Better Stack vs Datadog MCP Server

Better Stack 55

148 tools are named on the docs page, more than 30 (5). X-MCP-Tools-Only and X-MCP-Tools-Except narrow the list to a subset or a read-only set, documented for that purpose, and the server has no default toolset (add 10, so 15). REST lists take page and per_page up to 250 with first, last, prev and next links, and filters by url, pronounceable_name and team_name. Plan query windows splits a long telemetry query into windows, and Execute query takes SQL with its own LIMIT. No field selection (16 of 20). 422 bodies name the field that failed and 401 gives a message, but no error code list exists and MCP errors are not documented (10 of 20). No idempotency keys. Upsert catalog records avoids duplicates, Reopen incident is limited to 24 hours, and the annotations on the tools couldn't be read (6 of 20). Get workspace style defaults are not described. Two Terraform providers and logging clients exist, but no official API SDK in any language, and the Claude plugin's 16 skills carry the query recipes (8 of 15). 15 + 16 + 10 + 6 + 8 = 55.

Datadog MCP Server 78

More than 30 toolsets chosen with the toolsets parameter, omit_tools per the 30 September check, whoami and toolsets resources, and a core set trimmed by about 15 per cent in March. An execute_code toolset runs sandboxed TypeScript against the APIs instead of one tool per call. We couldn't count the default tools (20). limit, cursors, custom_attributes, token budgets and flattening on aggregates, and exclude_fields on Kubernetes manifests (19). The changelog shows a steady effort on actionable errors (15). OAuth read-only grants omit write tools, an org setting blocks MCP writes, and read-only calls retry automatically. We couldn't confirm tool annotations (12). Official Datadog API clients in several languages and Python agent examples in the repository (12).

Better Stack 40

Read with the hosted rubric. No x402, MPP or L402 (0). Per-unit prices are public without login, by GB and region for telemetry, per responder, per status page and per phone number (20). The Free plan has 10 monitors, a status page and 3 GB of logs, the signup page says Sign up for free and names no card, and we did not run the signup flow (20). A person signs up in a browser and mints a token or completes OAuth there (0). 0 + 20 + 20 + 0 = 40.

Datadog MCP Server 20

No x402, MPP or L402 (0). Datadog plan prices are public and the MCP quota of 100,000 calls a month per organisation is published, but there's no MCP price or per-call rate (10). A free Datadog plan exists per the 30 September check, and nothing we read says whether it includes MCP, so half (10). A person signs up and authorises OAuth or creates keys (0).

Better Stack 60

OAuth sign-in with a Full access level chosen at consent, or API tokens that are global or scoped to one team with Read & write or read access, minted and deleted in Settings. No scopes finer than read and write, no expiry and no PKCE or dynamic registration documented (24 of 30). Read-level tokens and consent, the two header allowlists, and the rule that comments can only be changed by their author or a token. No confirmation step before Remove monitor, Remove dashboard, Resolve incident or Remove team member (12 of 20). Logs, spans, errors and replays are untrusted text returned to the model, and no injection guidance was found in the MCP docs (2 of 15). Audit logs record every API token request with actor_type api_token and the token's name, never its value, and can be streamed to a Telemetry source or any URL, though the pricing page lists audit logs as a $250 a month add-on (12 of 15). SOC 2 Type 2 with the report on request, third-party penetration tests, security@betterstack.com for disclosures. No security.txt (404), no bug bounty and no disclosure policy page (10 of 20). 24 + 12 + 2 + 12 + 10 = 60.

Datadog MCP Server 76

OAuth 2.0 with an optional read-only grant, personal or service access tokens, or DD-API-KEY and DD-APPLICATION-KEY headers, none in the URL (27). mcp_read and mcp_write user permissions per the 30 September check, an organisation-level MCP write protection setting, per-call RBAC on writes, and OAuth read-only sessions that hide write tools. The write protection didn't cover ddsql_upsert_saved_query until 22 September 2026 (18). Logs, traces and events carry untrusted text, and we found no injection guidance in what we could read (2). Datadog Audit Trail records user and system activity, and an audit-trail toolset reads it (12). SOC 2 Type 2, ISO 27001, 27017, 27018, 27701 and 42001, FedRAMP High and HIPAA on the SafeBase trust centre, a 2026 NCC Group pen test, and a private HackerOne bounty. No security.txt, which returns 404 (17).

Better Stack 46

The server is closed and tools/list needs sign-in, so the tool schemas were not read, and no OpenAPI file was found for the REST APIs in the docs, the GitHub organisation or a search. Partial credit for a typed contract that exists but isn't public (10 of 25). No llms.txt on betterstack.com or its docs, and no Markdown twins (0). The MCP docs page gives one line per tool and says when some apply, such as Reopen incident within 24 hours and the instruction tools to call before Execute query. The REST reference pages describe each endpoint in a sentence (12 of 20). Inputs are typed only in the REST docs, with parameter tables, monitor types and status values listed in prose, and no schema to validate against (7 of 15). Every REST page carries a curl example and a 200 body; Create monitor documents a 422 with errors keyed by field, the Usage API a 401 and a 429, and no error code list exists (9 of 15). The APIs are versioned v2 in the path. The changelog is a product feed of 19 entries since March 2025 with the MCP server among them, with no API changelog and no deprecation notes (8 of 15). 10 + 0 + 12 + 7 + 9 + 8 = 46.

Datadog MCP Server 60

Tool schemas are only visible through tools/list with an account. The changelog shows typed parameters, for example limit 1 to 1,000 and percentile enums, so we gave partial credit for a contract we couldn't read (15). We couldn't check docs.datadoghq.com/llms.txt because our fetch proxy refused it, and the listing doesn't record one (0). Changelog entries show descriptions being corrected, such as search_pr_insights now explaining that expected means pending (10). Ranges, cursors, enums and attribute selectors per the changelog (11). Errors are being made actionable, with reversed time windows rejected up front and an explicit result_too_large failure (9). A dated public changelog with 102 entries since 9 March 2026 and a versioned /v1 URL (15).