Datadog expands MCP Server for Kubernetes and process investigations

Four tools examine Kubernetes control plane health

The Datadog MCP Server now provides four read-only tools for assessing a Kubernetes cluster in a single call. Agents can inspect API server signals such as request error rates, rate-limited client requests, maximum in-flight requests, rejected requests, and queued requests.

Separate tools cover the scheduler, controller manager, and etcd. Scheduler data includes scheduling attempts and durations, while controller manager data covers work queue depth, processing duration, goroutine counts, and thread counts. The etcd tool checks signals including leader availability, leader changes, failed write proposals, backend commit duration, WAL fsync duration, and peer round-trip time.

Each tool accepts a cluster name through the kube_cluster_name parameter and an optional time window. The default window is the last 10 minutes, while queries can cover up to 4 hours. Before querying metrics, the tool checks whether Datadog recognizes the specified cluster.

Live Processes adds evidence about individual processes

The search_datadog_live_processes tool gives AI agents access to recent process observations collected by Datadog’s Live Processes. Agents can search by executable, command line, tags, or observation time to determine whether a process is running, when it started, and which user owns it.

Returned information can include the executable and command line, process and parent process IDs, process owner, host, start time, last observation time, and process tags. Searches can use exact tags such as host, service, env, Kubernetes metadata, and user:<name>.

The default search window is 15 minutes. Live Processes retains observations for 36 hours, and individual queries can cover up to 1 hour. Datadog says an internal evaluation using live production data tested 10 natural-language scenarios with three runs per scenario. Answer correctness rose from 10% without the tool to 96.7% with it, based on whether returned process records matched the public API.

Controls help agents work with large process results

Datadog says a single Kubernetes process can carry more than a hundred tags from its host, container, cluster, and cloud environment. Returning all tags for every process could consume a large part of an agent’s context before analysis begins.

To limit response size, the Live Processes search tool applies a default token budget of 10,000 tokens. It also provides pagination cursors and indicates when results have been truncated, allowing agents to recognize incomplete responses and refine their searches.

The control plane tools use telemetry already collected by Datadog. They do not execute commands inside Kubernetes clusters or modify cluster resources. Access follows the calling user’s permissions, including Timeseries Query, Metrics Read, and Hosts Read. Together with Datadog’s existing Kubernetes MCP tools for finding and inspecting resources, the additions can help agents connect workload symptoms with cluster-level health and process-level evidence.