datadog-mcp 2.0.2 → 4.0.0

package/README.md

@@ -23,6 +23,12 @@ DD_APP_KEY=your-app-key
 
 ```bash
 DD_SITE=datadoghq.com  # Default. Use datadoghq.eu for EU, etc.
+
+# Limit defaults (fallbacks when AI doesn't specify)
+MCP_DEFAULT_LIMIT=50              # General tools default limit
+MCP_DEFAULT_LOG_LINES=200         # Logs tool default limit
+MCP_DEFAULT_METRIC_POINTS=1000    # Metrics timeseries data points
+MCP_DEFAULT_TIME_RANGE=24         # Default time range in hours
 ```
 
 ### Optional Flags
@@ -205,6 +211,18 @@ When running with `--transport=http`:
 
 ## Token Efficiency
 
+### Limit Control
+
+AI assistants have full control over query limits. The environment variables set what value is used when the AI doesn't specify a limit. They do NOT cap what the AI can request.
+
+| Tool | Default | Parameter | Description |
+|------|---------|-----------|-------------|
+| Logs | 200 | `limit` | Log lines to return |
+| Metrics (timeseries) | 1000 | `pointLimit` | Data points per series (controls resolution) |
+| General tools | 50 | `limit` | Results to return |
+
+Defaults can be configured via `MCP_DEFAULT_*` environment variables.
+
 ### Compact Mode (Logs)
 
 Use `compact: true` when searching logs to reduce token usage. Strips custom attributes and keeps only essential fields:
@@ -234,23 +252,57 @@ The `diverse` mode normalizes messages (strips UUIDs, timestamps, IPs, numbers)
 
 ## Events Aggregation
 
-Find the noisiest monitors with a single query:
+### Top Monitors Report (Best for Weekly/Daily Meteo)
+
+Get top alerting monitors with automatic context breakdown by queue, service, ingress, pod, etc:
 
 ```
 events({ action: "top", from: "7d", limit: 10 })
 ```
 
-Returns:
+Returns nested structure perfect for reports:
 ```json
 {
   "top": [
-    { "rank": 1, "name": "Error budget (SLI)", "alertCount": 44, "lastAlert": "..." },
-    { "rank": 2, "name": "High number of ready messages", "alertCount": 38, "lastAlert": "..." }
+    {
+      "rank": 1,
+      "name": "High number of ready messages",
+      "monitor_id": 67860480,
+      "total_count": 50,
+      "by_context": [
+        {"context": "queue:state-status_tasks", "count": 30},
+        {"context": "queue:updated_order_service", "count": 20}
+      ]
+    },
+    {
+      "rank": 2,
+      "name": "Nginx 5XX errors",
+      "monitor_id": 134611486,
+      "total_count": 42,
+      "by_context": [
+        {"context": "ingress:trusk-api", "count": 29},
+        {"context": "ingress:backoffice", "count": 13}
+      ]
+    }
   ]
 }
 ```
 
-For more control, use `aggregate` with custom groupBy:
+Context tags are auto-extracted: `queue:`, `service:`, `ingress:`, `pod_name:`, `kube_namespace:`, `kube_container_name:`
+
+### Tag Discovery
+
+Discover available tag prefixes in your alert data:
+
+```
+events({ action: "discover", from: "7d", tags: ["source:alert"] })
+```
+
+Returns: `{tagPrefixes: ["queue", "service", "ingress", "pod_name", "monitor", "priority"], sampleSize: 150}`
+
+### Custom Aggregation
+
+For custom grouping patterns, use `aggregate`:
 
 ```
 events({
@@ -261,7 +313,7 @@ events({
 })
 ```
 
-Supported groupBy fields: `monitor_name`, `priority`, `alert_type`, `source`, `status`, `host`
+Supported groupBy fields: `monitor_name`, `priority`, `alert_type`, `source`, `status`, `host`, or any tag prefix
 
 The aggregation uses v2 API with cursor pagination to stream through events efficiently (up to 10k events).