Datadog (kud) MCP Server
@kud/mcp-datadog
npm
v0.2.0
Published by @kud — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
Datadog server covering monitoring, metrics, logs, and dashboards.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 8 = 92. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 1
high Sensitive-source and external-sink co-existMTC-FLOW-004
Tools that read sensitive data ([datadog_get_usage_logs, datadog_get_logs_archive, datadog_get_logs_pipeline, datadog_get_logs_index, datadog_get_logs_metric]) and tools that can send data out ([datadog_create_webhook, datadog_get_webhook, datadog_update_webhook, datadog_delete_webhook]) are exposed together. An agent can move private data to the sink.
Evidence: sources [datadog_get_usage_logs, datadog_get_logs_archive, datadog_get_logs_pipeline, datadog_get_logs_index, datadog_get_logs_metric] → sinks [datadog_create_w
Fix: Keep secret-reading and egress capabilities on separate, separately-approved servers.
Location: flow datadog_get_usage_logs → datadog_create_webhook
Tools 175
Each tool and what it can reach — statically extracted from the published source.
datadog_create_webhooknetwork egressdatadog_delete_webhooknetwork egressdatadog_get_logs_archivereads sensitive datadatadog_get_logs_indexreads sensitive datadatadog_get_logs_metricreads sensitive datadatadog_get_logs_pipelinereads sensitive datadatadog_get_usage_logsreads sensitive datadatadog_get_webhooknetwork egressdatadog_update_webhooknetwork egressdatadog_add_permission_to_roleno sensitive capability
Show 165 more tools ↓
datadog_aggregate_logsno sensitive capabilitydatadog_aggregate_rum_eventsno sensitive capabilitydatadog_aggregate_spansno sensitive capabilitydatadog_cancel_downtimeno sensitive capabilitydatadog_create_api_keyno sensitive capabilitydatadog_create_apm_retention_filterno sensitive capabilitydatadog_create_aws_accountno sensitive capabilitydatadog_create_azure_integrationno sensitive capabilitydatadog_create_dashboardno sensitive capabilitydatadog_create_dashboard_listno sensitive capabilitydatadog_create_downtimeno sensitive capabilitydatadog_create_eventno sensitive capabilitydatadog_create_gcp_integrationno sensitive capabilitydatadog_create_host_tagsno sensitive capabilitydatadog_create_incidentno sensitive capabilitydatadog_create_incident_serviceno sensitive capabilitydatadog_create_incident_teamno sensitive capabilitydatadog_create_logs_archiveno sensitive capabilitydatadog_create_logs_metricno sensitive capabilitydatadog_create_logs_pipelineno sensitive capabilitydatadog_create_monitorno sensitive capabilitydatadog_create_notebookno sensitive capabilitydatadog_create_or_update_service_definitionno sensitive capabilitydatadog_create_roleno sensitive capabilitydatadog_create_rum_applicationno sensitive capabilitydatadog_create_security_ruleno sensitive capabilitydatadog_create_slono sensitive capabilitydatadog_create_synthetic_testno sensitive capabilitydatadog_create_teamno sensitive capabilitydatadog_create_userno sensitive capabilitydatadog_delete_api_keyno sensitive capabilitydatadog_delete_apm_retention_filterno sensitive capabilitydatadog_delete_application_keyno sensitive capabilitydatadog_delete_aws_accountno sensitive capabilitydatadog_delete_azure_integrationno sensitive capabilitydatadog_delete_dashboardno sensitive capabilitydatadog_delete_dashboard_listno sensitive capabilitydatadog_delete_gcp_integrationno sensitive capabilitydatadog_delete_host_tagsno sensitive capabilitydatadog_delete_incidentno sensitive capabilitydatadog_delete_incident_serviceno sensitive capabilitydatadog_delete_incident_teamno sensitive capabilitydatadog_delete_logs_archiveno sensitive capabilitydatadog_delete_logs_metricno sensitive capabilitydatadog_delete_logs_pipelineno sensitive capabilitydatadog_delete_monitorno sensitive capabilitydatadog_delete_notebookno sensitive capabilitydatadog_delete_roleno sensitive capabilitydatadog_delete_rum_applicationno sensitive capabilitydatadog_delete_security_ruleno sensitive capabilitydatadog_delete_service_definitionno sensitive capabilitydatadog_delete_slono sensitive capabilitydatadog_delete_synthetic_testsno sensitive capabilitydatadog_delete_teamno sensitive capabilitydatadog_disable_userno sensitive capabilitydatadog_enable_aws_log_servicesno sensitive capabilitydatadog_get_api_keyno sensitive capabilitydatadog_get_apm_retention_filterno sensitive capabilitydatadog_get_application_keyno sensitive capabilitydatadog_get_dashboardno sensitive capabilitydatadog_get_dashboard_listno sensitive capabilitydatadog_get_downtimeno sensitive capabilitydatadog_get_eventno sensitive capabilitydatadog_get_host_tagsno sensitive capabilitydatadog_get_host_totalsno sensitive capabilitydatadog_get_incidentno sensitive capabilitydatadog_get_incident_serviceno sensitive capabilitydatadog_get_incident_teamno sensitive capabilitydatadog_get_metric_metadatano sensitive capabilitydatadog_get_monitorno sensitive capabilitydatadog_get_notebookno sensitive capabilitydatadog_get_organizationno sensitive capabilitydatadog_get_roleno sensitive capabilitydatadog_get_rum_applicationno sensitive capabilitydatadog_get_security_ruleno sensitive capabilitydatadog_get_serviceno sensitive capabilitydatadog_get_slono sensitive capabilitydatadog_get_slo_historyno sensitive capabilitydatadog_get_synthetic_testno sensitive capabilitydatadog_get_synthetic_test_resultsno sensitive capabilitydatadog_get_teamno sensitive capabilitydatadog_get_usage_hostsno sensitive capabilitydatadog_get_usage_summaryno sensitive capabilitydatadog_get_usage_timeseriesno sensitive capabilitydatadog_get_usage_top_avg_metricsno sensitive capabilitydatadog_get_userno sensitive capabilitydatadog_list_active_metricsno sensitive capabilitydatadog_list_api_keysno sensitive capabilitydatadog_list_apm_retention_filtersno sensitive capabilitydatadog_list_application_keysno sensitive capabilitydatadog_list_aws_accountsno sensitive capabilitydatadog_list_aws_log_servicesno sensitive capabilitydatadog_list_azure_integrationsno sensitive capabilitydatadog_list_dashboard_listsno sensitive capabilitydatadog_list_dashboardsno sensitive capabilitydatadog_list_downtimesno sensitive capabilitydatadog_list_eventsno sensitive capabilitydatadog_list_gcp_integrationsno sensitive capabilitydatadog_list_host_tagsno sensitive capabilitydatadog_list_hostsno sensitive capabilitydatadog_list_incident_servicesno sensitive capabilitydatadog_list_incident_teamsno sensitive capabilitydatadog_list_incidentsno sensitive capabilitydatadog_list_logsno sensitive capabilitydatadog_list_logs_archivesno sensitive capabilitydatadog_list_logs_indexesno sensitive capabilitydatadog_list_logs_metricsno sensitive capabilitydatadog_list_logs_pipelinesno sensitive capabilitydatadog_list_monitorsno sensitive capabilitydatadog_list_notebooksno sensitive capabilitydatadog_list_organizationsno sensitive capabilitydatadog_list_role_permissionsno sensitive capabilitydatadog_list_role_usersno sensitive capabilitydatadog_list_rolesno sensitive capabilitydatadog_list_rum_applicationsno sensitive capabilitydatadog_list_security_rulesno sensitive capabilitydatadog_list_security_signalsno sensitive capabilitydatadog_list_servicesno sensitive capabilitydatadog_list_slosno sensitive capabilitydatadog_list_spansno sensitive capabilitydatadog_list_spans_advancedno sensitive capabilitydatadog_list_synthetic_locationsno sensitive capabilitydatadog_list_synthetic_testsno sensitive capabilitydatadog_list_teamsno sensitive capabilitydatadog_list_usersno sensitive capabilitydatadog_mute_hostno sensitive capabilitydatadog_query_metricsno sensitive capabilitydatadog_remove_permission_from_roleno sensitive capabilitydatadog_search_incidentsno sensitive capabilitydatadog_search_monitorsno sensitive capabilitydatadog_search_rum_eventsno sensitive capabilitydatadog_search_slono sensitive capabilitydatadog_submit_metricsno sensitive capabilitydatadog_submit_service_checkno sensitive capabilitydatadog_trigger_synthetic_testsno sensitive capabilitydatadog_unmute_hostno sensitive capabilitydatadog_update_api_keyno sensitive capabilitydatadog_update_apm_retention_filterno sensitive capabilitydatadog_update_application_keyno sensitive capabilitydatadog_update_azure_host_filtersno sensitive capabilitydatadog_update_azure_integrationno sensitive capabilitydatadog_update_dashboardno sensitive capabilitydatadog_update_dashboard_listno sensitive capabilitydatadog_update_downtimeno sensitive capabilitydatadog_update_gcp_integrationno sensitive capabilitydatadog_update_host_tagsno sensitive capabilitydatadog_update_incidentno sensitive capabilitydatadog_update_incident_serviceno sensitive capabilitydatadog_update_incident_teamno sensitive capabilitydatadog_update_logs_archiveno sensitive capabilitydatadog_update_logs_indexno sensitive capabilitydatadog_update_logs_metricno sensitive capabilitydatadog_update_logs_pipelineno sensitive capabilitydatadog_update_metric_metadatano sensitive capabilitydatadog_update_monitorno sensitive capabilitydatadog_update_notebookno sensitive capabilitydatadog_update_organizationno sensitive capabilitydatadog_update_roleno sensitive capabilitydatadog_update_rum_applicationno sensitive capabilitydatadog_update_security_ruleno sensitive capabilitydatadog_update_slono sensitive capabilitydatadog_update_synthetic_testno sensitive capabilitydatadog_update_teamno sensitive capabilitydatadog_update_userno sensitive capabilitydatadog_validate_monitorno sensitive capability
Toxic flows 1
Cross-tool combinations that form a data-exfiltration primitive (untrusted input → sensitive source → external sink).
What this scan could not see
- Tools were statically extracted from the published source (175 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.2.0 latest |
A 92/100 | 1 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @kud/mcp-datadog --onlineOther implementations of Datadog 12
Independent packages implementing the same tool, scanned with the same engine. Compare all 13 side by side →
MCP server for interacting with Datadog API
MCP server for Datadog API - monitors, logs, metrics, traces, dashboards and more
Datadog MCP server - 165 tools for metrics, monitors, logs, APM, RUM, incidents, CI/CD, status pages, fleet automation, and more
MCP Server for Datadog API
MCP-native server for Datadog API with tools, resources, prompts, and schema-based generation
Datadog MCP Server for monitoring and observability data
More in Cloud & DevOps
Operator control CLI for AdGuard Home with an MCP adapter
interacting with Aliyun (Alibaba Cloud) services through This MCP server provides tools.
MCP server for the Aspro.Cloud REST API
MCP server for Atlassian Confluence and Jira Cloud APIs
AuroraCloud-first MCP server that exposes AuroraDocs workspace data to Claude Desktop and other AI agents
The official AWS Knowledge Base retrieval server using Bedrock Agent Runtime.