duration, then opens the full trace
Incidents	Lists Datadog incidents and reads their detail
Infrastructure	Lists hosts with their apps, mute status, and key system metrics
Services	Lists catalog services and maps their dependencies
Dashboards, events, notebooks	Searches and reads them for context

When the connection first reaches Connected, CloudThinker runs a read-only discovery and saves what it finds for later chats.

Verify the connection

Run Datadog discovery and list monitors by state, the number of hosts, and any active incidents

A healthy answer counts monitors in OK, Alert, Warn, and No Data, and names the alerting ones.

Example prompts

Which Datadog monitors are alerting right now, and what do the error logs for those services show in the last 15 minutes?
Find the slowest checkout spans in the last hour and walk me through one trace
Which hosts have the highest CPU right now, and do any have muted monitors?

Send Datadog alerts to Resolve

Resolve ships a Datadog preset, so Resolve → Triggers & Outcomes pre-fills the field and severity mapping for you. Webhook Signals explains the dialog in full; the steps below are the Datadog specifics. For a tool with no preset, see Connect alert sources.

Create the webhook in CloudThinker

Go to Resolve → Triggers & Outcomes, select Datadog, and under Signals to Resolve click Add signal. Step through Basic Info, Configure, and Advanced, then click Create. Copy the Webhook URL and the Secret Key — the key is shown only once.

Point the mapping at a service

The preset reads title, body, and alert_type, but its Service Path defaults to tags, which points at a list and maps to nothing. Under Field Mapping, change Service Path to service, then send that key in the payload below. See Map the fields.

Add the severity rows your monitors send

The preset’s Severity Mapping covers alert, warn, ok, and no data, while Datadog’s $ALERT_TYPE sends error, warning, info, or success. Under Severity Mapping, click Customize, then Add Mapping for each value your monitors send. An unmapped value lands on medium.

Add the webhook in Datadog

In Datadog, open Integrations → Webhooks and add a webhook named CloudThinker. Paste the Webhook URL into URL, and put this in the Custom Headers box: {"Authorization": "Bearer <your-secret-key>"}. Use a payload like this:

{
  "title": "$EVENT_TITLE",
  "body": "$EVENT_MSG",
  "alert_type": "$ALERT_TYPE",
  "service": "web-api"
}

A fixed service value applies to every monitor that notifies this webhook. The secret is stored in Datadog’s webhook configuration, so anyone who can manage that integration can read it. Limit that access, and use Regenerate credentials on the webhook row in Resolve if it leaks.

Notify the webhook from your monitors

Add @webhook-CloudThinker to the message of each monitor that should open incidents. To send alerts but not recoveries, wrap the mention in Datadog’s alert condition:

{{#is_alert}}@webhook-CloudThinker{{/is_alert}}

Send one test event

Click Test Notifications on a monitor, or use the cURL tab under Integration Examples in the webhook dialog.

Success state: the next alert from that monitor shows up in Pulse, the alert feed in Resolve, with your monitor’s title, and agents investigate it through this connection.

Troubleshooting

401 or 403 at Verifying or on every call

DD_SITE doesn’t match your organization. Datadog keys only work on their own site, so compare it with your Datadog URL using the table in step 1, then edit the connection.
One of the keys is wrong, revoked, or from a different Datadog organization. Create fresh keys in the same organization and update the connection from its detail panel.
MCP Access is off for your organization, or the application key lacks mcp_read.

403 Forbidden on some questions but not others

The application key is missing the scope for that data, for example apm_read for traces. Add the scope in Organization Settings → Application Keys.

A metric or service isn't found

CloudThinker searches for metric and service names before querying. Ask it to list metrics matching a name, then use the exact name it returns.

429 Too Many Requests

Datadog is rate limiting the keys. Ask narrower questions with shorter time windows, or retry after a minute.

Security

Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

Scope the application key: an unscoped key carries its creator’s full permissions, including writes.
Dedicated keys: create keys only for CloudThinker so you can revoke them without touching other integrations.

Webhook Signals

Map an alert’s fields and choose when CloudThinker investigates

PagerDuty Connection

Send PagerDuty incidents to Resolve

Connections

Customize

Approvals

Workspace settings

Admin Settings

Artifacts and sharing

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Send Datadog alerts to Resolve

Troubleshooting

Security

Webhook Signals

PagerDuty Connection

​Prerequisites

​Setup

​Connection details

​Required permissions

​Agent capabilities

​Verify the connection

​Example prompts

​Send Datadog alerts to Resolve

​Troubleshooting

​Security

​Related

Webhook Signals

PagerDuty Connection

Prerequisites

Setup

Connection details

Required permissions

Agent capabilities

Verify the connection

Example prompts

Send Datadog alerts to Resolve

Troubleshooting

Security

Related