datadog-mcp 1.0.0

package/dist/index.js

@@ -0,0 +1,4579 @@
+#!/usr/bin/env node
+
+// src/config/schema.ts
+import { z } from "zod";
+var ALL_TOOLS = [
+  "monitors",
+  "dashboards",
+  "logs",
+  "metrics",
+  "traces",
+  "events",
+  "incidents",
+  "slos",
+  "synthetics",
+  "hosts",
+  "downtimes",
+  "rum",
+  "security",
+  "notebooks",
+  "users",
+  "teams",
+  "tags",
+  "usage",
+  "auth"
+];
+var configSchema = z.object({
+  datadog: z.object({
+    apiKey: z.string().min(1, "DD_API_KEY is required"),
+    appKey: z.string().min(1, "DD_APP_KEY is required"),
+    site: z.string().default("datadoghq.com")
+  }),
+  server: z.object({
+    name: z.string().default("datadog-mcp"),
+    version: z.string().default("1.0.0"),
+    transport: z.enum(["stdio", "http"]).default("stdio"),
+    port: z.number().default(3e3),
+    host: z.string().default("localhost")
+  }),
+  limits: z.object({
+    maxResults: z.number().default(100),
+    maxLogLines: z.number().default(100),
+    // Reduced from 500 for token efficiency
+    defaultLimit: z.number().default(25),
+    // Default limit for initial queries
+    maxMetricDataPoints: z.number().default(1e3),
+    defaultTimeRangeHours: z.number().default(24)
+  }),
+  features: z.object({
+    readOnly: z.boolean().default(false),
+    disabledTools: z.array(z.string()).default([])
+  }).default({})
+});
+
+// src/config/index.ts
+function parseArgs() {
+  const strings = {};
+  const booleans = /* @__PURE__ */ new Set();
+  const argv = process.argv.slice(2);
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg) continue;
+    if (arg.startsWith("--")) {
+      if (arg.includes("=")) {
+        const parts = arg.slice(2).split("=");
+        const key = parts[0];
+        const value = parts.slice(1).join("=");
+        if (key && value !== void 0) {
+          strings[key] = value;
+        }
+      } else {
+        const argName = arg.slice(2);
+        const nextArg = argv[i + 1];
+        if (nextArg && !nextArg.startsWith("--")) {
+          strings[argName] = nextArg;
+          i++;
+        } else {
+          booleans.add(argName);
+        }
+      }
+    }
+  }
+  return { strings, booleans };
+}
+function parseDisabledTools(value) {
+  if (!value) return [];
+  const requested = value.split(",").map((s) => s.trim().toLowerCase());
+  return requested.filter((t) => ALL_TOOLS.includes(t));
+}
+function loadConfig() {
+  const args = parseArgs();
+  const raw = {
+    datadog: {
+      apiKey: process.env.DD_API_KEY ?? "",
+      appKey: process.env.DD_APP_KEY ?? "",
+      site: args.strings.site ?? process.env.DD_SITE ?? "datadoghq.com"
+    },
+    server: {
+      name: "datadog-mcp",
+      version: "1.0.0",
+      transport: args.strings.transport ?? process.env.MCP_TRANSPORT ?? "stdio",
+      port: parseInt(args.strings.port ?? process.env.MCP_PORT ?? "3000", 10),
+      host: args.strings.host ?? process.env.MCP_HOST ?? "localhost"
+    },
+    limits: {
+      maxResults: parseInt(process.env.MCP_MAX_RESULTS ?? "100", 10),
+      maxLogLines: parseInt(process.env.MCP_MAX_LOG_LINES ?? "500", 10),
+      maxMetricDataPoints: parseInt(process.env.MCP_MAX_METRIC_POINTS ?? "1000", 10),
+      defaultTimeRangeHours: parseInt(process.env.MCP_DEFAULT_TIME_RANGE ?? "24", 10)
+    },
+    features: {
+      readOnly: args.booleans.has("read-only") || process.env.MCP_READ_ONLY === "true",
+      disabledTools: parseDisabledTools(args.strings["disable-tools"] ?? process.env.MCP_DISABLE_TOOLS)
+    }
+  };
+  return configSchema.parse(raw);
+}
+
+// src/server.ts
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+
+// src/config/datadog.ts
+import { client, v1, v2 } from "@datadog/datadog-api-client";
+function createDatadogClients(config) {
+  const configuration = client.createConfiguration({
+    authMethods: {
+      apiKeyAuth: config.apiKey,
+      appKeyAuth: config.appKey
+    }
+  });
+  if (config.site && config.site !== "datadoghq.com") {
+    configuration.setServerVariables({ site: config.site });
+  }
+  configuration.unstableOperations = {
+    "v2.listIncidents": true,
+    "v2.getIncident": true,
+    "v2.searchIncidents": true,
+    "v2.createIncident": true,
+    "v2.updateIncident": true,
+    "v2.deleteIncident": true
+  };
+  return {
+    monitors: new v1.MonitorsApi(configuration),
+    dashboards: new v1.DashboardsApi(configuration),
+    dashboardLists: new v1.DashboardListsApi(configuration),
+    logs: new v2.LogsApi(configuration),
+    metricsV1: new v1.MetricsApi(configuration),
+    metricsV2: new v2.MetricsApi(configuration),
+    eventsV1: new v1.EventsApi(configuration),
+    eventsV2: new v2.EventsApi(configuration),
+    incidents: new v2.IncidentsApi(configuration),
+    downtimes: new v2.DowntimesApi(configuration),
+    hosts: new v1.HostsApi(configuration),
+    slo: new v1.ServiceLevelObjectivesApi(configuration),
+    synthetics: new v1.SyntheticsApi(configuration),
+    rum: new v2.RUMApi(configuration),
+    security: new v2.SecurityMonitoringApi(configuration),
+    notebooks: new v1.NotebooksApi(configuration),
+    users: new v2.UsersApi(configuration),
+    teams: new v2.TeamsApi(configuration),
+    tags: new v1.TagsApi(configuration),
+    usage: new v1.UsageMeteringApi(configuration),
+    spans: new v2.SpansApi(configuration),
+    services: new v2.ServiceDefinitionApi(configuration),
+    auth: new v1.AuthenticationApi(configuration)
+  };
+}
+
+// src/tools/monitors.ts
+import { z as z2 } from "zod";
+
+// src/errors/datadog.ts
+import { McpError, ErrorCode } from "@modelcontextprotocol/sdk/types.js";
+var DatadogErrorCode = {
+  /** 401 - Invalid or missing API/APP key */
+  Unauthorized: -32050,
+  /** 403 - Valid credentials but insufficient permissions */
+  Forbidden: -32051,
+  /** 404 - Requested resource does not exist */
+  NotFound: -32052,
+  /** 429 - Rate limit exceeded, should retry after delay */
+  RateLimited: -32053,
+  /** 5xx - Datadog service temporarily unavailable */
+  ServiceUnavailable: -32054
+};
+function handleDatadogError(error) {
+  console.error("[Datadog Error]", error);
+  if (error instanceof McpError) {
+    throw error;
+  }
+  const apiError = error;
+  if (typeof apiError.code === "number") {
+    const message = apiError.body?.errors?.[0] ?? apiError.message ?? "Unknown error";
+    switch (apiError.code) {
+      case 400:
+        throw new McpError(ErrorCode.InvalidRequest, `Invalid request: ${message}`);
+      case 401:
+        throw new McpError(DatadogErrorCode.Unauthorized, `Authentication failed: Invalid Datadog API key or APP key`);
+      case 403:
+        throw new McpError(DatadogErrorCode.Forbidden, `Authorization denied: ${message}`);
+      case 404:
+        throw new McpError(DatadogErrorCode.NotFound, `Resource not found: ${message}`);
+      case 429:
+        throw new McpError(DatadogErrorCode.RateLimited, "Rate limit exceeded. Retry after a short delay.");
+      case 500:
+      case 502:
+      case 503:
+        throw new McpError(DatadogErrorCode.ServiceUnavailable, "Datadog service temporarily unavailable. Retry later.");
+      default:
+        throw new McpError(ErrorCode.InternalError, `Datadog API error (${apiError.code}): ${message}`);
+    }
+  }
+  throw new McpError(
+    ErrorCode.InternalError,
+    error instanceof Error ? error.message : String(error)
+  );
+}
+function requireParam(value, name, action) {
+  if (value === void 0 || value === null || value === "") {
+    throw new McpError(
+      ErrorCode.InvalidParams,
+      `Parameter '${name}' is required for action '${action}'`
+    );
+  }
+  return value;
+}
+var WRITE_ACTIONS = /* @__PURE__ */ new Set([
+  "create",
+  "update",
+  "delete",
+  "mute",
+  "unmute",
+  "cancel",
+  "add",
+  "trigger"
+]);
+function checkReadOnly(action, readOnly) {
+  if (readOnly && WRITE_ACTIONS.has(action)) {
+    throw new McpError(
+      ErrorCode.InvalidRequest,
+      `Action '${action}' is not allowed in read-only mode. Server started with --read-only flag.`
+    );
+  }
+}
+
+// src/utils/format.ts
+function formatResponse(data) {
+  return [
+    {
+      type: "text",
+      text: JSON.stringify(data, null, 2)
+    }
+  ];
+}
+function toolResult(data) {
+  return {
+    content: formatResponse(data)
+  };
+}
+
+// src/utils/urls.ts
+var SITE_TO_APP_URL = {
+  "datadoghq.com": "https://app.datadoghq.com",
+  "us3.datadoghq.com": "https://us3.datadoghq.com",
+  "us5.datadoghq.com": "https://us5.datadoghq.com",
+  "datadoghq.eu": "https://app.datadoghq.eu",
+  "ap1.datadoghq.com": "https://ap1.datadoghq.com",
+  "ddog-gov.com": "https://app.ddog-gov.com"
+};
+function getAppBaseUrl(site = "datadoghq.com") {
+  return SITE_TO_APP_URL[site] ?? SITE_TO_APP_URL["datadoghq.com"];
+}
+function toMs(seconds) {
+  return seconds * 1e3;
+}
+function buildLogsUrl(query, fromSec, toSec, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  const params = new URLSearchParams({
+    query,
+    from_ts: toMs(fromSec).toString(),
+    to_ts: toMs(toSec).toString()
+  });
+  return `${base}/logs?${params.toString()}`;
+}
+function extractMetricName(query) {
+  const match = query.match(/^(?:\w+:)?([a-zA-Z0-9_.]+)/);
+  return match?.[1] ?? query;
+}
+function buildMetricsUrl(query, fromSec, toSec, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  const metricName = extractMetricName(query);
+  const params = new URLSearchParams({
+    exp_metric: metricName,
+    exp_query: query,
+    from_ts: toMs(fromSec).toString(),
+    to_ts: toMs(toSec).toString()
+  });
+  return `${base}/metric/explorer?${params.toString()}`;
+}
+function buildTracesUrl(query, fromSec, toSec, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  const params = new URLSearchParams({
+    query,
+    start: toMs(fromSec).toString(),
+    end: toMs(toSec).toString()
+  });
+  return `${base}/apm/traces?${params.toString()}`;
+}
+function buildEventsUrl(query, fromSec, toSec, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  const params = new URLSearchParams({
+    query,
+    from_ts: toMs(fromSec).toString(),
+    to_ts: toMs(toSec).toString()
+  });
+  return `${base}/event/explorer?${params.toString()}`;
+}
+function buildMonitorUrl(monitorId, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  return `${base}/monitors/${monitorId}`;
+}
+function buildMonitorsListUrl(query, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  if (query) {
+    const params = new URLSearchParams({ query });
+    return `${base}/monitors/manage?${params.toString()}`;
+  }
+  return `${base}/monitors/manage`;
+}
+function buildRumUrl(query, fromSec, toSec, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  const params = new URLSearchParams({
+    query,
+    from_ts: toMs(fromSec).toString(),
+    to_ts: toMs(toSec).toString()
+  });
+  return `${base}/rum/explorer?${params.toString()}`;
+}
+function buildRumSessionUrl(applicationId, sessionId, site = "datadoghq.com") {
+  const base = getAppBaseUrl(site);
+  return `${base}/rum/replay/sessions/${sessionId}?applicationId=${encodeURIComponent(applicationId)}`;
+}
+
+// src/tools/monitors.ts
+var ActionSchema = z2.enum(["list", "get", "search", "create", "update", "delete", "mute", "unmute"]);
+var InputSchema = {
+  action: ActionSchema.describe("Action to perform"),
+  id: z2.string().optional().describe("Monitor ID (required for get/update/delete/mute/unmute)"),
+  query: z2.string().optional().describe("Search query (for search action)"),
+  name: z2.string().optional().describe("Filter by name (for list action)"),
+  tags: z2.array(z2.string()).optional().describe("Filter by tags"),
+  groupStates: z2.array(z2.string()).optional().describe("Filter by group states: alert, warn, no data, ok"),
+  limit: z2.number().optional().describe("Maximum number of monitors to return"),
+  config: z2.record(z2.unknown()).optional().describe("Monitor configuration (for create/update)"),
+  message: z2.string().optional().describe("Mute message (for mute action)"),
+  end: z2.number().optional().describe("Mute end timestamp (for mute action)")
+};
+function formatMonitor(m) {
+  return {
+    id: m.id ?? 0,
+    name: m.name ?? "",
+    type: String(m.type ?? "unknown"),
+    status: String(m.overallState ?? "unknown"),
+    message: m.message ?? "",
+    tags: m.tags ?? [],
+    query: m.query ?? "",
+    created: m.created ? new Date(m.created).toISOString() : "",
+    modified: m.modified ? new Date(m.modified).toISOString() : ""
+  };
+}
+async function listMonitors(api, params, limits, site) {
+  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const response = await api.listMonitors({
+    name: params.name,
+    tags: params.tags?.join(","),
+    groupStates: params.groupStates?.join(",")
+  });
+  const monitors = response.slice(0, effectiveLimit).map(formatMonitor);
+  const statusCounts = {
+    total: response.length,
+    alert: response.filter((m) => m.overallState === "Alert").length,
+    warn: response.filter((m) => m.overallState === "Warn").length,
+    ok: response.filter((m) => m.overallState === "OK").length,
+    noData: response.filter((m) => m.overallState === "No Data").length
+  };
+  return {
+    monitors,
+    summary: statusCounts,
+    datadog_url: buildMonitorsListUrl(params.name, site)
+  };
+}
+async function getMonitor(api, id, site) {
+  const monitorId = parseInt(id, 10);
+  if (isNaN(monitorId)) {
+    throw new Error(`Invalid monitor ID: ${id}`);
+  }
+  const monitor = await api.getMonitor({ monitorId });
+  return {
+    monitor: formatMonitor(monitor),
+    datadog_url: buildMonitorUrl(monitorId, site)
+  };
+}
+async function searchMonitors(api, query, limits, site) {
+  const response = await api.searchMonitors({ query });
+  const monitors = (response.monitors ?? []).slice(0, limits.maxResults).map((m) => ({
+    id: m.id ?? 0,
+    name: m.name ?? "",
+    status: String(m.status ?? "unknown"),
+    type: m.type ?? "",
+    tags: m.tags ?? []
+  }));
+  return {
+    monitors,
+    metadata: {
+      totalCount: response.metadata?.totalCount ?? monitors.length,
+      pageCount: response.metadata?.pageCount ?? 1,
+      page: response.metadata?.page ?? 0
+    },
+    datadog_url: buildMonitorsListUrl(query, site)
+  };
+}
+function normalizeMonitorConfig(config) {
+  const normalized = { ...config };
+  if (!normalized.name && !normalized.type && !normalized.query) {
+    throw new Error("Monitor config requires at least 'name', 'type', and 'query' fields");
+  }
+  if (normalized.options && typeof normalized.options === "object") {
+    const opts = { ...normalized.options };
+    const optionMappings = [
+      ["notify_no_data", "notifyNoData"],
+      ["no_data_timeframe", "noDataTimeframe"],
+      ["new_host_delay", "newHostDelay"],
+      ["new_group_delay", "newGroupDelay"],
+      ["evaluation_delay", "evaluationDelay"],
+      ["renotify_interval", "renotifyInterval"],
+      ["renotify_occurrences", "renotifyOccurrences"],
+      ["renotify_statuses", "renotifyStatuses"],
+      ["timeout_h", "timeoutH"],
+      ["notify_audit", "notifyAudit"],
+      ["include_tags", "includeTags"],
+      ["require_full_window", "requireFullWindow"],
+      ["escalation_message", "escalationMessage"],
+      ["locked", "locked"],
+      ["silenced", "silenced"]
+    ];
+    for (const [snake, camel] of optionMappings) {
+      if (snake in opts && !(camel in opts)) {
+        opts[camel] = opts[snake];
+        delete opts[snake];
+      }
+    }
+    if (opts.thresholds && typeof opts.thresholds === "object") {
+      const thresholds = { ...opts.thresholds };
+      const thresholdMappings = [
+        ["critical", "critical"],
+        ["warning", "warning"],
+        ["ok", "ok"],
+        ["critical_recovery", "criticalRecovery"],
+        ["warning_recovery", "warningRecovery"]
+      ];
+      for (const [snake, camel] of thresholdMappings) {
+        if (snake in thresholds && !(camel in thresholds) && snake !== camel) {
+          thresholds[camel] = thresholds[snake];
+          delete thresholds[snake];
+        }
+      }
+      opts.thresholds = thresholds;
+    }
+    normalized.options = opts;
+  }
+  return normalized;
+}
+async function createMonitor(api, config) {
+  const body = normalizeMonitorConfig(config);
+  const monitor = await api.createMonitor({ body });
+  return {
+    success: true,
+    monitor: formatMonitor(monitor)
+  };
+}
+async function updateMonitor(api, id, config) {
+  const monitorId = parseInt(id, 10);
+  const body = normalizeMonitorConfig(config);
+  const monitor = await api.updateMonitor({ monitorId, body });
+  return {
+    success: true,
+    monitor: formatMonitor(monitor)
+  };
+}
+async function deleteMonitor(api, id) {
+  const monitorId = parseInt(id, 10);
+  await api.deleteMonitor({ monitorId });
+  return { success: true, message: `Monitor ${id} deleted` };
+}
+async function muteMonitor(api, id, params) {
+  const monitorId = parseInt(id, 10);
+  const monitor = await api.getMonitor({ monitorId });
+  await api.updateMonitor({
+    monitorId,
+    body: {
+      options: {
+        ...monitor.options,
+        silenced: { "*": params.end ?? null }
+      }
+    }
+  });
+  return { success: true, message: `Monitor ${id} muted` };
+}
+async function unmuteMonitor(api, id) {
+  const monitorId = parseInt(id, 10);
+  const monitor = await api.getMonitor({ monitorId });
+  await api.updateMonitor({
+    monitorId,
+    body: {
+      options: {
+        ...monitor.options,
+        silenced: {}
+      }
+    }
+  });
+  return { success: true, message: `Monitor ${id} unmuted` };
+}
+function registerMonitorsTool(server, api, limits, readOnly = false, site = "datadoghq.com") {
+  server.tool(
+    "monitors",
+    `Manage Datadog monitors. Actions: list, get, search, create, update, delete, mute, unmute.
+Filters: name, tags, groupStates (alert/warn/ok/no data).
+TIP: For alert HISTORY (which monitors triggered), use the events tool with tags: ["source:alert"].`,
+    InputSchema,
+    async ({ action, id, query, name, tags, groupStates, limit, config, end }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listMonitors(api, { name, tags, groupStates, limit }, limits, site));
+          case "get": {
+            const monitorId = requireParam(id, "id", "get");
+            return toolResult(await getMonitor(api, monitorId, site));
+          }
+          case "search": {
+            const searchQuery = requireParam(query, "query", "search");
+            return toolResult(await searchMonitors(api, searchQuery, limits, site));
+          }
+          case "create": {
+            const monitorConfig = requireParam(config, "config", "create");
+            return toolResult(await createMonitor(api, monitorConfig));
+          }
+          case "update": {
+            const monitorId = requireParam(id, "id", "update");
+            const updateConfig = requireParam(config, "config", "update");
+            return toolResult(await updateMonitor(api, monitorId, updateConfig));
+          }
+          case "delete": {
+            const monitorId = requireParam(id, "id", "delete");
+            return toolResult(await deleteMonitor(api, monitorId));
+          }
+          case "mute": {
+            const monitorId = requireParam(id, "id", "mute");
+            return toolResult(await muteMonitor(api, monitorId, { end }));
+          }
+          case "unmute": {
+            const monitorId = requireParam(id, "id", "unmute");
+            return toolResult(await unmuteMonitor(api, monitorId));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/dashboards.ts
+import { z as z3 } from "zod";
+var ActionSchema2 = z3.enum(["list", "get", "create", "update", "delete"]);
+var InputSchema2 = {
+  action: ActionSchema2.describe("Action to perform"),
+  id: z3.string().optional().describe("Dashboard ID (required for get/update/delete)"),
+  name: z3.string().optional().describe("Filter by name"),
+  tags: z3.array(z3.string()).optional().describe("Filter by tags"),
+  limit: z3.number().optional().describe("Maximum number of dashboards to return"),
+  config: z3.record(z3.unknown()).optional().describe("Dashboard configuration (for create/update)")
+};
+function formatDashboardSummary(d) {
+  return {
+    id: d.id ?? "",
+    title: d.title ?? "",
+    description: d.description ?? "",
+    url: d.url ?? "",
+    layoutType: String(d.layoutType ?? "unknown"),
+    created: d.createdAt ? new Date(d.createdAt).toISOString() : "",
+    modified: d.modifiedAt ? new Date(d.modifiedAt).toISOString() : "",
+    authorHandle: d.authorHandle ?? ""
+  };
+}
+async function listDashboards(api, params, limits) {
+  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const response = await api.listDashboards({
+    filterShared: false
+  });
+  let dashboards = response.dashboards ?? [];
+  if (params.name) {
+    const lowerName = params.name.toLowerCase();
+    dashboards = dashboards.filter(
+      (d) => d.title?.toLowerCase().includes(lowerName)
+    );
+  }
+  const result = dashboards.slice(0, effectiveLimit).map(formatDashboardSummary);
+  return {
+    dashboards: result,
+    total: response.dashboards?.length ?? 0
+  };
+}
+async function getDashboard(api, id) {
+  const dashboard = await api.getDashboard({ dashboardId: id });
+  return {
+    dashboard: {
+      id: dashboard.id ?? "",
+      title: dashboard.title ?? "",
+      description: dashboard.description ?? "",
+      layoutType: String(dashboard.layoutType ?? "unknown"),
+      widgets: dashboard.widgets?.length ?? 0,
+      url: dashboard.url ?? "",
+      created: dashboard.createdAt ? new Date(dashboard.createdAt).toISOString() : "",
+      modified: dashboard.modifiedAt ? new Date(dashboard.modifiedAt).toISOString() : "",
+      authorHandle: dashboard.authorHandle ?? ""
+    }
+  };
+}
+function normalizeDashboardConfig(config) {
+  const normalized = { ...config };
+  if ("layout_type" in normalized && !("layoutType" in normalized)) {
+    normalized.layoutType = normalized.layout_type;
+    delete normalized.layout_type;
+  }
+  if (!normalized.layoutType) {
+    throw new Error("Dashboard config requires 'layoutType' (e.g., 'ordered', 'free')");
+  }
+  return normalized;
+}
+async function createDashboard(api, config) {
+  const body = normalizeDashboardConfig(config);
+  const dashboard = await api.createDashboard({ body });
+  return {
+    success: true,
+    dashboard: {
+      id: dashboard.id ?? "",
+      title: dashboard.title ?? "",
+      url: dashboard.url ?? ""
+    }
+  };
+}
+async function updateDashboard(api, id, config) {
+  const body = normalizeDashboardConfig(config);
+  const dashboard = await api.updateDashboard({ dashboardId: id, body });
+  return {
+    success: true,
+    dashboard: {
+      id: dashboard.id ?? "",
+      title: dashboard.title ?? "",
+      url: dashboard.url ?? ""
+    }
+  };
+}
+async function deleteDashboard(api, id) {
+  await api.deleteDashboard({ dashboardId: id });
+  return { success: true, message: `Dashboard ${id} deleted` };
+}
+function registerDashboardsTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "dashboards",
+    "Access Datadog dashboards and visualizations. Actions: list (filter by name/tags), get, create, update, delete. Use for: finding existing views, team dashboards, understanding what is monitored.",
+    InputSchema2,
+    async ({ action, id, name, tags, limit, config }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listDashboards(api, { name, tags, limit }, limits));
+          case "get": {
+            const dashboardId = requireParam(id, "id", "get");
+            return toolResult(await getDashboard(api, dashboardId));
+          }
+          case "create": {
+            const dashboardConfig = requireParam(config, "config", "create");
+            return toolResult(await createDashboard(api, dashboardConfig));
+          }
+          case "update": {
+            const dashboardId = requireParam(id, "id", "update");
+            const updateConfig = requireParam(config, "config", "update");
+            return toolResult(await updateDashboard(api, dashboardId, updateConfig));
+          }
+          case "delete": {
+            const dashboardId = requireParam(id, "id", "delete");
+            return toolResult(await deleteDashboard(api, dashboardId));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/logs.ts
+import { z as z4 } from "zod";
+
+// src/utils/time.ts
+function hoursAgo(hours) {
+  return Math.floor(Date.now() / 1e3) - hours * 3600;
+}
+function now() {
+  return Math.floor(Date.now() / 1e3);
+}
+function startOfDayAgo(days) {
+  const date = /* @__PURE__ */ new Date();
+  date.setDate(date.getDate() - days);
+  date.setHours(0, 0, 0, 0);
+  return date;
+}
+function parseTime(input, defaultValue) {
+  if (input === void 0) {
+    return defaultValue;
+  }
+  if (typeof input === "number") {
+    return input;
+  }
+  const trimmed = input.trim();
+  const simpleRelativeMatch = trimmed.match(/^(\d+)(s|m|h|d)$/);
+  if (simpleRelativeMatch) {
+    const value = parseInt(simpleRelativeMatch[1] ?? "0", 10);
+    const unit = simpleRelativeMatch[2];
+    const nowTs = now();
+    switch (unit) {
+      case "s":
+        return nowTs - value;
+      case "m":
+        return nowTs - value * 60;
+      case "h":
+        return nowTs - value * 3600;
+      case "d":
+        return nowTs - value * 86400;
+      default:
+        return defaultValue;
+    }
+  }
+  const relativeWithTimeMatch = trimmed.match(/^(\d+)(d|h)[@\s](\d{1,2}):(\d{2})(?::(\d{2}))?$/);
+  if (relativeWithTimeMatch) {
+    const value = parseInt(relativeWithTimeMatch[1] ?? "0", 10);
+    const unit = relativeWithTimeMatch[2];
+    const hours = parseInt(relativeWithTimeMatch[3] ?? "0", 10);
+    const minutes = parseInt(relativeWithTimeMatch[4] ?? "0", 10);
+    const seconds = parseInt(relativeWithTimeMatch[5] ?? "0", 10);
+    if (unit === "d") {
+      const date3 = startOfDayAgo(value);
+      date3.setHours(hours, minutes, seconds, 0);
+      return Math.floor(date3.getTime() / 1e3);
+    }
+    const date2 = /* @__PURE__ */ new Date();
+    date2.setHours(date2.getHours() - value);
+    date2.setMinutes(minutes, seconds, 0);
+    return Math.floor(date2.getTime() / 1e3);
+  }
+  const keywordMatch = trimmed.match(/^(today|yesterday)[@\s](\d{1,2}):(\d{2})(?::(\d{2}))?$/i);
+  if (keywordMatch) {
+    const keyword = keywordMatch[1]?.toLowerCase();
+    const hours = parseInt(keywordMatch[2] ?? "0", 10);
+    const minutes = parseInt(keywordMatch[3] ?? "0", 10);
+    const seconds = parseInt(keywordMatch[4] ?? "0", 10);
+    const daysAgo = keyword === "yesterday" ? 1 : 0;
+    const date2 = startOfDayAgo(daysAgo);
+    date2.setHours(hours, minutes, seconds, 0);
+    return Math.floor(date2.getTime() / 1e3);
+  }
+  const date = new Date(trimmed);
+  if (!isNaN(date.getTime())) {
+    return Math.floor(date.getTime() / 1e3);
+  }
+  const ts = parseInt(trimmed, 10);
+  if (!isNaN(ts)) {
+    return ts;
+  }
+  return defaultValue;
+}
+function ensureValidTimeRange(from, to, minRangeSeconds = 60) {
+  if (from > to) {
+    [from, to] = [to, from];
+  }
+  if (to - from < minRangeSeconds) {
+    to = from + minRangeSeconds;
+  }
+  return [from, to];
+}
+function parseDurationToNs(input) {
+  if (input === void 0) {
+    return void 0;
+  }
+  if (typeof input === "number") {
+    return input;
+  }
+  const trimmed = input.trim().toLowerCase();
+  const match = trimmed.match(/^(\d+(?:\.\d+)?)(ns|µs|us|ms|s|m|h|d|w)?$/);
+  if (!match) {
+    const raw = parseInt(trimmed, 10);
+    return isNaN(raw) ? void 0 : raw;
+  }
+  const value = parseFloat(match[1] ?? "0");
+  const unit = match[2] ?? "ns";
+  const multipliers = {
+    "ns": 1,
+    "\xB5s": 1e3,
+    "us": 1e3,
+    "ms": 1e6,
+    "s": 1e9,
+    "m": 6e10,
+    "h": 36e11,
+    "d": 864e11,
+    "w": 6048e11
+  };
+  return Math.floor(value * (multipliers[unit] ?? 1));
+}
+function formatDurationNs(ns) {
+  if (ns < 1e3) return `${ns}ns`;
+  if (ns < 1e6) return `${(ns / 1e3).toFixed(1)}\xB5s`;
+  if (ns < 1e9) return `${(ns / 1e6).toFixed(1)}ms`;
+  if (ns < 6e10) return `${(ns / 1e9).toFixed(2)}s`;
+  return `${(ns / 6e10).toFixed(2)}m`;
+}
+
+// src/tools/logs.ts
+var ActionSchema3 = z4.enum(["search", "aggregate"]);
+var InputSchema3 = {
+  action: ActionSchema3.describe("Action to perform"),
+  query: z4.string().optional().describe('Log search query (Datadog syntax). Examples: "error", "service:my-service status:error", "error AND timeout"'),
+  keyword: z4.string().optional().describe("Simple text search - finds logs containing this text (grep-like). Merged with query using AND"),
+  pattern: z4.string().optional().describe('Regex pattern to match in log message (grep -E style). Example: "ERROR.*timeout|connection refused"'),
+  from: z4.string().optional().describe("Start time. Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23, yesterday@14:00)"),
+  to: z4.string().optional().describe('End time. Same formats as "from". Example: from="3d@11:45:23" to="3d@12:55:34"'),
+  service: z4.string().optional().describe("Filter by service name"),
+  host: z4.string().optional().describe("Filter by host"),
+  status: z4.enum(["error", "warn", "info", "debug"]).optional().describe("Filter by log status/level"),
+  indexes: z4.array(z4.string()).optional().describe("Log indexes to search"),
+  limit: z4.number().optional().describe("Maximum number of logs to return"),
+  sort: z4.enum(["timestamp", "-timestamp"]).optional().describe("Sort order"),
+  sample: z4.enum(["first", "spread", "diverse"]).optional().describe("Sampling mode: first (chronological, default), spread (evenly across time range), diverse (distinct message patterns)"),
+  compact: z4.boolean().optional().describe("Strip custom attributes for token efficiency. Keeps: id, timestamp, service, status, message (truncated), dd.trace_id, error info"),
+  groupBy: z4.array(z4.string()).optional().describe("Fields to group by (for aggregate)"),
+  compute: z4.record(z4.unknown()).optional().describe("Compute operations (for aggregate)")
+};
+function formatLog(log) {
+  const attrs = log.attributes ?? {};
+  let timestamp = "";
+  if (attrs.timestamp) {
+    const ts = attrs.timestamp;
+    timestamp = ts instanceof Date ? ts.toISOString() : new Date(String(ts)).toISOString();
+  }
+  return {
+    id: log.id ?? "",
+    timestamp,
+    service: attrs.service ?? "",
+    host: attrs.host ?? "",
+    status: attrs.status ?? "",
+    message: attrs.message ?? "",
+    tags: attrs.tags ?? [],
+    attributes: attrs.attributes ?? {}
+  };
+}
+function formatLogCompact(log) {
+  const attrs = log.attributes ?? {};
+  const nestedAttrs = attrs.attributes ?? {};
+  let timestamp = "";
+  if (attrs.timestamp) {
+    const ts = attrs.timestamp;
+    timestamp = ts instanceof Date ? ts.toISOString() : new Date(String(ts)).toISOString();
+  }
+  const traceId = nestedAttrs["dd.trace_id"] ?? nestedAttrs["trace_id"] ?? attrs["dd.trace_id"] ?? "";
+  const spanId = nestedAttrs["dd.span_id"] ?? nestedAttrs["span_id"] ?? attrs["dd.span_id"] ?? "";
+  const errorType = nestedAttrs["error.type"] ?? nestedAttrs["error.kind"] ?? "";
+  const errorMessage = nestedAttrs["error.message"] ?? nestedAttrs["error.msg"] ?? "";
+  const fullMessage = attrs.message ?? "";
+  const message = fullMessage.length > 500 ? fullMessage.slice(0, 500) + "..." : fullMessage;
+  const entry = {
+    id: log.id ?? "",
+    timestamp,
+    service: attrs.service ?? "",
+    host: attrs.host ?? "",
+    status: attrs.status ?? "",
+    message,
+    traceId,
+    spanId
+  };
+  if (errorType || errorMessage) {
+    entry.error = {
+      type: errorType,
+      message: errorMessage.length > 200 ? errorMessage.slice(0, 200) + "..." : errorMessage
+    };
+  }
+  return entry;
+}
+function normalizeToPattern(message) {
+  return message.replace(/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/gi, "{UUID}").replace(/\b[0-9a-f]{16,}\b/gi, "{HEX}").replace(/\b[0-9a-f]{8,15}\b/gi, "{ID}").replace(/\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[.\dZ]*/g, "{TS}").replace(/\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, "{IP}").replace(/\b\d{4,}\b/g, "{N}").slice(0, 200);
+}
+function spreadSample(items, limit) {
+  if (items.length <= limit) return items;
+  const step = items.length / limit;
+  return Array.from({ length: limit }, (_, i) => items[Math.floor(i * step)]);
+}
+function diverseSample(items, limit) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const item of items) {
+    const pattern = normalizeToPattern(item.message);
+    if (!seen.has(pattern)) {
+      seen.set(pattern, item);
+      if (seen.size >= limit) break;
+    }
+  }
+  return {
+    samples: Array.from(seen.values()),
+    patterns: seen.size
+  };
+}
+function buildLogQuery(params) {
+  const parts = [];
+  if (params.query) {
+    parts.push(params.query);
+  }
+  if (params.keyword) {
+    const escaped = params.keyword.replace(/"/g, '\\"');
+    parts.push(`"${escaped}"`);
+  }
+  if (params.pattern) {
+    const escaped = params.pattern.replace(/"/g, '\\"');
+    parts.push(`@message:~"${escaped}"`);
+  }
+  if (params.service) {
+    parts.push(`service:${params.service}`);
+  }
+  if (params.host) {
+    parts.push(`host:${params.host}`);
+  }
+  if (params.status) {
+    parts.push(`status:${params.status}`);
+  }
+  return parts.length > 0 ? parts.join(" ") : "*";
+}
+async function searchLogs(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const fullQuery = buildLogQuery({
+    query: params.query,
+    keyword: params.keyword,
+    pattern: params.pattern,
+    service: params.service,
+    host: params.host,
+    status: params.status
+  });
+  const requestedLimit = params.limit ?? limits.defaultLimit;
+  const sampleMode = params.sample ?? "first";
+  const fetchMultiplier = sampleMode === "first" ? 1 : 4;
+  const fetchLimit = Math.min(requestedLimit * fetchMultiplier, limits.maxLogLines);
+  const body = {
+    filter: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      indexes: params.indexes
+    },
+    sort: params.sort === "timestamp" ? "timestamp" : "-timestamp",
+    page: {
+      limit: fetchLimit
+    }
+  };
+  const response = await api.listLogs({ body });
+  const formattedLogs = params.compact ? (response.data ?? []).map(formatLogCompact) : (response.data ?? []).map(formatLog);
+  let logs;
+  let distinctPatterns;
+  switch (sampleMode) {
+    case "spread":
+      logs = spreadSample(formattedLogs, requestedLimit);
+      break;
+    case "diverse": {
+      const result = diverseSample(formattedLogs, requestedLimit);
+      logs = result.samples;
+      distinctPatterns = result.patterns;
+      break;
+    }
+    case "first":
+    default:
+      logs = formattedLogs.slice(0, requestedLimit);
+  }
+  return {
+    logs,
+    meta: {
+      count: logs.length,
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      compact: params.compact ?? false,
+      sample: sampleMode,
+      ...sampleMode !== "first" && { fetched: formattedLogs.length },
+      ...distinctPatterns !== void 0 && { distinctPatterns },
+      datadog_url: buildLogsUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function aggregateLogs(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const computeOps = params.compute ? [params.compute] : [{ aggregation: "count", type: "total" }];
+  const body = {
+    filter: {
+      query: params.query,
+      from: fromTime,
+      to: toTime
+    },
+    compute: computeOps,
+    groupBy: params.groupBy?.map((field) => ({
+      facet: field,
+      limit: 10
+    }))
+  };
+  const response = await api.aggregateLogs({ body });
+  return {
+    buckets: response.data?.buckets ?? [],
+    meta: {
+      query: params.query,
+      from: fromTime,
+      to: toTime,
+      groupBy: params.groupBy,
+      datadog_url: buildLogsUrl(params.query, validFrom, validTo, site)
+    }
+  };
+}
+function registerLogsTool(server, api, limits, site = "datadoghq.com") {
+  server.tool(
+    "logs",
+    `Search Datadog logs with grep-like text filtering. Actions: search (find logs), aggregate (count/group). Key filters: keyword (text grep), pattern (regex), service, host, status (error/warn/info). Time ranges: "1h", "3d@11:45:23".
+CORRELATION: Logs contain dd.trace_id in attributes for linking to traces and APM metrics.
+SAMPLING: Use sample:"diverse" for error investigation (dedupes by message pattern), sample:"spread" for time distribution.
+TOKEN TIP: Use compact:true to reduce payload size (strips heavy fields) when querying large volumes.`,
+    InputSchema3,
+    async ({ action, query, keyword, pattern, service, host, status, from, to, indexes, limit, sort, sample, compact, groupBy, compute }) => {
+      try {
+        switch (action) {
+          case "search": {
+            return toolResult(await searchLogs(api, {
+              query,
+              keyword,
+              pattern,
+              service,
+              host,
+              status,
+              from,
+              to,
+              indexes,
+              limit,
+              sort,
+              sample,
+              compact
+            }, limits, site));
+          }
+          case "aggregate": {
+            const aggregateQuery = requireParam(query, "query", "aggregate");
+            return toolResult(await aggregateLogs(api, {
+              query: aggregateQuery,
+              from,
+              to,
+              groupBy,
+              compute
+            }, limits, site));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/metrics.ts
+import { z as z5 } from "zod";
+var ActionSchema4 = z5.enum(["query", "search", "list", "metadata"]);
+var InputSchema4 = {
+  action: ActionSchema4.describe("Action to perform"),
+  query: z5.string().optional().describe('For query: PromQL expression (e.g., "avg:system.cpu.user{*}"). For search: grep-like filter on metric names. For list: tag filter.'),
+  from: z5.string().optional().describe("Start time (ONLY for query action). Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23)"),
+  to: z5.string().optional().describe('End time (ONLY for query action). Same formats as "from".'),
+  metric: z5.string().optional().describe("Metric name (for metadata action)"),
+  tag: z5.string().optional().describe("Filter by tag"),
+  limit: z5.number().optional().describe("Maximum number of results (for search/list)")
+};
+async function queryMetrics(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [fromTs, toTs] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const response = await api.queryMetrics({
+    from: fromTs,
+    to: toTs,
+    query: params.query
+  });
+  const series = (response.series ?? []).map((s) => ({
+    metric: s.metric ?? "",
+    points: (s.pointlist ?? []).slice(0, limits.maxMetricDataPoints).map((p) => ({
+      timestamp: p[0] ?? 0,
+      value: p[1] ?? 0
+    })),
+    scope: s.scope ?? "",
+    tags: s.tagSet ?? []
+  }));
+  return {
+    series,
+    meta: {
+      query: params.query,
+      from: new Date(fromTs * 1e3).toISOString(),
+      to: new Date(toTs * 1e3).toISOString(),
+      seriesCount: series.length,
+      datadog_url: buildMetricsUrl(params.query, fromTs, toTs, site)
+    }
+  };
+}
+async function searchMetrics(api, params, limits) {
+  const response = await api.listActiveMetrics({
+    from: hoursAgo(24),
+    host: void 0,
+    tagFilter: void 0
+    // Must match listMetrics exactly
+  });
+  const allMetrics = response.metrics ?? [];
+  const lowerQuery = params.query.toLowerCase();
+  const filtered = allMetrics.filter((name) => name.toLowerCase().includes(lowerQuery)).slice(0, params.limit ?? limits.maxResults);
+  return {
+    metrics: filtered,
+    total: filtered.length,
+    searchedFrom: allMetrics.length
+  };
+}
+async function listMetrics(api, params, limits) {
+  const response = await api.listActiveMetrics({
+    from: hoursAgo(24),
+    host: void 0,
+    tagFilter: params.query
+  });
+  const metrics = (response.metrics ?? []).slice(0, limits.maxResults);
+  return {
+    metrics,
+    total: response.metrics?.length ?? 0
+  };
+}
+async function getMetricMetadata(api, metricName) {
+  const metadata = await api.getMetricMetadata({ metricName });
+  return {
+    metric: metricName,
+    description: metadata.description ?? "",
+    unit: metadata.unit ?? "",
+    perUnit: metadata.perUnit ?? "",
+    type: metadata.type ?? "",
+    shortName: metadata.shortName ?? "",
+    integration: metadata.integration ?? ""
+  };
+}
+function registerMetricsTool(server, metricsV1Api, metricsV2Api, limits, site = "datadoghq.com") {
+  server.tool(
+    "metrics",
+    `Query Datadog metrics. Actions:
+- query: Get timeseries data (requires from/to time range, PromQL query)
+- search: Find metrics by name (grep-like, NO time param needed)
+- list: Get recently active metrics (last 24h, optionally filter by tag)
+- metadata: Get metric details (unit, type, description)
+
+APM METRICS (auto-generated from traces):
+- trace.{service}.hits - Request count
+- trace.{service}.errors - Error count
+- trace.{service}.duration - Latency (use avg:, p95:, max:)
+Example: max:trace.{service}.request.duration{*}`,
+    InputSchema4,
+    async ({ action, query, from, to, metric, limit }) => {
+      try {
+        switch (action) {
+          case "query": {
+            const metricsQuery = requireParam(query, "query", "query");
+            return toolResult(await queryMetrics(metricsV1Api, {
+              query: metricsQuery,
+              from,
+              to
+            }, limits, site));
+          }
+          case "search": {
+            const searchQuery = requireParam(query, "query", "search");
+            return toolResult(await searchMetrics(metricsV1Api, {
+              query: searchQuery,
+              limit
+            }, limits));
+          }
+          case "list":
+            return toolResult(await listMetrics(metricsV1Api, { query }, limits));
+          case "metadata": {
+            const metricName = requireParam(metric, "metric", "metadata");
+            return toolResult(await getMetricMetadata(metricsV1Api, metricName));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/traces.ts
+import { z as z6 } from "zod";
+var ActionSchema5 = z6.enum(["search", "aggregate", "services"]);
+var RESERVED_SPAN_FACETS = /* @__PURE__ */ new Set([
+  "service",
+  "resource_name",
+  "operation_name",
+  "span_name",
+  "status",
+  "env",
+  "host",
+  "type",
+  "duration",
+  "trace_id",
+  "span_id"
+]);
+var InputSchema5 = {
+  action: ActionSchema5.describe("Action to perform"),
+  query: z6.string().optional().describe('APM trace search query (Datadog syntax). Example: "@http.status_code:500", "service:my-service status:error"'),
+  from: z6.string().optional().describe("Start time. Formats: ISO 8601, relative (30s, 15m, 2h, 7d), precise (3d@11:45:23, yesterday@14:00)"),
+  to: z6.string().optional().describe('End time. Same formats as "from". Example: from="3d@11:45" to="3d@12:55"'),
+  service: z6.string().optional().describe('Filter by service name. Example: "my-service", "postgres"'),
+  operation: z6.string().optional().describe('Filter by operation name. Example: "express.request", "mongodb.query"'),
+  resource: z6.string().optional().describe('Filter by resource name (endpoint/query). Supports wildcards. Example: "GET /api/*", "*orders*"'),
+  status: z6.enum(["ok", "error"]).optional().describe('Filter by span status - "ok" for successful, "error" for failed spans'),
+  env: z6.string().optional().describe('Filter by environment. Example: "production", "staging"'),
+  minDuration: z6.string().optional().describe('Minimum span duration (find slow spans). Examples: "1s", "500ms", "100ms"'),
+  maxDuration: z6.string().optional().describe('Maximum span duration. Examples: "5s", "1000ms"'),
+  httpStatus: z6.string().optional().describe('HTTP status code filter. Examples: "500", "5xx" (500-599), "4xx" (400-499), ">=400"'),
+  errorType: z6.string().optional().describe('Filter by error type (grep-like). Example: "TimeoutError", "ConnectionRefused"'),
+  errorMessage: z6.string().optional().describe('Filter by error message (grep-like). Example: "timeout", "connection refused"'),
+  limit: z6.number().optional().describe("Maximum number of results"),
+  sort: z6.enum(["timestamp", "-timestamp"]).optional().describe("Sort order"),
+  groupBy: z6.array(z6.string()).optional().describe('Fields to group by (for aggregate). Example: ["resource_name", "status"]')
+};
+function formatSpan(span) {
+  const attrs = span.attributes ?? {};
+  const tags = attrs.tags ?? [];
+  const nestedAttrs = attrs.attributes ?? {};
+  const custom = attrs.custom ?? {};
+  const tagMap = {};
+  for (const tag of tags) {
+    const [key, value] = tag.split(":");
+    if (key && value) tagMap[key] = value;
+  }
+  let durationNs = 0;
+  if (attrs.startTimestamp && attrs.endTimestamp) {
+    const startMs = attrs.startTimestamp.getTime();
+    const endMs = attrs.endTimestamp.getTime();
+    durationNs = (endMs - startMs) * 1e6;
+  } else if (typeof nestedAttrs["duration"] === "number") {
+    durationNs = nestedAttrs["duration"];
+  } else if (typeof custom["duration"] === "number") {
+    durationNs = custom["duration"];
+  }
+  const status = nestedAttrs["status"] ?? custom["status"] ?? tagMap["status"] ?? "";
+  return {
+    traceId: attrs.traceId ?? "",
+    spanId: attrs.spanId ?? "",
+    service: attrs.service ?? "",
+    resource: attrs.resourceName ?? "",
+    operation: nestedAttrs["operation_name"] ?? custom["operation_name"] ?? "",
+    type: attrs.type ?? "",
+    status,
+    duration: formatDurationNs(durationNs),
+    durationNs,
+    http: {
+      statusCode: tagMap["http.status_code"] ?? "",
+      method: tagMap["http.method"] ?? "",
+      url: tagMap["http.url"] ?? ""
+    },
+    error: {
+      type: tagMap["error.type"] ?? "",
+      message: tagMap["error.message"] ?? tagMap["error.msg"] ?? ""
+    },
+    env: attrs.env ?? tagMap["env"] ?? "",
+    tags
+  };
+}
+function buildTraceQuery(params) {
+  const parts = [];
+  if (params.query) {
+    parts.push(params.query);
+  }
+  if (params.service) {
+    parts.push(`service:${params.service}`);
+  }
+  if (params.operation) {
+    parts.push(`operation_name:${params.operation}`);
+  }
+  if (params.resource) {
+    if (params.resource.includes("*") || params.resource.includes(" ")) {
+      parts.push(`resource_name:${params.resource}`);
+    } else {
+      parts.push(`resource_name:${params.resource}`);
+    }
+  }
+  if (params.status) {
+    parts.push(`status:${params.status}`);
+  }
+  if (params.env) {
+    parts.push(`env:${params.env}`);
+  }
+  if (params.minDuration) {
+    const ns = parseDurationToNs(params.minDuration);
+    if (ns !== void 0) {
+      parts.push(`@duration:>=${ns}`);
+    }
+  }
+  if (params.maxDuration) {
+    const ns = parseDurationToNs(params.maxDuration);
+    if (ns !== void 0) {
+      parts.push(`@duration:<=${ns}`);
+    }
+  }
+  if (params.httpStatus) {
+    const status = params.httpStatus.toLowerCase();
+    if (status.endsWith("xx")) {
+      const base = parseInt(status[0] ?? "0", 10) * 100;
+      parts.push(`@http.status_code:[${base} TO ${base + 99}]`);
+    } else if (status.startsWith(">=")) {
+      parts.push(`@http.status_code:>=${status.slice(2)}`);
+    } else if (status.startsWith(">")) {
+      parts.push(`@http.status_code:>${status.slice(1)}`);
+    } else if (status.startsWith("<=")) {
+      parts.push(`@http.status_code:<=${status.slice(2)}`);
+    } else if (status.startsWith("<")) {
+      parts.push(`@http.status_code:<${status.slice(1)}`);
+    } else {
+      parts.push(`@http.status_code:${params.httpStatus}`);
+    }
+  }
+  if (params.errorType) {
+    const escaped = params.errorType.replace(/"/g, '\\"');
+    parts.push(`error.type:*${escaped}*`);
+  }
+  if (params.errorMessage) {
+    const escaped = params.errorMessage.replace(/"/g, '\\"');
+    parts.push(`error.message:*${escaped}*`);
+  }
+  return parts.length > 0 ? parts.join(" ") : "*";
+}
+async function searchTraces(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const fullQuery = buildTraceQuery({
+    query: params.query,
+    service: params.service,
+    operation: params.operation,
+    resource: params.resource,
+    status: params.status,
+    env: params.env,
+    minDuration: params.minDuration,
+    maxDuration: params.maxDuration,
+    httpStatus: params.httpStatus,
+    errorType: params.errorType,
+    errorMessage: params.errorMessage
+  });
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const body = {
+    data: {
+      type: "search_request",
+      attributes: {
+        filter: {
+          query: fullQuery,
+          from: fromTime,
+          to: toTime
+        },
+        sort: params.sort === "timestamp" ? "timestamp" : "-timestamp",
+        page: {
+          limit: Math.min(params.limit ?? limits.maxResults, limits.maxResults)
+        }
+      }
+    }
+  };
+  const response = await api.listSpans({ body });
+  const spans = (response.data ?? []).map(formatSpan);
+  return {
+    spans,
+    meta: {
+      count: spans.length,
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      datadog_url: buildTracesUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function aggregateTraces(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const fullQuery = buildTraceQuery({
+    query: params.query,
+    service: params.service,
+    operation: params.operation,
+    resource: params.resource,
+    status: params.status,
+    env: params.env,
+    minDuration: params.minDuration,
+    maxDuration: params.maxDuration,
+    httpStatus: params.httpStatus,
+    errorType: params.errorType,
+    errorMessage: params.errorMessage
+  });
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const body = {
+    data: {
+      type: "aggregate_request",
+      attributes: {
+        filter: {
+          query: fullQuery,
+          from: fromTime,
+          to: toTime
+        },
+        compute: [{ aggregation: "count", type: "total" }],
+        groupBy: params.groupBy?.map((field) => ({
+          facet: RESERVED_SPAN_FACETS.has(field) || field.startsWith("@") ? field : `@${field}`,
+          limit: 10
+        }))
+      }
+    }
+  };
+  const response = await api.aggregateSpans({ body });
+  return {
+    data: response.data ?? [],
+    meta: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      groupBy: params.groupBy,
+      datadog_url: buildTracesUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function listApmServices(api, params, limits) {
+  const defaultFrom = hoursAgo(24);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const query = params.env ? `env:${params.env}` : "*";
+  const body = {
+    data: {
+      type: "aggregate_request",
+      attributes: {
+        filter: {
+          query,
+          from: fromTime,
+          to: toTime
+        },
+        compute: [{ aggregation: "count", type: "total" }],
+        groupBy: [{
+          facet: "service",
+          limit: limits.maxResults
+        }]
+      }
+    }
+  };
+  const response = await api.aggregateSpans({ body });
+  const buckets = response.data ?? [];
+  const services = buckets.map((bucket) => ({
+    name: bucket.attributes?.by?.["service"] ?? "",
+    spanCount: bucket.attributes?.computes?.["c0"] ?? 0
+  })).filter((s) => s.name !== "");
+  return {
+    services,
+    total: services.length,
+    meta: {
+      query,
+      env: params.env ?? "all",
+      from: fromTime,
+      to: toTime
+    }
+  };
+}
+function registerTracesTool(server, spansApi, _servicesApi, limits, site = "datadoghq.com") {
+  server.tool(
+    "traces",
+    `Analyze APM traces for request flow and latency debugging. Actions: search (find spans), aggregate (group stats), services (list APM services). Key filters: minDuration/maxDuration ("500ms", "2s"), httpStatus ("5xx", ">=400"), status (ok/error), errorMessage (grep).
+APM METRICS: Traces auto-generate metrics in trace.{service}.* namespace. Use metrics tool to query: avg:trace.{service}.request.duration{*}`,
+    InputSchema5,
+    async ({ action, query, from, to, service, operation, resource, status, env, minDuration, maxDuration, httpStatus, errorType, errorMessage, limit, sort, groupBy }) => {
+      try {
+        switch (action) {
+          case "search": {
+            return toolResult(await searchTraces(spansApi, {
+              query,
+              from,
+              to,
+              service,
+              operation,
+              resource,
+              status,
+              env,
+              minDuration,
+              maxDuration,
+              httpStatus,
+              errorType,
+              errorMessage,
+              limit,
+              sort
+            }, limits, site));
+          }
+          case "aggregate": {
+            return toolResult(await aggregateTraces(spansApi, {
+              query,
+              from,
+              to,
+              service,
+              operation,
+              resource,
+              status,
+              env,
+              minDuration,
+              maxDuration,
+              httpStatus,
+              errorType,
+              errorMessage,
+              groupBy
+            }, limits, site));
+          }
+          case "services":
+            return toolResult(await listApmServices(spansApi, { env, from, to }, limits));
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/events.ts
+import { z as z7 } from "zod";
+var ActionSchema6 = z7.enum(["list", "get", "create", "search", "aggregate", "top", "timeseries", "incidents"]);
+var InputSchema6 = {
+  action: ActionSchema6.describe("Action to perform"),
+  id: z7.string().optional().describe("Event ID (for get action)"),
+  query: z7.string().optional().describe("Search query"),
+  from: z7.string().optional().describe('Start time (ISO 8601, relative like "1h", or Unix timestamp)'),
+  to: z7.string().optional().describe('End time (ISO 8601, relative like "1h", or Unix timestamp)'),
+  priority: z7.enum(["normal", "low"]).optional().describe("Event priority"),
+  sources: z7.array(z7.string()).optional().describe("Filter by sources"),
+  tags: z7.array(z7.string()).optional().describe("Filter by tags"),
+  limit: z7.number().optional().describe("Maximum number of events to return"),
+  title: z7.string().optional().describe("Event title (for create)"),
+  text: z7.string().optional().describe("Event text (for create)"),
+  alertType: z7.enum(["error", "warning", "info", "success"]).optional().describe("Alert type (for create)"),
+  groupBy: z7.array(z7.string()).optional().describe("Fields to group by: monitor_name, priority, alert_type, source"),
+  cursor: z7.string().optional().describe("Pagination cursor from previous response"),
+  // Phase 2: Timeseries
+  interval: z7.string().optional().describe("Time bucket interval for timeseries: 1h, 4h, 1d (default: 1h)"),
+  // Phase 2: Incidents deduplication
+  dedupeWindow: z7.string().optional().describe("Deduplication window for incidents: 5m, 15m, 1h (default: 5m)"),
+  // Phase 3: Monitor enrichment
+  enrich: z7.boolean().optional().describe("Enrich events with monitor metadata (slower, adds monitor details)")
+};
+function extractMonitorInfo(title) {
+  const priorityMatch = title.match(/^\[P(\d+)\]\s*/);
+  const priority = priorityMatch ? `P${priorityMatch[1]}` : void 0;
+  const withoutPriority = title.replace(/^\[P\d+\]\s*/, "");
+  const match = withoutPriority.match(
+    /^\[(Triggered|Recovered|Warn|Alert|OK|No Data|Re-Triggered|Renotify)(?:\s+on\s+\{([^}]+)\})?\]\s*(.+)$/i
+  );
+  if (match) {
+    return {
+      status: match[1] ?? "",
+      scope: match[2] ?? "",
+      name: match[3]?.trim() ?? title,
+      priority
+    };
+  }
+  return { status: "", scope: "", name: title, priority };
+}
+function extractTitleFromMessage(message) {
+  if (!message) return "";
+  const content = message.replace(/^%%%\s*\n?/, "").trim();
+  const firstLine = content.split("\n")[0]?.trim() ?? "";
+  return firstLine.replace(/\s+!?\s*$/, "").trim();
+}
+function extractMonitorIdFromMessage(message) {
+  if (!message) return void 0;
+  const match = message.match(/\/monitors\/(\d+)/);
+  if (match && match[1]) {
+    const id = parseInt(match[1], 10);
+    return isNaN(id) ? void 0 : id;
+  }
+  return void 0;
+}
+function buildGroupKey(event, groupBy) {
+  const parts = [];
+  for (const field of groupBy) {
+    switch (field) {
+      case "monitor_name":
+        parts.push(event.monitorInfo?.name ?? event.title);
+        break;
+      case "monitor_id":
+        parts.push(event.monitorId?.toString() ?? "");
+        break;
+      case "priority":
+        parts.push(event.monitorInfo?.priority ?? event.priority);
+        break;
+      case "source":
+        parts.push(event.source);
+        break;
+      case "alert_type":
+        parts.push(event.alertType);
+        break;
+      case "status":
+        parts.push(event.monitorInfo?.status ?? "");
+        break;
+      case "host":
+        parts.push(event.host);
+        break;
+      default: {
+        const tagValue = event.tags.find((t) => t.startsWith(`${field}:`))?.split(":")[1] ?? "";
+        parts.push(tagValue);
+      }
+    }
+  }
+  return parts.join("|");
+}
+function formatEventV1(e) {
+  const event = e;
+  return {
+    id: e.id ?? 0,
+    title: e.title ?? "",
+    text: e.text ?? "",
+    dateHappened: e.dateHappened ? new Date(e.dateHappened * 1e3).toISOString() : "",
+    priority: String(e.priority ?? "normal"),
+    source: event.sourceTypeName ?? "",
+    tags: e.tags ?? [],
+    alertType: String(e.alertType ?? "info"),
+    host: e.host ?? ""
+  };
+}
+function formatEventV2(e) {
+  const attrs = e.attributes ?? {};
+  let timestamp = "";
+  if (attrs.timestamp) {
+    const ts = attrs.timestamp;
+    timestamp = ts instanceof Date ? ts.toISOString() : new Date(String(ts)).toISOString();
+  }
+  const message = attrs.message ?? "";
+  let title = attrs.title ?? "";
+  if (!title && message) {
+    title = extractTitleFromMessage(message);
+  }
+  const monitorInfo = extractMonitorInfo(title);
+  const monitorId = extractMonitorIdFromMessage(message);
+  const tags = attrs.tags ?? [];
+  const sourceTag = tags.find((t) => t.startsWith("source:"));
+  const source = sourceTag?.split(":")[1] ?? "";
+  const alertTypeTag = tags.find((t) => t.startsWith("alert_type:"));
+  const alertType = alertTypeTag?.split(":")[1] ?? "";
+  const hostTag = tags.find((t) => t.startsWith("host:"));
+  const host = hostTag?.split(":")[1] ?? "";
+  const priorityTag = tags.find((t) => t.startsWith("priority:"));
+  const priority = priorityTag?.split(":")[1] ?? "normal";
+  return {
+    id: String(e.id ?? ""),
+    title,
+    message,
+    timestamp,
+    priority,
+    source,
+    tags,
+    alertType,
+    host,
+    monitorId,
+    monitorInfo: monitorInfo.name !== title ? {
+      name: monitorInfo.name,
+      status: monitorInfo.status,
+      scope: monitorInfo.scope,
+      priority: monitorInfo.priority
+    } : void 0
+  };
+}
+async function listEventsV1(api, params, limits) {
+  const effectiveLimit = Math.min(params.limit ?? limits.defaultLimit, limits.maxResults);
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const response = await api.listEvents({
+    start: parseTime(params.from, defaultFrom),
+    end: parseTime(params.to, defaultTo),
+    priority: params.priority === "low" ? "low" : "normal",
+    sources: params.sources?.join(","),
+    tags: params.tags?.join(","),
+    unaggregated: true
+  });
+  let events = response.events ?? [];
+  if (params.query) {
+    const lowerQuery = params.query.toLowerCase();
+    events = events.filter(
+      (e) => e.title?.toLowerCase().includes(lowerQuery) || e.text?.toLowerCase().includes(lowerQuery)
+    );
+  }
+  const result = events.slice(0, effectiveLimit).map(formatEventV1);
+  return {
+    events: result,
+    total: events.length
+  };
+}
+async function getEventV1(api, id) {
+  const eventId = parseInt(id, 10);
+  if (isNaN(eventId)) {
+    throw new Error(`Invalid event ID: ${id}`);
+  }
+  const response = await api.getEvent({ eventId });
+  return { event: formatEventV1(response.event ?? {}) };
+}
+async function createEventV1(api, params) {
+  const body = {
+    title: params.title,
+    text: params.text,
+    priority: params.priority === "low" ? "low" : "normal",
+    tags: params.tags,
+    alertType: params.alertType ?? "info"
+  };
+  const response = await api.createEvent({ body });
+  return {
+    success: true,
+    event: {
+      id: response.event?.id ?? 0,
+      title: response.event?.title ?? "",
+      status: response.status ?? ""
+    }
+  };
+}
+function buildEventQuery(params) {
+  const parts = [];
+  if (params.query) {
+    parts.push(params.query);
+  }
+  if (params.sources && params.sources.length > 0) {
+    const sourceFilter = params.sources.map((s) => `source:${s}`).join(" OR ");
+    parts.push(`(${sourceFilter})`);
+  }
+  if (params.tags && params.tags.length > 0) {
+    for (const tag of params.tags) {
+      parts.push(tag);
+    }
+  }
+  if (params.priority) {
+    parts.push(`priority:${params.priority}`);
+  }
+  return parts.length > 0 ? parts.join(" ") : "*";
+}
+async function searchEventsV2(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const fullQuery = buildEventQuery({
+    query: params.query,
+    sources: params.sources,
+    tags: params.tags,
+    priority: params.priority
+  });
+  const effectiveLimit = Math.min(params.limit ?? limits.defaultLimit, limits.maxResults);
+  const body = {
+    filter: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime
+    },
+    sort: "timestamp",
+    page: {
+      limit: effectiveLimit,
+      cursor: params.cursor
+    }
+  };
+  const response = await api.searchEvents({ body });
+  const events = (response.data ?? []).map(formatEventV2);
+  const nextCursor = response.meta?.page?.after;
+  return {
+    events,
+    meta: {
+      count: events.length,
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      nextCursor,
+      datadog_url: buildEventsUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function aggregateEventsV2(api, params, limits, site) {
+  const counts = /* @__PURE__ */ new Map();
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const fullQuery = buildEventQuery({
+    query: params.query,
+    sources: params.sources,
+    tags: params.tags
+  });
+  const groupByFields = params.groupBy ?? ["monitor_name"];
+  const maxEventsToAggregate = 1e4;
+  let eventCount = 0;
+  let pageCount = 0;
+  const maxPages = 100;
+  const body = {
+    filter: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime
+    },
+    sort: "timestamp",
+    page: {
+      limit: 1e3
+      // Max per page
+    }
+  };
+  let cursor;
+  while (pageCount < maxPages && eventCount < maxEventsToAggregate) {
+    const pageBody = { ...body, page: { ...body.page, cursor } };
+    const response = await api.searchEvents({ body: pageBody });
+    const events = response.data ?? [];
+    if (events.length === 0) break;
+    for (const event of events) {
+      const formatted = formatEventV2(event);
+      const groupKey = buildGroupKey(formatted, groupByFields);
+      const existing = counts.get(groupKey);
+      if (existing) {
+        existing.count++;
+      } else {
+        counts.set(groupKey, { count: 1, sample: formatted });
+      }
+      eventCount++;
+      if (eventCount >= maxEventsToAggregate) break;
+    }
+    cursor = response.meta?.page?.after;
+    if (!cursor) break;
+    pageCount++;
+  }
+  const effectiveLimit = Math.min(params.limit ?? 100, 1e3);
+  const sorted = [...counts.entries()].sort((a, b) => b[1].count - a[1].count).slice(0, effectiveLimit);
+  const buckets = sorted.map(([key, data]) => ({
+    key,
+    count: data.count,
+    sample: data.sample
+  }));
+  return {
+    buckets,
+    meta: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      groupBy: groupByFields,
+      totalGroups: counts.size,
+      totalEvents: eventCount,
+      truncated: eventCount >= maxEventsToAggregate,
+      datadog_url: buildEventsUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function topEventsV2(api, params, limits, site) {
+  const effectiveQuery = params.query ?? "source:alert";
+  const effectiveTags = params.tags ?? ["source:alert"];
+  const result = await aggregateEventsV2(api, {
+    ...params,
+    query: effectiveQuery,
+    tags: effectiveTags,
+    groupBy: params.groupBy ?? ["monitor_name"],
+    limit: params.limit ?? 10
+  }, limits, site);
+  return {
+    top: result.buckets.map((bucket, index) => ({
+      rank: index + 1,
+      name: bucket.key,
+      monitorId: bucket.sample.monitorId,
+      alertCount: bucket.count,
+      lastAlert: bucket.sample.timestamp,
+      sample: {
+        title: bucket.sample.title,
+        source: bucket.sample.source,
+        alertType: bucket.sample.alertType
+      }
+    })),
+    meta: result.meta
+  };
+}
+function parseIntervalToMs(interval) {
+  const ns = parseDurationToNs(interval ?? "1h");
+  return ns ? Math.floor(ns / 1e6) : 36e5;
+}
+async function timeseriesEventsV2(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const fullQuery = buildEventQuery({
+    query: params.query ?? "source:alert",
+    sources: params.sources,
+    tags: params.tags ?? ["source:alert"]
+  });
+  const intervalMs = parseIntervalToMs(params.interval);
+  const groupByFields = params.groupBy ?? ["monitor_name"];
+  const timeBuckets = /* @__PURE__ */ new Map();
+  const maxEventsToProcess = 1e4;
+  let eventCount = 0;
+  let pageCount = 0;
+  const maxPages = 100;
+  const body = {
+    filter: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime
+    },
+    sort: "timestamp",
+    page: { limit: 1e3 }
+  };
+  let cursor;
+  while (pageCount < maxPages && eventCount < maxEventsToProcess) {
+    const pageBody = { ...body, page: { ...body.page, cursor } };
+    const response = await api.searchEvents({ body: pageBody });
+    const events = response.data ?? [];
+    if (events.length === 0) break;
+    for (const event of events) {
+      const formatted = formatEventV2(event);
+      const groupKey = buildGroupKey(formatted, groupByFields);
+      const eventTs = new Date(formatted.timestamp).getTime();
+      const bucketTs = Math.floor(eventTs / intervalMs) * intervalMs;
+      if (!timeBuckets.has(bucketTs)) {
+        timeBuckets.set(bucketTs, /* @__PURE__ */ new Map());
+      }
+      const groupCounts = timeBuckets.get(bucketTs);
+      groupCounts.set(groupKey, (groupCounts.get(groupKey) ?? 0) + 1);
+      eventCount++;
+      if (eventCount >= maxEventsToProcess) break;
+    }
+    cursor = response.meta?.page?.after;
+    if (!cursor) break;
+    pageCount++;
+  }
+  const sortedBuckets = [...timeBuckets.entries()].sort((a, b) => a[0] - b[0]).map(([bucketTs, groupCounts]) => {
+    const counts = {};
+    let total = 0;
+    for (const [key, count] of groupCounts) {
+      counts[key] = count;
+      total += count;
+    }
+    return {
+      timestamp: new Date(bucketTs).toISOString(),
+      timestampMs: bucketTs,
+      counts,
+      total
+    };
+  });
+  const effectiveLimit = params.limit ?? 100;
+  const limitedBuckets = sortedBuckets.slice(0, effectiveLimit);
+  return {
+    timeseries: limitedBuckets,
+    meta: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      interval: params.interval ?? "1h",
+      intervalMs,
+      groupBy: groupByFields,
+      totalBuckets: sortedBuckets.length,
+      totalEvents: eventCount,
+      truncated: eventCount >= maxEventsToProcess,
+      datadog_url: buildEventsUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function incidentsEventsV2(api, params, limits, site) {
+  const defaultFrom = hoursAgo(limits.defaultTimeRangeHours);
+  const defaultTo = now();
+  const [validFrom, validTo] = ensureValidTimeRange(
+    parseTime(params.from, defaultFrom),
+    parseTime(params.to, defaultTo)
+  );
+  const fromTime = new Date(validFrom * 1e3).toISOString();
+  const toTime = new Date(validTo * 1e3).toISOString();
+  const fullQuery = buildEventQuery({
+    query: params.query ?? "source:alert",
+    sources: params.sources,
+    tags: params.tags ?? ["source:alert"]
+  });
+  const dedupeWindowNs = parseDurationToNs(params.dedupeWindow ?? "5m");
+  const dedupeWindowMs = dedupeWindowNs ? Math.floor(dedupeWindowNs / 1e6) : 3e5;
+  const incidents = /* @__PURE__ */ new Map();
+  const maxEventsToProcess = 1e4;
+  let eventCount = 0;
+  let pageCount = 0;
+  const maxPages = 100;
+  const body = {
+    filter: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime
+    },
+    sort: "timestamp",
+    page: { limit: 1e3 }
+  };
+  let cursor;
+  while (pageCount < maxPages && eventCount < maxEventsToProcess) {
+    const pageBody = { ...body, page: { ...body.page, cursor } };
+    const response = await api.searchEvents({ body: pageBody });
+    const events = response.data ?? [];
+    if (events.length === 0) break;
+    for (const event of events) {
+      const formatted = formatEventV2(event);
+      const monitorName = formatted.monitorInfo?.name ?? formatted.title;
+      if (!monitorName) {
+        eventCount++;
+        continue;
+      }
+      const eventTs = new Date(formatted.timestamp);
+      let status = formatted.monitorInfo?.status?.toLowerCase() ?? "";
+      if (!status && formatted.alertType) {
+        const alertType = formatted.alertType.toLowerCase();
+        if (alertType === "error" || alertType === "warning") {
+          status = "triggered";
+        } else if (alertType === "success") {
+          status = "recovered";
+        }
+      }
+      if (!status && formatted.source === "alert") {
+        const msgLower = formatted.message.toLowerCase();
+        if (msgLower.includes("recovered") || msgLower.includes("[ok]") || msgLower.includes("resolved")) {
+          status = "recovered";
+        } else {
+          status = "triggered";
+        }
+      }
+      const existing = incidents.get(monitorName);
+      if (status === "triggered" || status === "alert" || status === "re-triggered" || status === "renotify") {
+        if (existing) {
+          const timeSinceLastTrigger = eventTs.getTime() - existing.lastTrigger.getTime();
+          if (timeSinceLastTrigger <= dedupeWindowMs) {
+            existing.lastTrigger = eventTs;
+            existing.triggerCount++;
+            existing.sample = formatted;
+          } else {
+            const oldKey = `${monitorName}::${existing.firstTrigger.toISOString()}`;
+            incidents.set(oldKey, existing);
+            incidents.set(monitorName, {
+              monitorName,
+              firstTrigger: eventTs,
+              lastTrigger: eventTs,
+              triggerCount: 1,
+              recovered: false,
+              sample: formatted
+            });
+          }
+        } else {
+          incidents.set(monitorName, {
+            monitorName,
+            firstTrigger: eventTs,
+            lastTrigger: eventTs,
+            triggerCount: 1,
+            recovered: false,
+            sample: formatted
+          });
+        }
+      } else if (status === "recovered" || status === "ok") {
+        if (existing && !existing.recovered) {
+          existing.recovered = true;
+          existing.recoveredAt = eventTs;
+        }
+      }
+      eventCount++;
+      if (eventCount >= maxEventsToProcess) break;
+    }
+    cursor = response.meta?.page?.after;
+    if (!cursor) break;
+    pageCount++;
+  }
+  const incidentList = [...incidents.values()].map((inc) => {
+    let duration;
+    if (inc.recoveredAt) {
+      const durationMs = inc.recoveredAt.getTime() - inc.firstTrigger.getTime();
+      if (durationMs < 6e4) {
+        duration = `${Math.round(durationMs / 1e3)}s`;
+      } else if (durationMs < 36e5) {
+        duration = `${Math.round(durationMs / 6e4)}m`;
+      } else {
+        duration = `${(durationMs / 36e5).toFixed(1)}h`;
+      }
+    }
+    return {
+      monitorName: inc.monitorName,
+      firstTrigger: inc.firstTrigger.toISOString(),
+      lastTrigger: inc.lastTrigger.toISOString(),
+      triggerCount: inc.triggerCount,
+      recovered: inc.recovered,
+      recoveredAt: inc.recoveredAt?.toISOString(),
+      duration,
+      sample: inc.sample
+    };
+  });
+  incidentList.sort((a, b) => new Date(b.firstTrigger).getTime() - new Date(a.firstTrigger).getTime());
+  const effectiveLimit = Math.min(params.limit ?? 100, 500);
+  return {
+    incidents: incidentList.slice(0, effectiveLimit),
+    meta: {
+      query: fullQuery,
+      from: fromTime,
+      to: toTime,
+      dedupeWindow: params.dedupeWindow ?? "5m",
+      dedupeWindowMs,
+      totalIncidents: incidentList.length,
+      totalEvents: eventCount,
+      recoveredCount: incidentList.filter((i) => i.recovered).length,
+      activeCount: incidentList.filter((i) => !i.recovered).length,
+      truncated: eventCount >= maxEventsToProcess,
+      datadog_url: buildEventsUrl(fullQuery, validFrom, validTo, site)
+    }
+  };
+}
+async function enrichWithMonitorMetadata(events, monitorsApi) {
+  const monitorNames = /* @__PURE__ */ new Set();
+  for (const event of events) {
+    if (event.monitorInfo?.name) {
+      monitorNames.add(event.monitorInfo.name);
+    }
+  }
+  if (monitorNames.size === 0) {
+    return events;
+  }
+  const monitorCache = /* @__PURE__ */ new Map();
+  try {
+    const response = await monitorsApi.listMonitors({
+      pageSize: 1e3
+    });
+    const monitors = response ?? [];
+    for (const monitor of monitors) {
+      if (monitor.name) {
+        monitorCache.set(monitor.name, monitor);
+      }
+    }
+  } catch {
+    return events;
+  }
+  return events.map((event) => {
+    const enriched = { ...event };
+    if (event.monitorInfo?.name) {
+      const monitor = monitorCache.get(event.monitorInfo.name);
+      if (monitor) {
+        enriched.monitorMetadata = {
+          id: monitor.id ?? 0,
+          type: String(monitor.type ?? ""),
+          message: monitor.message ?? "",
+          tags: monitor.tags ?? [],
+          options: {
+            thresholds: monitor.options?.thresholds,
+            notifyNoData: monitor.options?.notifyNoData,
+            escalationMessage: monitor.options?.escalationMessage
+          }
+        };
+      }
+    }
+    return enriched;
+  });
+}
+function registerEventsTool(server, apiV1, apiV2, monitorsApi, limits, readOnly = false, site = "datadoghq.com") {
+  server.tool(
+    "events",
+    `Track Datadog events. Actions: list, get, create, search, aggregate, top, timeseries, incidents.
+IMPORTANT: For monitor alert history, use tags: ["source:alert"] to find all triggered monitors.
+Filters: query (text search), sources, tags, priority, time range.
+Use for: monitor alerts, deployments, incidents, change tracking.
+
+Use action:"top" with from:"7d" to find the noisiest monitors.
+Use action:"aggregate" with groupBy:["monitor_name"] for alert counts per monitor.
+Use action:"timeseries" with interval:"1h" to see alert trends over time.
+Use action:"incidents" with dedupeWindow:"5m" to deduplicate alerts into incidents.
+Use enrich:true with search to get monitor metadata (slower).`,
+    InputSchema6,
+    async ({ action, id, query, from, to, priority, sources, tags, limit, title, text, alertType, groupBy, cursor, interval, dedupeWindow, enrich }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listEventsV1(apiV1, {
+              query,
+              from,
+              to,
+              priority,
+              sources,
+              tags,
+              limit
+            }, limits));
+          case "get": {
+            const eventId = requireParam(id, "id", "get");
+            return toolResult(await getEventV1(apiV1, eventId));
+          }
+          case "create": {
+            const eventTitle = requireParam(title, "title", "create");
+            const eventText = requireParam(text, "text", "create");
+            return toolResult(await createEventV1(apiV1, {
+              title: eventTitle,
+              text: eventText,
+              priority,
+              tags,
+              alertType
+            }));
+          }
+          case "search": {
+            const result = await searchEventsV2(apiV2, {
+              query,
+              from,
+              to,
+              sources,
+              tags,
+              priority,
+              limit,
+              cursor
+            }, limits, site);
+            if (enrich && result.events.length > 0) {
+              const enrichedEvents = await enrichWithMonitorMetadata(result.events, monitorsApi);
+              return toolResult({ ...result, events: enrichedEvents });
+            }
+            return toolResult(result);
+          }
+          case "aggregate":
+            return toolResult(await aggregateEventsV2(apiV2, {
+              query,
+              from,
+              to,
+              sources,
+              tags,
+              groupBy,
+              limit
+            }, limits, site));
+          case "top":
+            return toolResult(await topEventsV2(apiV2, {
+              query,
+              from,
+              to,
+              sources,
+              tags,
+              groupBy,
+              limit
+            }, limits, site));
+          case "timeseries":
+            return toolResult(await timeseriesEventsV2(apiV2, {
+              query,
+              from,
+              to,
+              sources,
+              tags,
+              groupBy,
+              interval,
+              limit
+            }, limits, site));
+          case "incidents":
+            return toolResult(await incidentsEventsV2(apiV2, {
+              query,
+              from,
+              to,
+              sources,
+              tags,
+              dedupeWindow,
+              limit
+            }, limits, site));
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/incidents.ts
+import { z as z8 } from "zod";
+var ActionSchema7 = z8.enum(["list", "get", "search", "create", "update", "delete"]);
+var InputSchema7 = {
+  action: ActionSchema7.describe("Action to perform"),
+  id: z8.string().optional().describe("Incident ID (required for get/update/delete)"),
+  query: z8.string().optional().describe("Search query (for search action)"),
+  status: z8.enum(["active", "stable", "resolved"]).optional().describe("Filter by status (for list)"),
+  limit: z8.number().optional().describe("Maximum number of incidents to return"),
+  config: z8.record(z8.unknown()).optional().describe("Incident configuration (for create/update). Create requires: title. Update can modify: title, status, severity, fields.")
+};
+function formatIncident(i) {
+  const attrs = i.attributes;
+  const commander = i.relationships?.commanderUser?.data;
+  return {
+    id: i.id ?? "",
+    title: attrs?.title ?? "",
+    status: String(attrs?.state ?? "unknown"),
+    severity: attrs?.severity ? String(attrs.severity) : null,
+    state: attrs?.state ? String(attrs.state) : null,
+    customerImpactScope: attrs?.customerImpactScope ?? null,
+    customerImpacted: attrs?.customerImpacted ?? false,
+    commander: {
+      name: null,
+      // Would need to resolve from relationships
+      email: null,
+      handle: commander?.id ?? null
+    },
+    createdAt: attrs?.created ? new Date(attrs.created).toISOString() : "",
+    modifiedAt: attrs?.modified ? new Date(attrs.modified).toISOString() : "",
+    resolvedAt: attrs?.resolved ? new Date(attrs.resolved).toISOString() : null,
+    timeToDetect: attrs?.timeToDetect ?? null,
+    timeToRepair: attrs?.timeToRepair ?? null
+  };
+}
+async function listIncidents(api, params, limits) {
+  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const response = await api.listIncidents({
+    pageSize: effectiveLimit
+  });
+  let incidents = (response.data ?? []).map(formatIncident);
+  if (params.status) {
+    incidents = incidents.filter((i) => i.state?.toLowerCase() === params.status);
+  }
+  incidents = incidents.slice(0, effectiveLimit);
+  return {
+    incidents,
+    total: incidents.length
+  };
+}
+async function getIncident(api, id) {
+  const response = await api.getIncident({ incidentId: id });
+  return {
+    incident: response.data ? formatIncident(response.data) : null
+  };
+}
+async function searchIncidents(api, query, limits) {
+  const response = await api.searchIncidents({
+    query,
+    pageSize: limits.maxResults
+  });
+  const incidents = (response.data?.attributes?.incidents ?? []).map((i) => ({
+    id: i.data?.id ?? "",
+    title: i.data?.attributes?.title ?? "",
+    state: i.data?.attributes?.state ?? "unknown"
+  }));
+  return {
+    incidents,
+    total: response.data?.attributes?.total ?? incidents.length
+  };
+}
+async function createIncident(api, config) {
+  const body = {
+    data: {
+      type: "incidents",
+      attributes: config
+    }
+  };
+  const response = await api.createIncident({ body });
+  return {
+    success: true,
+    incident: response.data ? formatIncident(response.data) : null
+  };
+}
+async function updateIncident(api, id, config) {
+  const body = {
+    data: {
+      type: "incidents",
+      id,
+      attributes: config
+    }
+  };
+  const response = await api.updateIncident({ incidentId: id, body });
+  return {
+    success: true,
+    incident: response.data ? formatIncident(response.data) : null
+  };
+}
+async function deleteIncident(api, id) {
+  await api.deleteIncident({ incidentId: id });
+  return {
+    success: true,
+    message: `Incident ${id} deleted`
+  };
+}
+function registerIncidentsTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "incidents",
+    "Manage Datadog incidents for incident response. Actions: list, get, search, create, update, delete. Use for: incident management, on-call response, postmortems, tracking MTTR/MTTD.",
+    InputSchema7,
+    async ({ action, id, query, status, limit, config }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listIncidents(api, { status, limit }, limits));
+          case "get": {
+            const incidentId = requireParam(id, "id", "get");
+            return toolResult(await getIncident(api, incidentId));
+          }
+          case "search": {
+            const searchQuery = requireParam(query, "query", "search");
+            return toolResult(await searchIncidents(api, searchQuery, limits));
+          }
+          case "create": {
+            const incidentConfig = requireParam(config, "config", "create");
+            return toolResult(await createIncident(api, incidentConfig));
+          }
+          case "update": {
+            const incidentId = requireParam(id, "id", "update");
+            const incidentConfig = requireParam(config, "config", "update");
+            return toolResult(await updateIncident(api, incidentId, incidentConfig));
+          }
+          case "delete": {
+            const incidentId = requireParam(id, "id", "delete");
+            return toolResult(await deleteIncident(api, incidentId));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/slos.ts
+import { z as z9 } from "zod";
+var ActionSchema8 = z9.enum(["list", "get", "create", "update", "delete", "history"]);
+var InputSchema8 = {
+  action: ActionSchema8.describe("Action to perform"),
+  id: z9.string().optional().describe("SLO ID (required for get/update/delete/history)"),
+  ids: z9.array(z9.string()).optional().describe("Multiple SLO IDs (for list with specific IDs)"),
+  query: z9.string().optional().describe("Search query (for list)"),
+  tags: z9.array(z9.string()).optional().describe("Filter by tags (for list)"),
+  limit: z9.number().optional().describe("Maximum number of SLOs to return"),
+  config: z9.record(z9.unknown()).optional().describe("SLO configuration (for create/update). Must include type, name, thresholds."),
+  from: z9.string().optional().describe('Start time for history (ISO 8601 or relative like "7d", "1w")'),
+  to: z9.string().optional().describe("End time for history (ISO 8601 or relative, default: now)")
+};
+function formatSlo(s) {
+  const primaryThreshold = s.thresholds?.[0];
+  return {
+    id: s.id ?? "",
+    name: s.name ?? "",
+    description: s.description ?? null,
+    type: String(s.type ?? "unknown"),
+    targetThreshold: primaryThreshold?.target ?? 0,
+    warningThreshold: primaryThreshold?.warning ?? null,
+    timeframe: String(primaryThreshold?.timeframe ?? ""),
+    tags: s.tags ?? [],
+    status: {
+      // Note: SLI status requires a separate API call to getSLOHistory
+      sli: null,
+      errorBudgetRemaining: null,
+      state: "unknown"
+    },
+    createdAt: s.createdAt ? new Date(s.createdAt * 1e3).toISOString() : "",
+    modifiedAt: s.modifiedAt ? new Date(s.modifiedAt * 1e3).toISOString() : ""
+  };
+}
+async function listSlos(api, params, limits) {
+  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const response = await api.listSLOs({
+    ids: params.ids?.join(","),
+    query: params.query,
+    tagsQuery: params.tags?.join(","),
+    limit: effectiveLimit
+  });
+  const slos = (response.data ?? []).map(formatSlo);
+  return {
+    slos,
+    total: response.data?.length ?? 0
+  };
+}
+async function getSlo(api, id) {
+  const response = await api.getSLO({ sloId: id });
+  return {
+    slo: response.data ? formatSlo(response.data) : null
+  };
+}
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+function normalizeConfigKeys(obj) {
+  if (obj === null || obj === void 0) return obj;
+  if (Array.isArray(obj)) return obj.map(normalizeConfigKeys);
+  if (typeof obj !== "object") return obj;
+  const normalized = {};
+  for (const [key, value] of Object.entries(obj)) {
+    const camelKey = snakeToCamel(key);
+    normalized[camelKey] = normalizeConfigKeys(value);
+  }
+  return normalized;
+}
+function normalizeSloConfig(config) {
+  const normalized = normalizeConfigKeys(config);
+  if (!normalized.name) {
+    throw new Error("SLO config requires 'name' field");
+  }
+  if (!normalized.type) {
+    throw new Error("SLO config requires 'type' field (e.g., 'metric', 'monitor')");
+  }
+  if (!normalized.thresholds || !Array.isArray(normalized.thresholds)) {
+    throw new Error("SLO config requires 'thresholds' array with at least one threshold");
+  }
+  return normalized;
+}
+async function createSlo(api, config) {
+  const body = normalizeSloConfig(config);
+  const response = await api.createSLO({ body });
+  return {
+    success: true,
+    slo: response.data?.[0] ? formatSlo(response.data[0]) : null
+  };
+}
+async function updateSlo(api, id, config) {
+  const body = normalizeConfigKeys(config);
+  const response = await api.updateSLO({ sloId: id, body });
+  return {
+    success: true,
+    slo: response.data?.[0] ? formatSlo(response.data[0]) : null
+  };
+}
+async function deleteSlo(api, id) {
+  await api.deleteSLO({ sloId: id });
+  return {
+    success: true,
+    message: `SLO ${id} deleted`
+  };
+}
+async function getSloHistory(api, id, params) {
+  const nowMs = Date.now();
+  const defaultFromMs = nowMs - 7 * 24 * 60 * 60 * 1e3;
+  const fromTime = parseTime(params.from, Math.floor(defaultFromMs / 1e3)) * 1e3;
+  const toTime = parseTime(params.to, Math.floor(nowMs / 1e3)) * 1e3;
+  const [validFrom, validTo] = ensureValidTimeRange(fromTime, toTime);
+  const response = await api.getSLOHistory({
+    sloId: id,
+    fromTs: Math.floor(validFrom / 1e3),
+    toTs: Math.floor(validTo / 1e3)
+  });
+  const data = response.data;
+  return {
+    history: {
+      overall: {
+        sliValue: data?.overall?.sliValue ?? null,
+        spanPrecision: data?.overall?.spanPrecision ?? null,
+        uptime: data?.overall?.uptime ?? null
+      },
+      series: {
+        numerator: data?.series?.numerator?.values ?? [],
+        denominator: data?.series?.denominator?.values ?? [],
+        times: data?.series?.times ?? []
+      },
+      thresholds: data?.thresholds ?? {},
+      fromTs: new Date(validFrom).toISOString(),
+      toTs: new Date(validTo).toISOString()
+    }
+  };
+}
+function registerSlosTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "slos",
+    "Manage Datadog Service Level Objectives. Actions: list, get, create, update, delete, history. SLO types: metric-based, monitor-based. Use for: reliability tracking, error budgets, SLA compliance, performance targets.",
+    InputSchema8,
+    async ({ action, id, ids, query, tags, limit, config, from, to }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listSlos(api, { ids, query, tags, limit }, limits));
+          case "get": {
+            const sloId = requireParam(id, "id", "get");
+            return toolResult(await getSlo(api, sloId));
+          }
+          case "create": {
+            const sloConfig = requireParam(config, "config", "create");
+            return toolResult(await createSlo(api, sloConfig));
+          }
+          case "update": {
+            const sloId = requireParam(id, "id", "update");
+            const sloConfig = requireParam(config, "config", "update");
+            return toolResult(await updateSlo(api, sloId, sloConfig));
+          }
+          case "delete": {
+            const sloId = requireParam(id, "id", "delete");
+            return toolResult(await deleteSlo(api, sloId));
+          }
+          case "history": {
+            const sloId = requireParam(id, "id", "history");
+            return toolResult(await getSloHistory(api, sloId, { from, to }));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/synthetics.ts
+import { z as z10 } from "zod";
+var ActionSchema9 = z10.enum(["list", "get", "create", "update", "delete", "trigger", "results"]);
+var InputSchema9 = {
+  action: ActionSchema9.describe("Action to perform"),
+  id: z10.string().optional().describe("Test public ID (required for get/update/delete/trigger/results)"),
+  ids: z10.array(z10.string()).optional().describe("Multiple test IDs (for bulk trigger)"),
+  testType: z10.enum(["api", "browser"]).optional().describe("Test type filter (for list) or type for create"),
+  locations: z10.array(z10.string()).optional().describe("Filter by locations (for list)"),
+  tags: z10.array(z10.string()).optional().describe("Filter by tags (for list)"),
+  limit: z10.number().optional().describe("Maximum number of tests to return"),
+  config: z10.record(z10.unknown()).optional().describe("Test configuration (for create/update). Includes: name, type, config, options, locations, message.")
+};
+function formatTest(t) {
+  return {
+    publicId: t.publicId ?? "",
+    name: t.name ?? "",
+    type: String(t.type ?? "unknown"),
+    subtype: t.subtype ? String(t.subtype) : null,
+    status: String(t.status ?? "unknown"),
+    message: t.message ?? "",
+    tags: t.tags ?? [],
+    locations: t.locations ?? [],
+    monitorId: t.monitorId ?? null
+  };
+}
+async function listTests(api, params, limits) {
+  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const response = await api.listTests({
+    pageSize: effectiveLimit
+  });
+  let tests = (response.tests ?? []).map(formatTest);
+  if (params.tags && params.tags.length > 0) {
+    tests = tests.filter((t) => params.tags.some((tag) => t.tags.includes(tag)));
+  }
+  if (params.locations && params.locations.length > 0) {
+    tests = tests.filter((t) => params.locations.some((loc) => t.locations.includes(loc)));
+  }
+  tests = tests.slice(0, effectiveLimit);
+  const summary = {
+    total: response.tests?.length ?? 0,
+    api: tests.filter((t) => t.type === "api").length,
+    browser: tests.filter((t) => t.type === "browser").length,
+    passing: tests.filter((t) => t.status === "OK" || t.status === "live").length,
+    failing: tests.filter((t) => t.status === "Alert").length
+  };
+  return { tests, summary };
+}
+async function getTest(api, id) {
+  try {
+    const response = await api.getAPITest({ publicId: id });
+    return { test: formatTest(response) };
+  } catch {
+    const response = await api.getBrowserTest({ publicId: id });
+    return { test: formatTest(response) };
+  }
+}
+function snakeToCamel2(str) {
+  return str.replace(/_([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+function normalizeConfigKeys2(obj) {
+  if (obj === null || obj === void 0) return obj;
+  if (Array.isArray(obj)) return obj.map(normalizeConfigKeys2);
+  if (typeof obj !== "object") return obj;
+  const normalized = {};
+  for (const [key, value] of Object.entries(obj)) {
+    const camelKey = snakeToCamel2(key);
+    normalized[camelKey] = normalizeConfigKeys2(value);
+  }
+  return normalized;
+}
+function normalizeSyntheticsConfig(config) {
+  const normalized = normalizeConfigKeys2(config);
+  if (!normalized.name) {
+    throw new Error("Synthetics test config requires 'name' field");
+  }
+  if (!normalized.locations || !Array.isArray(normalized.locations) || normalized.locations.length === 0) {
+    throw new Error("Synthetics test config requires 'locations' array (e.g., ['aws:us-east-1'])");
+  }
+  return normalized;
+}
+async function createTest(api, config, testType) {
+  const normalizedConfig = normalizeSyntheticsConfig(config);
+  const type = testType ?? (normalizedConfig.type === "browser" ? "browser" : "api");
+  if (type === "browser") {
+    const body = normalizedConfig;
+    const response = await api.createSyntheticsBrowserTest({ body });
+    return {
+      success: true,
+      test: formatTest(response)
+    };
+  } else {
+    const body = normalizedConfig;
+    const response = await api.createSyntheticsAPITest({ body });
+    return {
+      success: true,
+      test: formatTest(response)
+    };
+  }
+}
+async function updateTest(api, id, config) {
+  const normalizedConfig = normalizeConfigKeys2(config);
+  let testType = "api";
+  try {
+    await api.getAPITest({ publicId: id });
+    testType = "api";
+  } catch {
+    testType = "browser";
+  }
+  if (testType === "browser") {
+    const body = normalizedConfig;
+    const response = await api.updateBrowserTest({ publicId: id, body });
+    return {
+      success: true,
+      test: formatTest(response)
+    };
+  } else {
+    const body = normalizedConfig;
+    const response = await api.updateAPITest({ publicId: id, body });
+    return {
+      success: true,
+      test: formatTest(response)
+    };
+  }
+}
+async function deleteTests(api, ids) {
+  await api.deleteTests({
+    body: { publicIds: ids }
+  });
+  return {
+    success: true,
+    message: `Deleted ${ids.length} test(s): ${ids.join(", ")}`
+  };
+}
+async function triggerTests(api, ids) {
+  const response = await api.triggerTests({
+    body: {
+      tests: ids.map((id) => ({ publicId: id }))
+    }
+  });
+  const results = response.results?.map((r) => ({
+    publicId: r.publicId ?? "",
+    resultId: r.resultId ?? "",
+    triggered: true
+  })) ?? [];
+  return {
+    triggered: results,
+    total: results.length
+  };
+}
+async function getTestResults(api, id) {
+  try {
+    const response = await api.getAPITestLatestResults({ publicId: id });
+    const results = (response.results ?? []).map((r) => ({
+      resultId: r.resultId ?? "",
+      status: r.result?.passed ? "passed" : "failed",
+      checkTime: r.checkTime ? new Date(r.checkTime * 1e3).toISOString() : "",
+      responseTime: r.result?.timings?.total ?? null
+    }));
+    return { results, testType: "api" };
+  } catch {
+    const response = await api.getBrowserTestLatestResults({ publicId: id });
+    const results = (response.results ?? []).map((r) => ({
+      resultId: r.resultId ?? "",
+      // Browser tests don't have 'passed' - determine from errorCount
+      status: (r.result?.errorCount ?? 0) === 0 ? "passed" : "failed",
+      checkTime: r.checkTime ? new Date(r.checkTime * 1e3).toISOString() : "",
+      duration: r.result?.duration ?? null
+    }));
+    return { results, testType: "browser" };
+  }
+}
+function registerSyntheticsTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "synthetics",
+    "Manage Datadog Synthetic tests (API and Browser). Actions: list, get, create, update, delete, trigger, results. Use for: uptime monitoring, API testing, user journey testing, performance testing, canary deployments.",
+    InputSchema9,
+    async ({ action, id, ids, testType, locations, tags, limit, config }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listTests(api, { locations, tags, limit }, limits));
+          case "get": {
+            const testId = requireParam(id, "id", "get");
+            return toolResult(await getTest(api, testId));
+          }
+          case "create": {
+            const testConfig = requireParam(config, "config", "create");
+            return toolResult(await createTest(api, testConfig, testType));
+          }
+          case "update": {
+            const testId = requireParam(id, "id", "update");
+            const testConfig = requireParam(config, "config", "update");
+            return toolResult(await updateTest(api, testId, testConfig));
+          }
+          case "delete": {
+            const testIds = ids ?? (id ? [id] : void 0);
+            const deleteIds = requireParam(testIds, "id or ids", "delete");
+            return toolResult(await deleteTests(api, deleteIds));
+          }
+          case "trigger": {
+            const testIds = ids ?? (id ? [id] : void 0);
+            const triggerIds = requireParam(testIds, "id or ids", "trigger");
+            return toolResult(await triggerTests(api, triggerIds));
+          }
+          case "results": {
+            const testId = requireParam(id, "id", "results");
+            return toolResult(await getTestResults(api, testId));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/hosts.ts
+import { z as z11 } from "zod";
+var ActionSchema10 = z11.enum(["list", "totals", "mute", "unmute"]);
+var InputSchema10 = {
+  action: ActionSchema10.describe("Action to perform"),
+  filter: z11.string().optional().describe('Filter hosts by name, alias, or tag (e.g., "env:prod")'),
+  from: z11.number().optional().describe("Starting offset for pagination"),
+  count: z11.number().optional().describe("Number of hosts to return"),
+  sortField: z11.string().optional().describe('Field to sort by (e.g., "apps", "cpu", "name")'),
+  sortDir: z11.enum(["asc", "desc"]).optional().describe("Sort direction"),
+  hostName: z11.string().optional().describe("Host name (required for mute/unmute)"),
+  message: z11.string().optional().describe("Mute reason message"),
+  end: z11.number().optional().describe("Mute end timestamp (POSIX). Omit for indefinite mute"),
+  override: z11.boolean().optional().describe("If true, replaces existing mute instead of failing")
+};
+function formatHost(h) {
+  return {
+    hostName: h.hostName ?? "",
+    aliases: h.aliases ?? [],
+    apps: h.apps ?? [],
+    sources: h.sources ?? [],
+    up: h.up ?? false,
+    isMuted: h.isMuted ?? false,
+    muteTimeout: h.muteTimeout ?? null,
+    lastReportedTime: h.lastReportedTime ? new Date(h.lastReportedTime * 1e3).toISOString() : "",
+    meta: {
+      cpuCores: h.meta?.cpuCores ?? null,
+      platform: h.meta?.platform ?? null,
+      gohai: h.meta?.gohai ?? null
+    }
+  };
+}
+async function listHosts(api, params, limits) {
+  const response = await api.listHosts({
+    filter: params.filter,
+    from: params.from,
+    count: Math.min(params.count ?? limits.maxResults, limits.maxResults),
+    sortField: params.sortField,
+    sortDir: params.sortDir
+  });
+  const hosts = (response.hostList ?? []).map(formatHost);
+  return {
+    hosts,
+    totalReturned: response.totalReturned ?? hosts.length,
+    totalMatching: response.totalMatching ?? hosts.length
+  };
+}
+async function getHostTotals(api) {
+  const response = await api.getHostTotals({});
+  return {
+    totals: {
+      totalUp: response.totalUp ?? 0,
+      totalActive: response.totalActive ?? 0
+    }
+  };
+}
+async function muteHost(api, hostName, params) {
+  await api.muteHost({
+    hostName,
+    body: {
+      message: params.message,
+      end: params.end,
+      override: params.override
+    }
+  });
+  return {
+    success: true,
+    message: `Host ${hostName} muted${params.end ? ` until ${new Date(params.end * 1e3).toISOString()}` : " indefinitely"}`
+  };
+}
+async function unmuteHost(api, hostName) {
+  await api.unmuteHost({ hostName });
+  return {
+    success: true,
+    message: `Host ${hostName} unmuted`
+  };
+}
+function registerHostsTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "hosts",
+    "Manage Datadog infrastructure hosts. Actions: list (with filters), totals (counts), mute (silence alerts), unmute. Use for: infrastructure inventory, host health, silencing noisy hosts during maintenance.",
+    InputSchema10,
+    async ({ action, filter, from, count, sortField, sortDir, hostName, message, end, override }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listHosts(api, { filter, from, count, sortField, sortDir }, limits));
+          case "totals":
+            return toolResult(await getHostTotals(api));
+          case "mute": {
+            const host = requireParam(hostName, "hostName", "mute");
+            return toolResult(await muteHost(api, host, { message, end, override }));
+          }
+          case "unmute": {
+            const host = requireParam(hostName, "hostName", "unmute");
+            return toolResult(await unmuteHost(api, host));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/downtimes.ts
+import { z as z12 } from "zod";
+var ActionSchema11 = z12.enum(["list", "get", "create", "update", "cancel", "listByMonitor"]);
+var InputSchema11 = {
+  action: ActionSchema11.describe("Action to perform"),
+  id: z12.string().optional().describe("Downtime ID (required for get/update/cancel)"),
+  monitorId: z12.number().optional().describe("Monitor ID (required for listByMonitor)"),
+  currentOnly: z12.boolean().optional().describe("Only return active downtimes (for list)"),
+  limit: z12.number().optional().describe("Maximum number of downtimes to return"),
+  config: z12.record(z12.unknown()).optional().describe("Downtime configuration (for create/update). Must include scope and schedule.")
+};
+function extractMonitorIdentifier(mi) {
+  if (!mi) return { monitorId: null, monitorTags: [] };
+  if ("monitorId" in mi && typeof mi.monitorId === "number") {
+    return { monitorId: mi.monitorId, monitorTags: [] };
+  }
+  if ("monitorTags" in mi && Array.isArray(mi.monitorTags)) {
+    return { monitorId: null, monitorTags: mi.monitorTags };
+  }
+  return { monitorId: null, monitorTags: [] };
+}
+function formatDowntime(d) {
+  const attrs = d.attributes;
+  const status = attrs?.status;
+  return {
+    id: d.id ?? "",
+    displayTimezone: attrs?.displayTimezone ?? "UTC",
+    message: attrs?.message ?? null,
+    monitorIdentifier: extractMonitorIdentifier(attrs?.monitorIdentifier),
+    scope: attrs?.scope ?? "",
+    status: typeof status === "string" ? status : "unknown",
+    schedule: attrs?.schedule ?? null,
+    createdAt: attrs?.created ? new Date(attrs.created).toISOString() : "",
+    modifiedAt: attrs?.modified ? new Date(attrs.modified).toISOString() : ""
+  };
+}
+async function listDowntimes(api, params, limits) {
+  const effectiveLimit = Math.min(params.limit ?? limits.maxResults, limits.maxResults);
+  const response = await api.listDowntimes({
+    currentOnly: params.currentOnly
+  });
+  const downtimes = (response.data ?? []).slice(0, effectiveLimit).map(formatDowntime);
+  return {
+    downtimes,
+    total: response.data?.length ?? 0
+  };
+}
+async function getDowntime(api, id) {
+  const response = await api.getDowntime({ downtimeId: id });
+  return {
+    downtime: response.data ? formatDowntime(response.data) : null
+  };
+}
+async function createDowntime(api, config) {
+  const body = {
+    data: {
+      type: "downtime",
+      attributes: config
+    }
+  };
+  const response = await api.createDowntime({ body });
+  return {
+    success: true,
+    downtime: response.data ? formatDowntime(response.data) : null
+  };
+}
+async function updateDowntime(api, id, config) {
+  const body = {
+    data: {
+      type: "downtime",
+      id,
+      attributes: config
+    }
+  };
+  const response = await api.updateDowntime({ downtimeId: id, body });
+  return {
+    success: true,
+    downtime: response.data ? formatDowntime(response.data) : null
+  };
+}
+async function cancelDowntime(api, id) {
+  await api.cancelDowntime({ downtimeId: id });
+  return {
+    success: true,
+    message: `Downtime ${id} cancelled`
+  };
+}
+function formatMonitorDowntime(d) {
+  const attrs = d.attributes;
+  return {
+    id: d.id ?? "",
+    scope: attrs?.scope ?? null,
+    start: attrs?.start ? new Date(attrs.start).toISOString() : null,
+    end: attrs?.end ? new Date(attrs.end).toISOString() : null
+  };
+}
+async function listMonitorDowntimes(api, monitorId, limits) {
+  const response = await api.listMonitorDowntimes({ monitorId });
+  const downtimes = (response.data ?? []).slice(0, limits.maxResults).map(formatMonitorDowntime);
+  return {
+    downtimes,
+    monitorId,
+    total: response.data?.length ?? 0
+  };
+}
+function registerDowntimesTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "downtimes",
+    "Manage Datadog scheduled downtimes for maintenance windows. Actions: list, get, create, update, cancel, listByMonitor. Use for: scheduling maintenance, preventing false alerts during deployments, managing recurring maintenance windows.",
+    InputSchema11,
+    async ({ action, id, monitorId, currentOnly, limit, config }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listDowntimes(api, { currentOnly, limit }, limits));
+          case "get": {
+            const downtimeId = requireParam(id, "id", "get");
+            return toolResult(await getDowntime(api, downtimeId));
+          }
+          case "create": {
+            const downtimeConfig = requireParam(config, "config", "create");
+            return toolResult(await createDowntime(api, downtimeConfig));
+          }
+          case "update": {
+            const downtimeId = requireParam(id, "id", "update");
+            const downtimeConfig = requireParam(config, "config", "update");
+            return toolResult(await updateDowntime(api, downtimeId, downtimeConfig));
+          }
+          case "cancel": {
+            const downtimeId = requireParam(id, "id", "cancel");
+            return toolResult(await cancelDowntime(api, downtimeId));
+          }
+          case "listByMonitor": {
+            const monitor = requireParam(monitorId, "monitorId", "listByMonitor");
+            return toolResult(await listMonitorDowntimes(api, monitor, limits));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/rum.ts
+import { z as z13 } from "zod";
+var ActionSchema12 = z13.enum(["applications", "events", "aggregate", "performance", "waterfall"]);
+var InputSchema12 = {
+  action: ActionSchema12.describe("Action to perform"),
+  query: z13.string().optional().describe('RUM query string (e.g., "@type:view @application.id:abc")'),
+  from: z13.string().optional().describe('Start time (ISO 8601, relative like "1h", "7d", or precise like "1d@10:00")'),
+  to: z13.string().optional().describe('End time (ISO 8601, relative like "now", or precise timestamp)'),
+  type: z13.enum(["all", "view", "action", "error", "long_task", "resource"]).optional().describe("RUM event type filter"),
+  sort: z13.enum(["timestamp", "-timestamp"]).optional().describe("Sort order for events"),
+  limit: z13.number().optional().describe("Maximum number of events to return"),
+  groupBy: z13.array(z13.string()).optional().describe('Fields to group by for aggregation (e.g., ["@view.url_path", "@session.type"])'),
+  compute: z13.object({
+    aggregation: z13.enum(["count", "cardinality", "avg", "sum", "min", "max", "percentile"]).optional(),
+    metric: z13.string().optional(),
+    interval: z13.string().optional()
+  }).optional().describe("Compute configuration for aggregation"),
+  // Performance action parameters
+  metrics: z13.array(z13.enum(["lcp", "fcp", "cls", "fid", "inp", "loading_time"])).optional().describe("Core Web Vitals metrics to retrieve (default: all). lcp=Largest Contentful Paint, fcp=First Contentful Paint, cls=Cumulative Layout Shift, fid=First Input Delay, inp=Interaction to Next Paint, loading_time=View loading time"),
+  // Waterfall action parameters
+  applicationId: z13.string().optional().describe("Application ID for waterfall action"),
+  sessionId: z13.string().optional().describe("Session ID for waterfall action"),
+  viewId: z13.string().optional().describe("View ID for waterfall action (optional, filters to specific view)")
+};
+function formatApplication(app) {
+  const attrs = app.attributes ?? {};
+  return {
+    id: app.id ?? "",
+    name: attrs.name ?? "",
+    type: String(attrs.type ?? ""),
+    orgId: attrs.orgId ?? 0,
+    hash: attrs.hash ?? null,
+    createdAt: attrs.createdAt ? new Date(attrs.createdAt).toISOString() : "",
+    updatedAt: attrs.updatedAt ? new Date(attrs.updatedAt).toISOString() : ""
+  };
+}
+function formatEvent(event) {
+  const attrs = event.attributes ?? {};
+  const appAttrs = attrs.attributes ?? {};
+  const application = appAttrs["application"] ?? {};
+  const session = appAttrs["session"] ?? {};
+  const view = appAttrs["view"] ?? {};
+  const usr = appAttrs["usr"] ?? {};
+  const action = appAttrs["action"] ?? {};
+  const error = appAttrs["error"] ?? {};
+  const resource = appAttrs["resource"] ?? {};
+  return {
+    id: event.id ?? "",
+    type: String(event.type ?? ""),
+    timestamp: attrs.timestamp?.toISOString() ?? "",
+    attributes: {
+      application: {
+        id: application["id"] ?? null,
+        name: application["name"] ?? null
+      },
+      session: {
+        id: session["id"] ?? null,
+        type: session["type"] ?? null
+      },
+      view: {
+        id: view["id"] ?? null,
+        url: view["url"] ?? null,
+        urlPath: view["url_path"] ?? null,
+        name: view["name"] ?? null
+      },
+      user: {
+        id: usr["id"] ?? null,
+        email: usr["email"] ?? null,
+        name: usr["name"] ?? null
+      },
+      action: action["id"] ? {
+        id: action["id"] ?? null,
+        type: action["type"] ?? null,
+        name: action["name"] ?? null
+      } : void 0,
+      error: error["message"] ? {
+        message: error["message"] ?? null,
+        source: error["source"] ?? null,
+        stack: error["stack"] ?? null
+      } : void 0,
+      resource: resource["url"] ? {
+        url: resource["url"] ?? null,
+        type: resource["type"] ?? null,
+        duration: resource["duration"] ?? null
+      } : void 0
+    }
+  };
+}
+async function listApplications(api) {
+  const response = await api.getRUMApplications();
+  const applications = (response.data ?? []).map(formatApplication);
+  return {
+    applications,
+    totalCount: applications.length
+  };
+}
+async function searchEvents(api, params, limits, site) {
+  let queryString = params.query ?? "*";
+  if (params.type && params.type !== "all") {
+    queryString = `@type:${params.type} ${queryString}`.trim();
+  }
+  const nowMs = Date.now();
+  const defaultFromMs = nowMs - 15 * 60 * 1e3;
+  const fromTime = parseTime(params.from, Math.floor(defaultFromMs / 1e3));
+  const toTime = parseTime(params.to, Math.floor(nowMs / 1e3));
+  const response = await api.listRUMEvents({
+    filterQuery: queryString,
+    filterFrom: new Date(fromTime * 1e3),
+    filterTo: new Date(toTime * 1e3),
+    sort: params.sort === "timestamp" ? "timestamp" : "-timestamp",
+    pageLimit: Math.min(params.limit ?? limits.maxResults, limits.maxResults)
+  });
+  const events = (response.data ?? []).map(formatEvent);
+  return {
+    events,
+    meta: {
+      totalCount: events.length,
+      timeRange: {
+        from: new Date(fromTime * 1e3).toISOString(),
+        to: new Date(toTime * 1e3).toISOString()
+      },
+      datadog_url: buildRumUrl(queryString, fromTime, toTime, site)
+    }
+  };
+}
+async function aggregateEvents(api, params, _limits, site) {
+  const nowMs = Date.now();
+  const defaultFromMs = nowMs - 60 * 60 * 1e3;
+  const fromTime = parseTime(params.from, Math.floor(defaultFromMs / 1e3));
+  const toTime = parseTime(params.to, Math.floor(nowMs / 1e3));
+  const groupByConfigs = (params.groupBy ?? []).map((field) => ({
+    facet: field,
+    limit: 10,
+    sort: {
+      type: "measure",
+      aggregation: "count",
+      order: "desc"
+    }
+  }));
+  const computeConfig = {
+    aggregation: params.compute?.aggregation ?? "count"
+  };
+  if (params.compute?.metric) {
+    computeConfig.metric = params.compute.metric;
+    computeConfig.type = "total";
+  }
+  if (params.compute?.interval) {
+    computeConfig.interval = params.compute.interval;
+    computeConfig.type = "timeseries";
+  }
+  const computeConfigs = [computeConfig];
+  const queryString = params.query ?? "*";
+  const response = await api.aggregateRUMEvents({
+    body: {
+      filter: {
+        query: queryString,
+        from: new Date(fromTime * 1e3).toISOString(),
+        to: new Date(toTime * 1e3).toISOString()
+      },
+      groupBy: groupByConfigs.length > 0 ? groupByConfigs : void 0,
+      compute: computeConfigs
+    }
+  });
+  const buckets = (response.data?.buckets ?? []).map((bucket) => ({
+    by: bucket.by ?? {},
+    computes: bucket.computes ?? {}
+  }));
+  return {
+    buckets,
+    meta: {
+      elapsed: response.meta?.elapsed ?? 0,
+      timeRange: {
+        from: new Date(fromTime * 1e3).toISOString(),
+        to: new Date(toTime * 1e3).toISOString()
+      },
+      datadog_url: buildRumUrl(queryString, fromTime, toTime, site)
+    }
+  };
+}
+var METRIC_CONFIGS = {
+  lcp: {
+    field: "@view.largest_contentful_paint",
+    aggregations: ["avg", "pc75", "pc90"]
+  },
+  fcp: {
+    field: "@view.first_contentful_paint",
+    aggregations: ["avg", "pc75", "pc90"]
+  },
+  cls: {
+    field: "@view.cumulative_layout_shift",
+    aggregations: ["avg", "pc75"]
+  },
+  fid: {
+    field: "@view.first_input_delay",
+    aggregations: ["avg", "pc75", "pc90"]
+  },
+  inp: {
+    field: "@view.interaction_to_next_paint",
+    aggregations: ["avg", "pc75", "pc90"]
+  },
+  loading_time: {
+    field: "@view.loading_time",
+    aggregations: ["avg", "pc75", "pc90"]
+  }
+};
+async function getPerformanceMetrics(api, params, _limits, site) {
+  const nowMs = Date.now();
+  const defaultFromMs = nowMs - 60 * 60 * 1e3;
+  const fromTime = parseTime(params.from, Math.floor(defaultFromMs / 1e3));
+  const toTime = parseTime(params.to, Math.floor(nowMs / 1e3));
+  const requestedMetrics = params.metrics ?? ["lcp", "fcp", "cls"];
+  const computeConfigs = [];
+  for (const metricName of requestedMetrics) {
+    const config = METRIC_CONFIGS[metricName];
+    if (!config) continue;
+    for (const aggregation of config.aggregations) {
+      computeConfigs.push({
+        aggregation,
+        metric: config.field,
+        type: "total"
+      });
+    }
+  }
+  const groupByConfigs = (params.groupBy ?? []).map((field) => ({
+    facet: field,
+    limit: 10,
+    sort: {
+      type: "measure",
+      aggregation: "count",
+      order: "desc"
+    }
+  }));
+  const viewQuery = params.query ? `@type:view ${params.query}` : "@type:view";
+  const response = await api.aggregateRUMEvents({
+    body: {
+      filter: {
+        query: viewQuery,
+        from: new Date(fromTime * 1e3).toISOString(),
+        to: new Date(toTime * 1e3).toISOString()
+      },
+      groupBy: groupByConfigs.length > 0 ? groupByConfigs : void 0,
+      compute: computeConfigs
+    }
+  });
+  const buckets = (response.data?.buckets ?? []).map((bucket) => {
+    const computes = bucket.computes ?? {};
+    const metrics = {};
+    for (const metricName of requestedMetrics) {
+      const config = METRIC_CONFIGS[metricName];
+      if (!config) continue;
+      metrics[metricName] = {};
+      for (const aggregation of config.aggregations) {
+        const computeIndex = computeConfigs.findIndex(
+          (c) => c.metric === config.field && c.aggregation === aggregation
+        );
+        const key = `c${computeIndex}`;
+        const value = computes[key]?.value;
+        metrics[metricName][String(aggregation)] = value ?? null;
+      }
+    }
+    return {
+      by: bucket.by ?? {},
+      metrics
+    };
+  });
+  return {
+    buckets,
+    meta: {
+      metrics: requestedMetrics,
+      timeRange: {
+        from: new Date(fromTime * 1e3).toISOString(),
+        to: new Date(toTime * 1e3).toISOString()
+      },
+      datadog_url: buildRumUrl(viewQuery, fromTime, toTime, site)
+    }
+  };
+}
+function formatWaterfallEvent(event) {
+  const attrs = event.attributes ?? {};
+  const appAttrs = attrs.attributes ?? {};
+  const view = appAttrs["view"] ?? {};
+  const resource = appAttrs["resource"] ?? {};
+  const action = appAttrs["action"] ?? {};
+  const error = appAttrs["error"] ?? {};
+  const longTask = appAttrs["long_task"] ?? {};
+  const eventType = appAttrs["type"] ?? "unknown";
+  return {
+    id: event.id ?? "",
+    type: eventType,
+    timestamp: attrs.timestamp?.toISOString() ?? "",
+    duration: view["loading_time"] ?? resource["duration"] ?? null,
+    view: {
+      id: view["id"] ?? null,
+      url: view["url"] ?? null,
+      name: view["name"] ?? null
+    },
+    resource: resource["url"] ? {
+      url: resource["url"] ?? null,
+      type: resource["type"] ?? null,
+      duration: resource["duration"] ?? null,
+      size: resource["size"] ?? null,
+      statusCode: resource["status_code"] ?? null
+    } : void 0,
+    action: action["id"] ? {
+      id: action["id"] ?? null,
+      type: action["type"] ?? null,
+      name: action["name"] ?? null,
+      target: action["target"] ?? null
+    } : void 0,
+    error: error["message"] ? {
+      message: error["message"] ?? null,
+      source: error["source"] ?? null,
+      type: error["type"] ?? null
+    } : void 0,
+    longTask: longTask["duration"] ? {
+      duration: longTask["duration"] ?? null
+    } : void 0
+  };
+}
+async function getSessionWaterfall(api, params, limits, site) {
+  const queryParts = [
+    `@application.id:${params.applicationId}`,
+    `@session.id:${params.sessionId}`
+  ];
+  if (params.viewId) {
+    queryParts.push(`@view.id:${params.viewId}`);
+  }
+  const response = await api.listRUMEvents({
+    filterQuery: queryParts.join(" "),
+    sort: "timestamp",
+    pageLimit: Math.min(limits.maxResults, 1e3)
+  });
+  const events = (response.data ?? []).map(formatWaterfallEvent);
+  const summary = {
+    views: events.filter((e) => e.type === "view").length,
+    resources: events.filter((e) => e.type === "resource").length,
+    actions: events.filter((e) => e.type === "action").length,
+    errors: events.filter((e) => e.type === "error").length,
+    longTasks: events.filter((e) => e.type === "long_task").length
+  };
+  return {
+    events,
+    summary,
+    meta: {
+      totalCount: events.length,
+      applicationId: params.applicationId,
+      sessionId: params.sessionId,
+      viewId: params.viewId ?? null,
+      datadog_url: buildRumSessionUrl(params.applicationId, params.sessionId, site)
+    }
+  };
+}
+function registerRumTool(server, api, limits, site = "datadoghq.com") {
+  server.tool(
+    "rum",
+    "Query Datadog Real User Monitoring (RUM) data. Actions: applications (list RUM apps), events (search RUM events), aggregate (group and count events), performance (Core Web Vitals: LCP, FCP, CLS, FID, INP), waterfall (session timeline with resources/actions/errors). Use for: frontend performance, user sessions, page views, errors, resource loading.",
+    InputSchema12,
+    async ({ action, query, from, to, type, sort, limit, groupBy, compute, metrics, applicationId, sessionId, viewId }) => {
+      try {
+        switch (action) {
+          case "applications":
+            return toolResult(await listApplications(api));
+          case "events":
+            return toolResult(await searchEvents(api, { query, from, to, type, sort, limit }, limits, site));
+          case "aggregate":
+            return toolResult(await aggregateEvents(api, { query, from, to, groupBy, compute }, limits, site));
+          case "performance":
+            return toolResult(await getPerformanceMetrics(api, { query, from, to, groupBy, metrics }, limits, site));
+          case "waterfall":
+            if (!applicationId || !sessionId) {
+              throw new Error("waterfall action requires applicationId and sessionId parameters");
+            }
+            return toolResult(await getSessionWaterfall(api, { applicationId, sessionId, viewId }, limits, site));
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/security.ts
+import { z as z14 } from "zod";
+var ActionSchema13 = z14.enum(["rules", "signals", "findings"]);
+var InputSchema13 = {
+  action: ActionSchema13.describe("Action to perform"),
+  id: z14.string().optional().describe("Rule or signal ID (for specific lookups)"),
+  query: z14.string().optional().describe("Search query for signals or findings"),
+  from: z14.string().optional().describe('Start time (ISO 8601, relative like "1h", "7d")'),
+  to: z14.string().optional().describe('End time (ISO 8601, relative like "now")'),
+  severity: z14.enum(["info", "low", "medium", "high", "critical"]).optional().describe("Filter by severity"),
+  status: z14.enum(["open", "under_review", "archived"]).optional().describe("Filter signals by status"),
+  pageSize: z14.number().optional().describe("Number of results to return"),
+  pageCursor: z14.string().optional().describe("Cursor for pagination")
+};
+function formatRule(rule) {
+  const ruleData = rule;
+  return {
+    id: ruleData["id"] ?? "",
+    name: ruleData["name"] ?? "",
+    type: ruleData["type"] ?? "",
+    isEnabled: ruleData["isEnabled"] ?? false,
+    hasExtendedTitle: ruleData["hasExtendedTitle"] ?? false,
+    message: ruleData["message"] ?? null,
+    tags: ruleData["tags"] ?? [],
+    createdAt: ruleData["createdAt"] ? new Date(ruleData["createdAt"]).toISOString() : "",
+    updatedAt: ruleData["updatedAt"] ? new Date(ruleData["updatedAt"]).toISOString() : "",
+    creationAuthorId: ruleData["creationAuthorId"] ?? null,
+    isDefault: ruleData["isDefault"] ?? false,
+    isDeleted: ruleData["isDeleted"] ?? false,
+    filters: (ruleData["filters"] ?? []).map((f) => ({
+      action: f.action ?? "",
+      query: f.query ?? ""
+    }))
+  };
+}
+function formatSignal(signal) {
+  const attrs = signal.attributes ?? {};
+  const customAttrs = attrs;
+  return {
+    id: signal.id ?? "",
+    type: String(signal.type ?? ""),
+    timestamp: attrs.timestamp?.toISOString() ?? "",
+    attributes: {
+      message: attrs.message ?? null,
+      status: customAttrs["status"] ?? null,
+      severity: customAttrs["severity"] ?? null,
+      tags: attrs.tags ?? [],
+      custom: attrs.custom ?? {}
+    }
+  };
+}
+async function listRules(api, params, limits) {
+  const response = await api.listSecurityMonitoringRules({
+    pageSize: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    pageNumber: 0
+  });
+  const rules = (response.data ?? []).map(formatRule);
+  return {
+    rules,
+    meta: {
+      totalCount: rules.length
+    }
+  };
+}
+async function getRule(api, ruleId) {
+  const response = await api.getSecurityMonitoringRule({ ruleId });
+  return {
+    rule: formatRule(response)
+  };
+}
+async function searchSignals(api, params, limits) {
+  const nowMs = Date.now();
+  const defaultFromMs = nowMs - 24 * 60 * 60 * 1e3;
+  const fromTime = parseTime(params.from, Math.floor(defaultFromMs / 1e3));
+  const toTime = parseTime(params.to, Math.floor(nowMs / 1e3));
+  let queryString = params.query ?? "*";
+  if (params.severity) {
+    queryString = `severity:${params.severity} ${queryString}`.trim();
+  }
+  if (params.status) {
+    queryString = `status:${params.status} ${queryString}`.trim();
+  }
+  const response = await api.searchSecurityMonitoringSignals({
+    body: {
+      filter: {
+        query: queryString,
+        from: new Date(fromTime * 1e3),
+        to: new Date(toTime * 1e3)
+      },
+      page: {
+        limit: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+        cursor: params.pageCursor
+      },
+      sort: "timestamp"
+    }
+  });
+  const signals = (response.data ?? []).map(formatSignal);
+  return {
+    signals,
+    meta: {
+      nextCursor: response.meta?.page?.after ?? null,
+      totalCount: signals.length,
+      timeRange: {
+        from: new Date(fromTime * 1e3).toISOString(),
+        to: new Date(toTime * 1e3).toISOString()
+      }
+    }
+  };
+}
+async function listFindings(api, params, limits) {
+  const response = await api.searchSecurityMonitoringSignals({
+    body: {
+      filter: {
+        query: params.query ?? "@workflow.rule.type:workload_security OR @workflow.rule.type:cloud_configuration",
+        from: new Date(Date.now() - 7 * 24 * 60 * 60 * 1e3),
+        // Last 7 days
+        to: /* @__PURE__ */ new Date()
+      },
+      page: {
+        limit: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+        cursor: params.pageCursor
+      }
+    }
+  });
+  const findings = (response.data ?? []).map(formatSignal);
+  return {
+    findings,
+    meta: {
+      nextCursor: response.meta?.page?.after ?? null,
+      totalCount: findings.length
+    }
+  };
+}
+function registerSecurityTool(server, api, limits) {
+  server.tool(
+    "security",
+    "Query Datadog Security Monitoring. Actions: rules (list detection rules), signals (search security signals), findings (list security findings). Use for: threat detection, compliance, security posture, incident investigation.",
+    InputSchema13,
+    async ({ action, id, query, from, to, severity, status, pageSize, pageCursor }) => {
+      try {
+        switch (action) {
+          case "rules":
+            if (id) {
+              return toolResult(await getRule(api, id));
+            }
+            return toolResult(await listRules(api, { pageSize, pageCursor }, limits));
+          case "signals":
+            return toolResult(await searchSignals(api, { query, from, to, severity, status, pageSize, pageCursor }, limits));
+          case "findings":
+            return toolResult(await listFindings(api, { query, pageSize, pageCursor }, limits));
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/notebooks.ts
+import { z as z15 } from "zod";
+var ActionSchema14 = z15.enum(["list", "get", "create", "update", "delete"]);
+var InputSchema14 = {
+  action: ActionSchema14.describe("Action to perform"),
+  id: z15.number().optional().describe("Notebook ID (required for get/update/delete actions)"),
+  query: z15.string().optional().describe("Search query for notebooks"),
+  authorHandle: z15.string().optional().describe("Filter by author handle (email)"),
+  excludeAuthorHandle: z15.string().optional().describe("Exclude notebooks by author handle"),
+  includeCells: z15.boolean().optional().describe("Include cell content in response (default: true for get)"),
+  name: z15.string().optional().describe("Notebook name (for create/update)"),
+  cells: z15.array(z15.object({
+    type: z15.enum(["markdown", "timeseries", "toplist", "heatmap", "distribution", "log_stream"]),
+    content: z15.unknown()
+  })).optional().describe("Notebook cells (for create/update)"),
+  time: z15.object({
+    liveSpan: z15.string().optional(),
+    start: z15.number().optional(),
+    end: z15.number().optional()
+  }).optional().describe("Time configuration for notebook"),
+  status: z15.enum(["published"]).optional().describe("Notebook status"),
+  pageSize: z15.number().optional().describe("Number of notebooks to return"),
+  pageNumber: z15.number().optional().describe("Page number for pagination")
+};
+function formatNotebookSummary(nb) {
+  const attrs = nb.attributes ?? {};
+  return {
+    id: nb.id ?? 0,
+    name: attrs.name ?? "",
+    author: {
+      handle: attrs.author?.handle ?? null,
+      name: attrs.author?.name ?? null
+    },
+    status: String(attrs.status ?? ""),
+    cellCount: attrs.cells?.length ?? 0,
+    created: attrs.created?.toISOString() ?? "",
+    modified: attrs.modified?.toISOString() ?? "",
+    metadata: {
+      isTemplate: attrs.metadata?.isTemplate ?? null,
+      takeSnapshots: attrs.metadata?.takeSnapshots ?? null
+    }
+  };
+}
+function formatNotebookDetail(nb) {
+  const attrs = nb.attributes ?? {};
+  return {
+    id: nb.id ?? 0,
+    name: attrs.name ?? "",
+    author: {
+      handle: attrs.author?.handle ?? null,
+      name: attrs.author?.name ?? null
+    },
+    status: String(attrs.status ?? ""),
+    cellCount: attrs.cells?.length ?? 0,
+    created: attrs.created?.toISOString() ?? "",
+    modified: attrs.modified?.toISOString() ?? "",
+    metadata: {
+      isTemplate: attrs.metadata?.isTemplate ?? null,
+      takeSnapshots: attrs.metadata?.takeSnapshots ?? null
+    },
+    cells: (attrs.cells ?? []).map((cell) => ({
+      id: String(cell.id ?? ""),
+      type: String(cell.type ?? ""),
+      attributes: cell.attributes ?? {}
+    })),
+    time: {
+      liveSpan: attrs.time ? String(attrs.time["liveSpan"] ?? "") : null
+    }
+  };
+}
+async function listNotebooks(api, params, limits) {
+  const response = await api.listNotebooks({
+    query: params.query,
+    authorHandle: params.authorHandle,
+    excludeAuthorHandle: params.excludeAuthorHandle,
+    includeCells: params.includeCells ?? false,
+    count: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    start: (params.pageNumber ?? 0) * (params.pageSize ?? limits.maxResults)
+  });
+  const notebooks = (response.data ?? []).map(formatNotebookSummary);
+  return {
+    notebooks,
+    meta: {
+      totalCount: response.meta?.page?.totalCount ?? notebooks.length,
+      totalFilteredCount: response.meta?.page?.totalFilteredCount ?? notebooks.length
+    }
+  };
+}
+async function getNotebook(api, notebookId) {
+  const response = await api.getNotebook({ notebookId });
+  if (!response.data) {
+    throw new Error(`Notebook ${notebookId} not found`);
+  }
+  return {
+    notebook: formatNotebookDetail(response.data)
+  };
+}
+async function createNotebook(api, params) {
+  const cells = (params.cells ?? []).map((cell) => {
+    if (cell.type === "markdown") {
+      return {
+        type: "notebook_cells",
+        attributes: {
+          definition: {
+            type: "markdown",
+            text: String(cell.content ?? "")
+          }
+        }
+      };
+    }
+    return {
+      type: "notebook_cells",
+      attributes: {
+        definition: cell.content
+      }
+    };
+  });
+  if (cells.length === 0) {
+    cells.push({
+      type: "notebook_cells",
+      attributes: {
+        definition: {
+          type: "markdown",
+          text: "# New Notebook\n\nStart adding content here."
+        }
+      }
+    });
+  }
+  const timeConfig = params.time?.liveSpan ? { liveSpan: params.time.liveSpan } : { liveSpan: "1h" };
+  const response = await api.createNotebook({
+    body: {
+      data: {
+        type: "notebooks",
+        attributes: {
+          name: params.name,
+          cells,
+          time: timeConfig,
+          status: params.status ?? "published"
+        }
+      }
+    }
+  });
+  if (!response.data) {
+    throw new Error("Failed to create notebook");
+  }
+  return {
+    success: true,
+    notebook: formatNotebookDetail(response.data),
+    message: `Notebook "${params.name}" created successfully`
+  };
+}
+async function updateNotebook(api, notebookId, params) {
+  const existing = await api.getNotebook({ notebookId });
+  if (!existing.data) {
+    throw new Error(`Notebook ${notebookId} not found`);
+  }
+  const existingAttrs = existing.data.attributes ?? {};
+  let cells;
+  if (params.cells) {
+    cells = params.cells.map((cell) => {
+      if (cell.type === "markdown") {
+        return {
+          type: "notebook_cells",
+          attributes: {
+            definition: {
+              type: "markdown",
+              text: String(cell.content ?? "")
+            }
+          }
+        };
+      }
+      return {
+        type: "notebook_cells",
+        attributes: {
+          definition: cell.content
+        }
+      };
+    });
+  }
+  const timeConfig = params.time?.liveSpan ? { liveSpan: params.time.liveSpan } : void 0;
+  const response = await api.updateNotebook({
+    notebookId,
+    body: {
+      data: {
+        type: "notebooks",
+        attributes: {
+          name: params.name ?? existingAttrs.name ?? "",
+          cells: cells ?? existingAttrs.cells?.map((c) => ({
+            id: c.id,
+            type: "notebook_cells",
+            attributes: c.attributes
+          })) ?? [],
+          time: timeConfig ?? existingAttrs.time ?? { liveSpan: "1h" },
+          status: params.status ?? existingAttrs.status
+        }
+      }
+    }
+  });
+  if (!response.data) {
+    throw new Error("Failed to update notebook");
+  }
+  return {
+    success: true,
+    notebook: formatNotebookDetail(response.data),
+    message: `Notebook ${notebookId} updated successfully`
+  };
+}
+async function deleteNotebook(api, notebookId) {
+  await api.deleteNotebook({ notebookId });
+  return {
+    success: true,
+    message: `Notebook ${notebookId} deleted successfully`
+  };
+}
+function registerNotebooksTool(server, api, limits, readOnly = false) {
+  server.tool(
+    "notebooks",
+    "Manage Datadog Notebooks. Actions: list (search notebooks), get (by ID with cells), create (new notebook), update (modify notebook), delete (remove notebook). Use for: runbooks, incident documentation, investigation notes, dashboards as code.",
+    InputSchema14,
+    async ({ action, id, query, authorHandle, excludeAuthorHandle, includeCells, name, cells, time, status, pageSize, pageNumber }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listNotebooks(api, { query, authorHandle, excludeAuthorHandle, includeCells, pageSize, pageNumber }, limits));
+          case "get": {
+            const notebookId = requireParam(id, "id", "get");
+            return toolResult(await getNotebook(api, notebookId));
+          }
+          case "create": {
+            const notebookName = requireParam(name, "name", "create");
+            return toolResult(await createNotebook(api, {
+              name: notebookName,
+              cells,
+              time,
+              status
+            }));
+          }
+          case "update": {
+            const notebookId = requireParam(id, "id", "update");
+            return toolResult(await updateNotebook(api, notebookId, {
+              name,
+              cells,
+              time,
+              status
+            }));
+          }
+          case "delete": {
+            const notebookId = requireParam(id, "id", "delete");
+            return toolResult(await deleteNotebook(api, notebookId));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/users.ts
+import { z as z16 } from "zod";
+var ActionSchema15 = z16.enum(["list", "get"]);
+var InputSchema15 = {
+  action: ActionSchema15.describe("Action to perform"),
+  id: z16.string().optional().describe("User ID (required for get action)"),
+  filter: z16.string().optional().describe("Filter users by name or email"),
+  status: z16.enum(["Active", "Pending", "Disabled"]).optional().describe("Filter by user status"),
+  pageSize: z16.number().optional().describe("Number of users to return per page"),
+  pageNumber: z16.number().optional().describe("Page number for pagination")
+};
+function formatUser(user) {
+  const attrs = user.attributes ?? {};
+  const relationships = user.relationships ?? {};
+  const roles = (relationships.roles?.data ?? []).map((r) => r.id ?? "");
+  const orgId = relationships.org?.data?.id ?? null;
+  return {
+    id: user.id ?? "",
+    email: attrs.email ?? "",
+    name: attrs.name ?? "",
+    status: attrs.status ?? "",
+    title: attrs.title ?? null,
+    verified: attrs.verified ?? false,
+    disabled: attrs.disabled ?? false,
+    createdAt: attrs.createdAt?.toISOString() ?? "",
+    modifiedAt: attrs.modifiedAt?.toISOString() ?? "",
+    relationships: {
+      roles,
+      org: orgId
+    }
+  };
+}
+async function listUsers(api, params, limits) {
+  const response = await api.listUsers({
+    filter: params.filter,
+    filterStatus: params.status,
+    pageSize: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    pageNumber: params.pageNumber ?? 0
+  });
+  const users = (response.data ?? []).map(formatUser);
+  return {
+    users,
+    meta: {
+      page: response.meta?.page ?? {},
+      totalCount: users.length
+    }
+  };
+}
+async function getUser(api, userId) {
+  const response = await api.getUser({ userId });
+  if (!response.data) {
+    throw new Error(`User ${userId} not found`);
+  }
+  return {
+    user: formatUser(response.data)
+  };
+}
+function registerUsersTool(server, api, limits) {
+  server.tool(
+    "users",
+    "Manage Datadog users. Actions: list (with filters), get (by ID). Use for: access management, user auditing, team organization.",
+    InputSchema15,
+    async ({ action, id, filter, status, pageSize, pageNumber }) => {
+      try {
+        switch (action) {
+          case "list":
+            return toolResult(await listUsers(api, { filter, status, pageSize, pageNumber }, limits));
+          case "get": {
+            const userId = requireParam(id, "id", "get");
+            return toolResult(await getUser(api, userId));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/teams.ts
+import { z as z17 } from "zod";
+var ActionSchema16 = z17.enum(["list", "get", "members"]);
+var InputSchema16 = {
+  action: ActionSchema16.describe("Action to perform"),
+  id: z17.string().optional().describe("Team ID (required for get/members actions)"),
+  filter: z17.string().optional().describe("Filter teams by name"),
+  pageSize: z17.number().optional().describe("Number of teams to return per page"),
+  pageNumber: z17.number().optional().describe("Page number for pagination")
+};
+function formatTeam(team) {
+  const attrs = team.attributes ?? {};
+  return {
+    id: team.id ?? "",
+    name: attrs.name ?? "",
+    handle: attrs.handle ?? "",
+    description: attrs.description ?? null,
+    summary: attrs.summary ?? null,
+    linkCount: attrs.linkCount ?? 0,
+    userCount: attrs.userCount ?? 0,
+    createdAt: attrs.createdAt?.toISOString() ?? "",
+    modifiedAt: attrs.modifiedAt?.toISOString() ?? ""
+  };
+}
+function formatTeamMember(member) {
+  const attrs = member.attributes ?? {};
+  const relationships = member.relationships ?? {};
+  return {
+    id: member.id ?? "",
+    type: String(member.type ?? ""),
+    attributes: {
+      role: String(attrs.role ?? "")
+    },
+    relationships: {
+      userId: relationships.user?.data?.id ?? null
+    }
+  };
+}
+async function listTeams(api, params, limits) {
+  const response = await api.listTeams({
+    filterKeyword: params.filter,
+    pageSize: Math.min(params.pageSize ?? limits.maxResults, limits.maxResults),
+    pageNumber: params.pageNumber ?? 0
+  });
+  const teams = (response.data ?? []).map(formatTeam);
+  return {
+    teams,
+    meta: {
+      totalCount: teams.length
+    }
+  };
+}
+async function getTeam(api, teamId) {
+  const response = await api.getTeam({ teamId });
+  if (!response.data) {
+    throw new Error(`Team ${teamId} not found`);
+  }
+  return {
+    team: formatTeam(response.data)
+  };
+}
+async function getTeamMembers(api, teamId, limits) {
+  const response = await api.getTeamMemberships({
+    teamId,
+    pageSize: limits.maxResults
+  });
+  const members = (response.data ?? []).map(formatTeamMember);
+  return {
+    members,
+    meta: {
+      totalCount: members.length
+    }
+  };
+}
+function registerTeamsTool(server, api, limits) {
+  server.tool(
+    "teams",
+    "Manage Datadog teams. Actions: list (with filters), get (by ID), members (list team members). Use for: team organization, access management, collaboration.",
+    InputSchema16,
+    async ({ action, id, filter, pageSize, pageNumber }) => {
+      try {
+        switch (action) {
+          case "list":
+            return toolResult(await listTeams(api, { filter, pageSize, pageNumber }, limits));
+          case "get": {
+            const teamId = requireParam(id, "id", "get");
+            return toolResult(await getTeam(api, teamId));
+          }
+          case "members": {
+            const teamId = requireParam(id, "id", "members");
+            return toolResult(await getTeamMembers(api, teamId, limits));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/tags.ts
+import { z as z18 } from "zod";
+var ActionSchema17 = z18.enum(["list", "get", "add", "update", "delete"]);
+var InputSchema17 = {
+  action: ActionSchema17.describe("Action to perform"),
+  hostName: z18.string().optional().describe("Host name (required for get/add/update/delete actions)"),
+  tags: z18.array(z18.string()).optional().describe('Tags to add or set (for add/update actions). Format: "key:value"'),
+  source: z18.string().optional().describe('Source of the tags (e.g., "users", "datadog"). Defaults to "users"')
+};
+async function listAllTags(api, source) {
+  const response = await api.listHostTags({
+    source
+  });
+  const tags = response.tags ?? {};
+  return {
+    hosts: tags,
+    totalHosts: Object.keys(tags).length
+  };
+}
+async function getHostTags(api, hostName, source) {
+  const response = await api.getHostTags({
+    hostName,
+    source
+  });
+  return {
+    hostName,
+    tags: response.tags ?? [],
+    source: source ?? null
+  };
+}
+async function addHostTags(api, hostName, tags, source) {
+  const response = await api.createHostTags({
+    hostName,
+    body: {
+      host: hostName,
+      tags
+    },
+    source
+  });
+  return {
+    success: true,
+    hostName,
+    tags: response.tags ?? tags,
+    message: `Tags added to host ${hostName}`
+  };
+}
+async function updateHostTags(api, hostName, tags, source) {
+  const response = await api.updateHostTags({
+    hostName,
+    body: {
+      host: hostName,
+      tags
+    },
+    source
+  });
+  return {
+    success: true,
+    hostName,
+    tags: response.tags ?? tags,
+    message: `Tags updated for host ${hostName}`
+  };
+}
+async function deleteHostTags(api, hostName, source) {
+  await api.deleteHostTags({
+    hostName,
+    source
+  });
+  return {
+    success: true,
+    hostName,
+    message: `Tags deleted from host ${hostName}`
+  };
+}
+function registerTagsTool(server, api, _limits, readOnly = false) {
+  server.tool(
+    "tags",
+    "Manage Datadog host tags. Actions: list (all host tags), get (tags for specific host), add (create tags), update (replace tags), delete (remove all tags). Use for: infrastructure organization, filtering, grouping.",
+    InputSchema17,
+    async ({ action, hostName, tags, source }) => {
+      try {
+        checkReadOnly(action, readOnly);
+        switch (action) {
+          case "list":
+            return toolResult(await listAllTags(api, source));
+          case "get": {
+            const host = requireParam(hostName, "hostName", "get");
+            return toolResult(await getHostTags(api, host, source));
+          }
+          case "add": {
+            const host = requireParam(hostName, "hostName", "add");
+            const tagList = requireParam(tags, "tags", "add");
+            return toolResult(await addHostTags(api, host, tagList, source));
+          }
+          case "update": {
+            const host = requireParam(hostName, "hostName", "update");
+            const tagList = requireParam(tags, "tags", "update");
+            return toolResult(await updateHostTags(api, host, tagList, source));
+          }
+          case "delete": {
+            const host = requireParam(hostName, "hostName", "delete");
+            return toolResult(await deleteHostTags(api, host, source));
+          }
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/usage.ts
+import { z as z19 } from "zod";
+var ActionSchema18 = z19.enum(["summary", "hosts", "logs", "custom_metrics", "indexed_spans", "ingested_spans"]);
+var InputSchema18 = {
+  action: ActionSchema18.describe("Action to perform: summary (overall usage), hosts, logs, custom_metrics, indexed_spans, ingested_spans"),
+  from: z19.string().optional().describe('Start time (ISO 8601 date like "2024-01-01", or relative like "30d")'),
+  to: z19.string().optional().describe('End time (ISO 8601 date like "2024-01-31", or relative like "now")'),
+  includeOrgDetails: z19.boolean().optional().describe("Include usage breakdown by organization (for multi-org accounts)")
+};
+function parseDate(dateStr, defaultDate) {
+  if (!dateStr) return defaultDate;
+  if (dateStr.match(/^\d+[hdwmy]$/)) {
+    const seconds = parseTime(dateStr, Math.floor(Date.now() / 1e3));
+    return new Date(seconds * 1e3);
+  }
+  const parsed = new Date(dateStr);
+  if (!isNaN(parsed.getTime())) {
+    return parsed;
+  }
+  return defaultDate;
+}
+async function getUsageSummary(api, params) {
+  const endDate = parseDate(params.to, /* @__PURE__ */ new Date());
+  const startDate = parseDate(params.from, new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1e3));
+  const response = await api.getUsageSummary({
+    startMonth: startDate,
+    endMonth: endDate,
+    includeOrgDetails: params.includeOrgDetails
+  });
+  return {
+    startDate: response.startDate?.toISOString() ?? startDate.toISOString(),
+    endDate: response.endDate?.toISOString() ?? endDate.toISOString(),
+    aggsTotal: {
+      apmHostTop99p: response.apmHostTop99PSum ?? null,
+      infraHostTop99p: response.infraHostTop99PSum ?? null
+    },
+    usage: (response.usage ?? []).map((u) => ({
+      date: u.date?.toISOString() ?? "",
+      orgName: u["orgName"] ?? null,
+      apmHostTop99pSum: u.apmHostTop99P ?? null,
+      infraHostTop99pSum: u.infraHostTop99P ?? null,
+      logsIndexedLogsUsageSum: u.indexedEventsCountSum ?? null,
+      ingestedEventsBytesSum: u.ingestedEventsBytesSum ?? null,
+      customMetricsAvgPerHour: null
+      // Not in summary
+    }))
+  };
+}
+async function getHostsUsage(api, params) {
+  const endDate = parseDate(params.to, /* @__PURE__ */ new Date());
+  const startDate = parseDate(params.from, new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1e3));
+  const response = await api.getUsageHosts({
+    startHr: startDate,
+    endHr: endDate
+  });
+  return {
+    startDate: startDate.toISOString(),
+    endDate: endDate.toISOString(),
+    usage: (response.usage ?? []).map((u) => ({
+      date: u.hour?.toISOString() ?? "",
+      agentHostTop99p: u.agentHostCount ?? null,
+      awsHostTop99p: u.awsHostCount ?? null,
+      azureHostTop99p: u.azureHostCount ?? null,
+      gcpHostTop99p: u.gcpHostCount ?? null,
+      infraHostTop99p: u.hostCount ?? null,
+      containerTop99p: u.containerCount ?? null
+    }))
+  };
+}
+async function getLogsUsage(api, params) {
+  const endDate = parseDate(params.to, /* @__PURE__ */ new Date());
+  const startDate = parseDate(params.from, new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1e3));
+  const response = await api.getUsageLogs({
+    startHr: startDate,
+    endHr: endDate
+  });
+  return {
+    startDate: startDate.toISOString(),
+    endDate: endDate.toISOString(),
+    usage: (response.usage ?? []).map((u) => ({
+      date: u.hour?.toISOString() ?? "",
+      logsIndexedLogsUsageSum: u.indexedEventsCount ?? null,
+      logsLiveIndexedLogsUsageSum: u.indexedEventsCount ?? null,
+      logsRehydratedIndexedLogsUsageSum: u["logsRehydratedIndexedCount"] ?? null
+    }))
+  };
+}
+async function getCustomMetricsUsage(api, params) {
+  const endDate = parseDate(params.to, /* @__PURE__ */ new Date());
+  const startDate = parseDate(params.from, new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1e3));
+  const response = await api.getUsageTimeseries({
+    startHr: startDate,
+    endHr: endDate
+  });
+  return {
+    startDate: startDate.toISOString(),
+    endDate: endDate.toISOString(),
+    usage: (response.usage ?? []).map((u) => ({
+      date: u.hour?.toISOString() ?? "",
+      avgMetricsCount: u.numCustomTimeseries ?? null,
+      maxMetricsCount: null
+      // Not directly available
+    }))
+  };
+}
+async function getIndexedSpansUsage(api, params) {
+  const endDate = parseDate(params.to, /* @__PURE__ */ new Date());
+  const startDate = parseDate(params.from, new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1e3));
+  const response = await api.getUsageIndexedSpans({
+    startHr: startDate,
+    endHr: endDate
+  });
+  return {
+    startDate: startDate.toISOString(),
+    endDate: endDate.toISOString(),
+    usage: (response.usage ?? []).map((u) => ({
+      date: u.hour?.toISOString() ?? "",
+      indexedSpansCount: u.indexedEventsCount ?? null,
+      ingestedSpansBytes: null
+    }))
+  };
+}
+async function getIngestedSpansUsage(api, params) {
+  const endDate = parseDate(params.to, /* @__PURE__ */ new Date());
+  const startDate = parseDate(params.from, new Date(endDate.getTime() - 30 * 24 * 60 * 60 * 1e3));
+  const response = await api.getIngestedSpans({
+    startHr: startDate,
+    endHr: endDate
+  });
+  return {
+    startDate: startDate.toISOString(),
+    endDate: endDate.toISOString(),
+    usage: (response.usage ?? []).map((u) => ({
+      date: u.hour?.toISOString() ?? "",
+      indexedSpansCount: null,
+      ingestedSpansBytes: u["ingestedTracesBytes"] ?? null
+    }))
+  };
+}
+function registerUsageTool(server, api, _limits) {
+  server.tool(
+    "usage",
+    "Query Datadog usage metering data. Actions: summary (overall usage), hosts (infrastructure), logs, custom_metrics, indexed_spans, ingested_spans. Use for: cost management, capacity planning, usage tracking, billing analysis.",
+    InputSchema18,
+    async ({ action, from, to, includeOrgDetails }) => {
+      try {
+        switch (action) {
+          case "summary":
+            return toolResult(await getUsageSummary(api, { from, to, includeOrgDetails }));
+          case "hosts":
+            return toolResult(await getHostsUsage(api, { from, to }));
+          case "logs":
+            return toolResult(await getLogsUsage(api, { from, to }));
+          case "custom_metrics":
+            return toolResult(await getCustomMetricsUsage(api, { from, to }));
+          case "indexed_spans":
+            return toolResult(await getIndexedSpansUsage(api, { from, to }));
+          case "ingested_spans":
+            return toolResult(await getIngestedSpansUsage(api, { from, to }));
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+
+// src/tools/auth.ts
+import { z as z20 } from "zod";
+var ActionSchema19 = z20.enum(["validate"]);
+var InputSchema19 = {
+  action: ActionSchema19.describe("Action to perform: validate - test if API key and App key are valid")
+};
+function registerAuthTool(server, clients) {
+  server.tool(
+    "auth",
+    "Validate Datadog API credentials. Use this to verify that the API key and App key are correctly configured before performing other operations.",
+    InputSchema19,
+    async ({ action }) => {
+      try {
+        switch (action) {
+          case "validate":
+            return toolResult(await validateCredentials(clients));
+          default:
+            throw new Error(`Unknown action: ${action}`);
+        }
+      } catch (error) {
+        handleDatadogError(error);
+      }
+    }
+  );
+}
+async function validateCredentials(clients) {
+  const apiKeyResult = await clients.auth.validate();
+  if (!apiKeyResult.valid) {
+    return {
+      valid: false,
+      apiKeyValid: false,
+      appKeyValid: false,
+      error: "API key is invalid",
+      suggestion: "Check that your DD_API_KEY environment variable is correct"
+    };
+  }
+  try {
+    await clients.users.listUsers({ pageSize: 1 });
+    return {
+      valid: true,
+      apiKeyValid: true,
+      appKeyValid: true,
+      message: "Both API key and App key are valid and working",
+      permissions: "Credentials have sufficient permissions to access the Datadog API"
+    };
+  } catch (appKeyError) {
+    const errorMessage = appKeyError instanceof Error ? appKeyError.message : String(appKeyError);
+    const isAuthError = errorMessage.includes("401") || errorMessage.includes("403") || errorMessage.includes("Forbidden");
+    return {
+      valid: !isAuthError,
+      apiKeyValid: true,
+      appKeyValid: !isAuthError,
+      warning: isAuthError ? "App key may be invalid or have insufficient permissions" : "API key is valid. App key validation inconclusive.",
+      error: errorMessage,
+      suggestion: isAuthError ? "Check that your DD_APP_KEY environment variable is correct and has appropriate scopes" : "Credentials appear valid but encountered an issue during validation"
+    };
+  }
+}
+
+// src/tools/index.ts
+function registerAllTools(server, clients, limits, features, site = "datadoghq.com") {
+  const { readOnly, disabledTools } = features;
+  const enabled = (tool) => !disabledTools.includes(tool);
+  if (enabled("monitors")) registerMonitorsTool(server, clients.monitors, limits, readOnly, site);
+  if (enabled("dashboards")) registerDashboardsTool(server, clients.dashboards, limits, readOnly, site);
+  if (enabled("logs")) registerLogsTool(server, clients.logs, limits, site);
+  if (enabled("metrics")) registerMetricsTool(server, clients.metricsV1, clients.metricsV2, limits, site);
+  if (enabled("traces")) registerTracesTool(server, clients.spans, clients.services, limits, site);
+  if (enabled("events")) registerEventsTool(server, clients.eventsV1, clients.eventsV2, clients.monitors, limits, readOnly, site);
+  if (enabled("incidents")) registerIncidentsTool(server, clients.incidents, limits, readOnly, site);
+  if (enabled("slos")) registerSlosTool(server, clients.slo, limits, readOnly, site);
+  if (enabled("synthetics")) registerSyntheticsTool(server, clients.synthetics, limits, readOnly, site);
+  if (enabled("hosts")) registerHostsTool(server, clients.hosts, limits, readOnly);
+  if (enabled("downtimes")) registerDowntimesTool(server, clients.downtimes, limits, readOnly);
+  if (enabled("rum")) registerRumTool(server, clients.rum, limits, site);
+  if (enabled("security")) registerSecurityTool(server, clients.security, limits);
+  if (enabled("notebooks")) registerNotebooksTool(server, clients.notebooks, limits, readOnly, site);
+  if (enabled("users")) registerUsersTool(server, clients.users, limits);
+  if (enabled("teams")) registerTeamsTool(server, clients.teams, limits);
+  if (enabled("tags")) registerTagsTool(server, clients.tags, limits, readOnly);
+  if (enabled("usage")) registerUsageTool(server, clients.usage, limits);
+  if (enabled("auth")) registerAuthTool(server, clients);
+}
+
+// src/server.ts
+function createServer(config) {
+  const server = new McpServer({
+    name: config.server.name,
+    version: config.server.version
+  });
+  const clients = createDatadogClients(config.datadog);
+  registerAllTools(server, clients, config.limits, config.features, config.datadog.site);
+  return server;
+}
+
+// src/transport/stdio.ts
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+async function connectStdio(server) {
+  const transport = new StdioServerTransport();
+  await server.connect(transport);
+  console.error("[MCP] Datadog MCP server running on stdio");
+}
+
+// src/transport/http.ts
+import express from "express";
+import { randomUUID } from "crypto";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { isInitializeRequest } from "@modelcontextprotocol/sdk/types.js";
+var transports = {};
+async function connectHttp(server, config) {
+  const app = express();
+  app.use(express.json());
+  app.get("/health", (_req, res) => {
+    res.json({ status: "ok", name: config.name, version: config.version });
+  });
+  app.post("/mcp", async (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    let transport;
+    if (sessionId && transports[sessionId]) {
+      transport = transports[sessionId];
+    } else if (!sessionId && isInitializeRequest(req.body)) {
+      transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: () => randomUUID(),
+        onsessioninitialized: (id) => {
+          transports[id] = transport;
+          console.error(`[MCP] Session initialized: ${id}`);
+        }
+      });
+      transport.onclose = () => {
+        if (transport.sessionId) {
+          delete transports[transport.sessionId];
+          console.error(`[MCP] Session closed: ${transport.sessionId}`);
+        }
+      };
+      await server.connect(transport);
+    } else {
+      res.status(400).json({
+        jsonrpc: "2.0",
+        error: { code: -32e3, message: "Invalid session" },
+        id: null
+      });
+      return;
+    }
+    await transport.handleRequest(req, res, req.body);
+  });
+  app.get("/mcp", async (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    const transport = transports[sessionId];
+    if (transport) {
+      await transport.handleRequest(req, res);
+    } else {
+      res.status(400).json({ error: "Invalid session" });
+    }
+  });
+  app.delete("/mcp", async (req, res) => {
+    const sessionId = req.headers["mcp-session-id"];
+    const transport = transports[sessionId];
+    if (transport) {
+      await transport.handleRequest(req, res);
+    } else {
+      res.status(400).json({ error: "Invalid session" });
+    }
+  });
+  app.listen(config.port, config.host, () => {
+    console.error(`[MCP] Datadog MCP server running on http://${config.host}:${config.port}/mcp`);
+    console.error(`[MCP] Health check available at http://${config.host}:${config.port}/health`);
+  });
+}
+
+// src/index.ts
+async function main() {
+  try {
+    const config = loadConfig();
+    const server = createServer(config);
+    if (config.server.transport === "http") {
+      await connectHttp(server, config.server);
+    } else {
+      await connectStdio(server);
+    }
+  } catch (error) {
+    console.error("[MCP] Failed to start server:", error);
+    process.exit(1);
+  }
+}
+main();
+//# sourceMappingURL=index.js.map