Sign in

Datadog

3 reviewed Dtwo policies for Datadog MCP servers — egress + ingress controls for governing what AI agents can do with Datadog.

On this page
  1. Available policies
  2. Tool naming on the DTwo gateway
  3. Identity claims
  4. Contributing
  5. Ingress policies (2)
  6. Egress policies (1)

Reusable DTwo policies for Datadog's official hosted MCP server, which gives agents structured access to logs, APM spans and traces, metrics, events, RUM, monitors, incidents, dashboards, and notebooks. Most of its tools are reads, and Datadog ships MCP Write Access switched off by default, so the main risks are what the agent reads and how far back it looks (a single broad search can reach months of logs full of personal data and credentials) and, once write access is on, changes to the monitors and dashboards your on-call team depends on.

Available policies

Policy Direction Purpose Framework bundles
read-only-except-notebooks ingress Datadog is read-only for the agent, except it can create and edit notebooks to write up an investigation. Dashboard, monitor, and every other write is blocked. engineering-stack-jira, engineering-stack-linear
cap-search-window ingress Caps log, span, RUM, and event searches at a 7-day lookback window. Transform-only — searches still run, just over a bounded period. engineering-stack-jira, engineering-stack-linear
redact-secrets-egress egress Masks credentials (API keys, tokens, JWTs, private keys) and email addresses in every Datadog response before it reaches the agent. Transform-only. engineering-stack-jira, engineering-stack-linear

Tool naming on the DTwo gateway

DTwo prefixes tool names with the MCP server name configured on the gateway. A Datadog server registered as datadog surfaces tools like datadog-search_datadog_logs (some clients show datadog-search-datadog-logs). These policies scope on the datadog prefix and accept either _ or - separators. If your server is registered under another name, update the prefix check in each policy, and confirm the exact names your gateway sends with the dump-input debug technique before deploying.

Identity claims

None of these policies read IdP claims.

Contributing

To add a Datadog policy:

  1. Create apps/datadog/<policy-slug>/ with policy.md and a tests.yaml test file.
  2. Add a row to the table above.
  3. Declare apps: ["datadog"] in the policy frontmatter, plus any industry / bundle slugs that apply.
  4. If the policy fits a bundle, link to it from the matching landing page.
  5. Run pnpm manifest from the repo root.

See CONTRIBUTING.md for the full process.

Ingress policies (2)

Cap the Time Window of Datadog Searchesingress · DatadogKeeps Datadog searches to a recent window. The agent can search logs, spans, RUM, and events as much as it likes, but each call looks back at most 7 days .Datadog Read-Only Except Notebooksingress · DatadogKeeps Datadog read-only for the agent, with one exception: it can create and edit notebooks.

Egress policies (1)

Datadog: Redact Secrets and Emails from Responsesegress · DatadogLogs are where secrets actually leak: a debug line that prints a request header, a stack trace with a connection string, a config dump at startup.

↑↓ to navigate ↵ to open

Get in touch

Tell us what you need to govern.

A few lines is plenty — what you're deploying, and what you need control over. We read every one.