SoftTech AI Registry
Datadog · Datadog MCP Server

Workflow management and execution tools

The Datadog MCP Server workflows toolset, through which an external AI application can find, inspect, create, update, validate, publish, unpublish, permanently delete, run and cancel Datadog Workflow Automation workflows, and inspect their executions. Reasoning happens in the external AI application; Datadog performs the authorised operation.

Recorded characteristics

Function
Reasoning boundary: user → external AI application and model → the AI reasons and selects a Datadog MCP tool → the Datadog MCP Server receives the tool name and arguments → Datadog performs the authorised operation. Datadog states the MCP Server does not receive the user's prompt or the model's reasoning; the MCP Server is not the reasoning agent. Boundary: the `workflows` toolset only, covering workflow objects, the Action Catalog, the workflow schema and workflow execution data. The toolset must be explicitly requested (e.g. `toolsets=workflows`); it is not enabled by default for external AI applications. Other Datadog MCP toolsets are excluded. Tool inventory (17, Datadog naming): - Finding: list_datadog_workflows, get_datadog_workflow - Schema/actions: get_datadog_workflow_spec_schema, search_datadog_workflow_actions, get_datadog_workflow_action - Management: create_datadog_workflow, update_datadog_workflow, publish_datadog_workflow, unpublish_datadog_workflow, delete_datadog_workflow, validate_datadog_workflow - Execution/history: execute_datadog_workflow, get_datadog_workflow_instance, list_datadog_workflow_instances, cancel_datadog_workflow_instance, get_datadog_workflow_step_data Create: create_datadog_workflow creates an unpublished workflow from a complete specification supplied by the AI application (triggers, steps, connections). Requires Workflows Write. Creation does not publish. Update: supplied specification values and tag lists replace existing values; omitted fields remain unchanged; specification changes are saved as drafts (a persistent change before publication). Requires Workflows Write. Publish: makes the saved draft (or unpublished base) the live version, replacing the previous live version. Requires Workflows Write. A persistent operational configuration change. Unpublish: stops new automatic executions while preserving the base specification and any saved draft. Not documented to cancel executions already underway. Delete: delete_datadog_workflow permanently deletes a workflow. Requires Workflows Write, explicit user confirmation and `confirm: true`. No restore mechanism established. Execute: execute_datadog_workflow starts a new execution of a workflow with an agent trigger, with inputs supplied by the caller. Per the tool entry, it runs the saved draft when one exists, otherwise the base specification. Requires Workflows Run. Cancel: cancel_datadog_workflow_instance cancels a running execution; a cancelled execution cannot be resumed. Requires Workflows Run.
Data access
Read access through the toolset covers workflow definitions, Action Catalog entries, the workflow specification schema, execution instances and step-level execution data (inputs/outputs). Execution history (list_datadog_workflow_instances, get_datadog_workflow_instance, get_datadog_workflow_step_data) is workflow execution information and is separate from MCP-call auditing. External-action treatment (yes), two distinct effects: A. MCP management operations: external AI → Datadog MCP Server → Datadog workflow object changes. These effects remain inside Datadog. B. Workflow execution: external AI → execute_datadog_workflow → Datadog Workflow Automation runs the configured workflow → a workflow action may affect an external system. Datadog documents workflow use cases with external effects such as sending findings to Slack, paging on-call teams and invoking AWS Lambda functions. MCP outbound-call distinction: Datadog states the MCP Server itself makes no outbound calls to external domains. This does not contradict external = yes. Layers: the MCP Server authorises and invokes the Datadog workflow operation; Workflow Automation executes the workflow; the configured workflow action may act on the external system; the stored connection and the workflow's Run-as identity supply downstream authority. The MCP Server does not call Slack directly, and the AI application's Datadog identity does not supply Slack authority.
Actions
Can take actions
External actions
Yes
Human confirmation
Conditional
Permission basis
Mixed
Administrative control
Authentication: OAuth 2.0 (recommended); Personal Access Token or Service Access Token as a bearer Authorization header; Datadog API plus application keys (DD_API_KEY / DD_APPLICATION_KEY headers), with a service account recommended by Datadog for key-based and automated use. For key-based workflow access, the application key needs Actions API access, which is not enabled by default. MCP permissions (separate from resource permissions): mcp_read / mcp_write, plus resource-specific Workflow Automation permissions — Workflows Read (find, inspect, validate, executions), Workflows Write (create, update, publish, unpublish, delete), Workflows Run (execute, cancel). Datadog checks permissions on each tool call. Permission basis (mixed): multiple positively established authority models, not uncertainty — (A) user-associated authority: OAuth / personal credentials use the existing Datadog user's permissions, and the server cannot grant access beyond what that user has; (B) service-account authority: Service Access Tokens and service-account keys. Two authority layers (kept separate): LAYER 1 — MCP caller: determines whether the AI application may read, write/manage, or run/cancel workflows. LAYER 2 — Workflow execution: once a workflow runs, its Run-as identity (Owner, Initiator or Service Account) determines execution authority and resolves the workflow's configured connections (connections_resolve and connection Resolver access). A workflow running as its Owner may resolve connections that the triggering user cannot access themselves — a documented separation of trigger authority and execution authority. Human confirmation (conditional, by operation): for permanent deletion, Datadog requires explicit user confirmation and `confirm: true`. No equivalent Datadog-enforced confirmation is established for create, update, publish, unpublish, execute or cancel. Client-side approval in Claude Code, Cursor, Codex, Copilot, Gemini or other MCP clients is separate and is not counted. Tool-exposure controls (separate from Datadog permissions): the workflows toolset must be requested; omit_tools removes individual tools, so delete_datadog_workflow can be omitted; organisation settings govern MCP access and write capability; custom roles may omit mcp_write; IP allowlist support. Destructive-operation controls (delete): Workflows Write required; permanent; explicit confirmation requirement; confirm: true; excludable with omit_tools; no restore established. Audit: Datadog states all MCP tool calls are recorded in Datadog Audit Trail with metadata identifying them as MCP actions, including the tool name, arguments, user identity and the MCP client used. Telemetry metrics datadog.mcp.tool.usage and datadog.mcp.session.starts are also emitted (metrics are not Audit Trail records).
Default state
Conditional
Availability
Default conditional: requires Datadog MCP Server setup, an external MCP-capable AI application, supported authentication, the workflows toolset requested, applicable mcp_read/mcp_write permissions, applicable Workflows Read/Write/Run permissions, and Actions API access for key-based configurations. The toolset is not available for unrestricted write/run use by default. Lifecycle: active. Datadog lists the workflows toolset among generally available toolsets (Cases, APM and others are Preview). Datadog warns that MCP tools are under significant development and subject to change; this is recorded as a caution, not Preview status. Launched for Workflow Automation on 3 September 2026. Site restrictions: the Datadog MCP Server is not supported on app.ddog-gov.com or us2.ddog-gov.com. Separately, the ChatGPT client app is Preview and US1 only; that limitation applies to ChatGPT only. Client compatibility (not lifecycle evidence): Datadog documents ChatGPT (Preview, US1 only), Cursor, Claude Code, Claude, Codex CLI, Copilot CLI, Gemini CLI, Grok Build, Warp, VS Code, JetBrains, Kiro, Goose, OpenCode and Cline.
Licensing
Requires a Datadog organisation with Workflow Automation; no separate MCP-specific licence for the workflows toolset was established.
External model or provider
No fixed model or provider. The connected external AI application supplies the reasoning model. Supported clients are compatibility evidence only; Datadog is not classified as using OpenAI, Anthropic, Google or any other provider because those clients can connect.
Limitations and uncertainty
- No complete end-to-end external workflow run is demonstrated in the investigated evidence; external = yes rests on the documented execution mechanism, tool capability and documented external workflow actions/use cases. - Saved-draft execution semantics: the execute tool entry says the saved draft runs when one exists, while the Workflow Automation MCP Tools overview refers to running published workflows; the exact behaviour remains ambiguous. - Datadog requires deletion confirmation and confirm: true, but the evidence does not establish how each external AI client proves that a real person supplied the confirmation; Datadog is not claimed to verify a physical user action. - The precise external-effect chain in a demonstrated run is not documented. - Service-account authentication versus Datadog's wording that workflow MCP tools use "the user's existing Datadog permissions". - The interaction between MCP-caller authority and workflow Run-as authority in agent-triggered runs. - No deletion restore mechanism established. - Which Run-as identity applies to runs started through execute_datadog_workflow is not specifically documented. - Datadog's warning that MCP tools are under significant development and subject to change. - No Datadog-enforced confirmation established for publish, execute or other non-delete operations.

Evidence