> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vantage.sh/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog MCP

> Connect the Datadog MCP to the Vantage FinOps Agent to join live Datadog telemetry with your Vantage cost data in a single conversation.

The Datadog MCP Connector links the [Vantage FinOps Agent](/vantage_finops_agent) to your Datadog organizations through Datadog's [MCP server](https://docs.datadoghq.com/mcp_server/). Once connected, the Agent can pull live Datadog telemetry, like metrics, logs, monitors, dashboards, APM, events, and more, and reason over it alongside the Vantage cost, allocation, anomaly, and recommendation data it already understands.

<Note>
  The Datadog MCP Connector is the first of several [MCP Connectors](/vantage_finops_agent#mcp-connectors) for the FinOps Agent. It is available to all Vantage customers using the FinOps Agent, in the [Vantage console](https://console.vantage.sh/agent), Slack, and [Canvas](/canvas).
</Note>

## Prerequisites

Before you start, make sure you have:

* The [FinOps Agent](/vantage_finops_agent) enabled in Vantage. The Datadog MCP settings page prompts you to enable it first if it is not already on.
* A Vantage role that can manage integrations, such as **Organization Owner** or **Integration Owner**. See [Role-Based Access Control](/rbac) for details. Once the connector is configured, all Vantage users in your organization can use it through the Agent.
* A Datadog user who is an [Admin](https://docs.datadoghq.com/account_management/rbac/?tab=datadogapplication#datadog-default-roles) able to authorize the required OAuth scopes, including the [`mcp_read`](https://docs.datadoghq.com/account_management/rbac/permissions/#mcp) permission, plus the standard Datadog permissions for the underlying resources the Agent will query.

<Info>
  Usage is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). The Datadog MCP Connector is read-only. The FinOps Agent can retrieve data from Datadog but cannot create, modify, or delete any Datadog resources.
</Info>

## Permissions and Data Access

The Datadog MCP Connector reuses the same Datadog OAuth application as the [Datadog cost integration](/connecting_datadog).

| Scope                                                            | Why Vantage needs it                                                        |
| ---------------------------------------------------------------- | --------------------------------------------------------------------------- |
| `billing_read`, `usage_read`                                     | Read billing and usage metering data (shared with the cost integration).    |
| `metrics_read`, `timeseries_query`                               | Query metrics and time-series data such as CPU, memory, and request counts. |
| `logs_read_data`, `logs_read_index_data`, `logs_read_workspaces` | Read log data and log indexes for investigations.                           |
| `monitors_read`                                                  | Read monitor definitions and status.                                        |
| `apm_read`                                                       | Read APM (application performance) data.                                    |
| `dashboards_read`                                                | Read dashboard definitions.                                                 |
| `mcp_read`                                                       | Authorize access to the Datadog MCP server.                                 |
| `incident_read`                                                  | Read incident data.                                                         |
| `events_read`                                                    | Read events such as deployments and resource changes.                       |
| `llm_observability_read`                                         | Read LLM Observability data.                                                |

Vantage stores only the data that is explicitly written into your FinOps Agent conversation responses; no ancillary Datadog data is collected or stored outside of your conversation, and data retrieved through the connector is not used to train any models.

<Note>
  Data retrieved through the Datadog MCP is read-only and scoped to your conversation. Datadog API usage generated by FinOps Agent queries counts against your Datadog plan limits. Refer to your Datadog agreement for details.
</Note>

## Connect the Datadog MCP

<Steps>
  <Step title="Open the MCP Connectors section">
    From the top navigation in Vantage, click **Settings**. On the left navigation, select **Integrations**, then find the **MCP Connectors** section and select **Datadog MCP**.

    <Info>
      If the page shows a banner asking you to enable the FinOps Agent, open the [FinOps Agent settings page](https://console.vantage.sh/settings/finops_agent) and enable it first, then return to the Datadog MCP page.
    </Info>
  </Step>

  <Step title="Connect Datadog">
    On the **Datadog MCP** page, click **Connect Datadog**. Vantage redirects you to Datadog to complete the OAuth flow.
  </Step>

  <Step title="Authorize the scopes in Datadog">
    Sign in to Datadog as an Admin and authorize the requested scopes (see [Permissions and Data Access](#permissions-and-data-access)). After you approve, Datadog redirects you back to Vantage and the connection status changes to connected.
  </Step>

  <Step title="Confirm the connection">
    Back in Vantage, confirm the Datadog MCP shows as connected. You can now ask the FinOps Agent Datadog-aware questions in the console or in Slack.

    <Frame>
      <video autoPlay muted loop playsInline className="w-full aspect-video rounded-xl" src="https://assets.vantage.sh/blog/agent-mcp-connectors/agent-mcp-connectors.mp4" />
    </Frame>
  </Step>
</Steps>

<Note>
  If you previously connected Datadog only for cost ingestion, your existing connection may not include the extended agent scopes. In that case the Datadog MCP page prompts you to reconnect to grant the additional scopes (such as `mcp_read`). Reconnect from the **Datadog MCP** page rather than the standard [Datadog cost integration](/connecting_datadog) page.
</Note>

<Info>
  You can connect multiple Datadog organizations, based on the organizations the connecting user has access to. After authorizing your first organization, add more by returning to the **Datadog MCP** page and using the **Datadog organization** dropdown at the top to select another organization. When you select a newly added organization, Vantage prompts you to reconnect to grant the [required scopes](#permissions-and-data-access).
</Info>

## Example Use Cases

Once the Datadog MCP is connected, the FinOps Agent decides when to reach for Datadog tools based on the question you ask. It can call Datadog tools in the same turn it uses Vantage tools, combining cost data with live telemetry. The examples below come from real FinOps Agent conversations.

<Tip>
  For prompting best practices and more copy-paste examples, see the [FinOps AI Prompt Guide](/finops_ai_prompt_guide).
</Tip>

### Correlate Deployments with a Cost Increase

Ask the Agent to connect a cost spike to infrastructure activity. It loads the anomaly investigation skill, pulls Vantage cost anomalies, retrieves Datadog deployment and resource-change events, and correlates them on a timeline.

<Prompt description="Did any recent deployments cause my AWS costs to increase?" actions={["copy"]}>
  Did any recent deployments cause my AWS costs to increase?
</Prompt>

In this flow, the Agent runs a multi-step investigation across both Vantage and Datadog:

<Steps>
  <Step title="Gets account context">
    The Agent loads the anomaly investigation skill and identifies your default workspace using Vantage tools.
  </Step>

  <Step title="Pulls anomalies and events in parallel">
    It lists active Vantage cost anomalies and, at the same time, retrieves recent deployment and resource-change events from Datadog.
  </Step>

  <Step title="Correlates the timeline">
    It queries daily costs around the spike and aggregates Datadog events by day to line up cost increases with deployment activity.
  </Step>

  <Step title="Synthesizes the findings">
    It returns a structured summary tying specific anomalies (for example, EBS and EC2 increases) to a surge in resource-change events on the same dates.
  </Step>
</Steps>

<CodeGroup>
  ```md Example response expandable theme={null}
  AWS Cost Increase & Deployment Correlation Analysis

  Yes, there is a strong correlation between recent deployments and your AWS cost
  increases. Starting around May 27-28, a surge in infrastructure resource changes
  coincided with cost spikes across multiple AWS services.

  Cost anomalies detected (deduplicated):

  | Service     | Category               | Current Daily | 7-Day Avg | Increase |
  |-------------|------------------------|---------------|-----------|----------|
  | AmazonEC2   | Compute Instance       | $8,420        | $5,890    | +43%     |
  | EBS         | Storage                | $2,310        | $1,095    | +111%    |
  | EBS         | Provisioned Throughput | $1,240        | $325      | +282%    |
  | CloudWatch  | API Request            | $410          | $299      | +37%     |
  | AmazonS3    | Other                  | $560          | $386      | +45%     |

  Deployment activity (from Datadog) — resource changes by day:

  | Date   | Resource Changes | Notable          |
  |--------|------------------|------------------|
  | May 25 | 2                | Baseline         |
  | May 27 | 1,219            | Large spike      |
  | May 29 | 6,716            | Peak activity    |
  | May 30 | 3,954            | Sustained high   |

  Root cause: Kubernetes workload scaling in the temporal-etl namespace drove the
  EBS and EC2 anomalies, with new ECS task definitions deployed for production-core.
  The spike peaked May 29-30 and has been gradually declining.
  ```
</CodeGroup>

### Validate Rightsizing with Utilization Data

Ask the Agent to find expensive, underutilized resources. It pulls Vantage rightsizing recommendations and cost data, then cross-references Datadog CPU and memory utilization to confirm which instances are oversized.

<Prompt description="Which EC2 instances have the highest cost but lowest utilization?" actions={["copy"]}>
  Which EC2 instances have the highest cost but lowest utilization?
</Prompt>

<CodeGroup>
  ```md Example response expandable theme={null}
  EC2 Instances: High Cost, Low Utilization

  Combining Vantage rightsizing recommendations with Datadog utilization:

  | Instance              | Current Type        | Max CPU % | State    | Savings/mo | Recommended  |
  |-----------------------|---------------------|-----------|----------|------------|--------------|
  | i-0aaaa1111bbbb2222   | c5.xlarge (4 vCPU)  | 3.15%     | Running  | $412.00    | t3.large     |
  | i-0cccc3333dddd4444   | c5.large (2 vCPU)   | 11.09%    | Stopped  | $388.00    | t3.medium    |
  | i-0eeee5555ffff6666   | t3.large (2 vCPU)   | 10.06%    | Running  | $640.00    | t3.medium    |
  | i-0aaaa7777bbbb8888   | c5.2xlarge (8 vCPU) | ~100% peak| Running  | $910.00    | r6i.large    |

  The first three instances are strong downsizing candidates given sustained low CPU.
  The last instance peaks near 100%, so validate its workload pattern before resizing.
  ```
</CodeGroup>

### Verify an Unused Resource Before Acting

Before deleting or downsizing a resource Vantage flags as unused, ask the Agent to confirm it is truly idle in Datadog.

<Prompt description="Vantage says this resource is unused. Is it receiving any traffic or compute load in Datadog over the last 30 days?" actions={["copy"]}>
  Vantage says this resource is unused. Is it receiving any traffic or compute load in Datadog over the last 30 days?
</Prompt>

### Correlate Cost and Performance

Ask open-ended questions that require both cost context from Vantage and performance context from Datadog in one answer.

<Prompt description="Our AWS data transfer costs jumped this week. Which services or hosts in Datadog show increased network throughput over the same period?" actions={["copy"]}>
  Our AWS data transfer costs jumped this week. Which services or hosts in Datadog show increased network throughput over the same period?
</Prompt>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The page says I need to enable the FinOps Agent">
    Enable the [FinOps Agent](/vantage_finops_agent) first from the [FinOps Agent settings page](https://console.vantage.sh/settings/finops_agent), then return to **Settings** > **Integrations** > **MCP Connectors** > **Datadog MCP**.
  </Accordion>

  <Accordion title="The connection asks me to update or reconnect scopes">
    Your Datadog connection is missing the extended agent scopes (for example, `mcp_read`). Reconnect from the **Datadog MCP** page and authorize all requested scopes as a Datadog Admin. This is common if Datadog was originally connected only for cost ingestion.
  </Accordion>

  <Accordion title="The Agent is not using Datadog data">
    Confirm the Datadog MCP shows as connected and that your question requires Datadog context. The Agent prefers Vantage tools for pure cost questions and reaches for Datadog when telemetry (metrics, logs, monitors, events) is needed. Try phrasing the request to explicitly ask for utilization, metrics, or events.
  </Accordion>

  <Accordion title="The connection shows an authentication error">
    The Datadog OAuth grant may have been revoked or expired. Reconnect Datadog from the **Datadog MCP** page. If the issue persists, verify the connecting user is a Datadog Admin and that the Vantage app has not been removed in Datadog.
  </Accordion>

  <Accordion title="GovCloud is not supported">
    The Datadog MCP server is not available for GovCloud customers, so the Datadog MCP Connector cannot be used in those environments.
  </Accordion>

  <Accordion title="What happens if I disconnect the Datadog MCP">
    The Datadog tools are no longer available to the FinOps Agent. Previous conversations retain their historical responses based on your data retention period, but the Agent can no longer call Datadog after it is disconnected.
  </Accordion>
</AccordionGroup>