# Better Stack vs Datadog MCP Server (slim)

> Better Stack scores 54.2 (C) to Datadog's 50.8 (D) for observability logs. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/better-stack-vs-datadog-mcp.md (~5,150 tokens) · this version ~3,180 tokens · JSON https://www.anchorterminal.com/compare/better-stack-vs-datadog-mcp.json · canonical https://www.anchorterminal.com/compare/better-stack-vs-datadog-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-04
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Better Stack scores 54.2 (C) on agent readiness against Datadog MCP Server's 50.8 (D), and leads in 3 of 7 scored categories. Datadog MCP Server leads on schema & documentation, agent ergonomics and security & auth. Both do observability logs.

- Better Stack: C 54.2, rank #811 of 1349 · https://www.anchorterminal.com/tools/better-stack.min.md
- Datadog MCP Server: D 50.8, rank #933 of 1349 · https://www.anchorterminal.com/tools/datadog-mcp.min.md
- Better Stack, good for An agent that investigates incidents, queries logs and metrics with SQL, manages monitors and posts status page updates for a team already on Better Stack, with the Claude plugin as the shortest route. Ahead on Reliability, 50 against 33; Payments & pricing, 40 against 20. Also No incidents deducted, where Datadog MCP Server loses 6 points for them.
- Datadog MCP Server, good for Agents that triage production issues across metrics, logs, traces and monitors in a Datadog org. sentry-mcp is narrower and deeper on errors, pagerduty-mcp covers on-call. Ahead on Schema & documentation, 60 against 46; Agent ergonomics, 78 against 55; Security & auth, 76 against 60. Also Runs on your own machine.

| Category | Better Stack | Datadog MCP Server |
| --- | --- | --- |
| Reliability (16%) | 50 | 33 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 46 | 60 |
| Agent ergonomics (13%) | 55 | 78 |
| Security & auth (14%) | 60 | 76 |
| Payments & pricing (10%) | 40 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 71 | 68 |
| Transparency & trust (7%) | 69 | 69 |

| Fact (where they differ) | Better Stack | Datadog MCP Server |
| --- | --- | --- |
| Vendor | Better Stack, Inc. | Datadog |
| Hosted endpoint | `https://mcp.betterstack.com` | `https://mcp.datadoghq.com/v1/mcp` |
| Transports | Streamable HTTP | Streamable HTTP, stdio |
| Pricing | Freemium | Your plan |
| Price for observability logs | $0.10 per GB of traffic | not published |
| Licence | Proprietary hosted service under the Better Stack Terms of Use. The Claude, Cursor and Codex plugins and the Terraform providers on GitHub are MIT | MIT |
| Tools exposed | 148 | none |
| Last release | 2026-11-02 | 2026-10-16 |
| Popularity | 6 stars | 43 stars |
| Agent reviews | none | 2.5/5 (2) |

Why the edge:
- Agent ergonomics, Datadog MCP Server +23: Better Stack 55 (148 tools are named on the docs page, more than 30 (5). X-MCP-Tools-Only and X-MCP-Tools-Except narrow the list to a subset or a read-only set, documented for that purpose, and the server has no default toolset (add 10, so 15). REST lists take page and per_page up to 250 with first, last, prev and next links, and filters by url, pronounceable_name and team_name. Plan query windows splits a long telemetry query into windows, and Execute query takes SQL with its own LIMIT. No field selection (16 of 20). 422 bodies name the field that failed and 401 gives a message, but no error code list exists and MCP errors are not documented (10 of 20). No idempotency keys. `Upsert catalog records` avoids duplicates, Reopen incident is limited to 24 hours, and the annotations on the tools couldn't be read (6 of 20). Get workspace style defaults are not described. Two Terraform providers and logging clients exist, but no official API SDK in any language, and the Claude plugin's 16 skills carry the query recipes (8 of 15). 15 + 16 + 10 + 6 + 8 = 55.); Datadog MCP Server 78 (More than 30 toolsets chosen with the `toolsets` parameter, `omit_tools` per the 30 September check, `whoami` and `toolsets` resources, and a core set trimmed by about 15 per cent in March. An `execute_code` toolset runs sandboxed TypeScript against the APIs instead of one tool per call. We couldn't count the default tools (20). `limit`, cursors, `custom_attributes`, token budgets and flattening on aggregates, and `exclude_fields` on Kubernetes manifests (19). The changelog shows a steady effort on actionable errors (15). OAuth read-only grants omit write tools, an org setting blocks MCP writes, and read-only calls retry automatically. The 13 October entry says `execute_code` is now marked read-only so that clients asking approval for write-capable tools classify it correctly, but no entry names readOnlyHint or destructiveHint, so the annotation credit isn't added (12). Official Datadog API clients in several languages and Python agent examples in the repository (12).)
- Payments & pricing, Better Stack +20: Better Stack 40 (Read with the hosted rubric. No x402, MPP or L402 (0). Per-unit prices are public without login, by GB and region for telemetry, per responder, per status page and per phone number (20). The Free plan has 10 monitors, a status page and 3 GB of logs, the signup page says Sign up for free and names no card, and we did not run the signup flow (20). A person signs up in a browser and mints a token or completes OAuth there (0). 0 + 20 + 20 + 0 = 40.); Datadog MCP Server 20 (No x402, MPP or L402 (0). Datadog plan prices are public and the MCP quota of 100,000 calls a month per organisation is published, but there's no MCP price or per-call rate (10). A free Datadog plan exists per the 30 September check, and nothing we read says whether it includes MCP, so half (10). A person signs up and authorises OAuth or creates keys (0). Pricing pages weren't re-read on 4 November (paused host); readings per the 1 October check.)
- Reliability, Better Stack +17: Better Stack 50 (Read with the hosted lines and scored on the remote MCP server at mcp.betterstack.com, which fronts the same service as the Incidents and Telemetry APIs. status.betterstack.com runs on Better Stack's own status page product with three components and a 90-day history (20). Between 5 August and 3 November 2026 it records delayed Telemetry data processing in the Europe region from 3 to 6 September in entries of 6 hours 19 minutes, 10 hours 10 minutes, 19 hours 13 minutes, 21 hours 45 minutes and 1 day, a 9-minute Telemetry degradation on 20 August, 39 minutes of wrong downtime notifications on 21 October and 8 minutes of dashboard unavailability on 2 November, every one labelled degraded, plus two migrations labelled maintenance (11 hours 13 minutes on 9 August and 17 hours). About four days of delayed log processing in one region is more than trivial and less than an outage of the API, so between minor-only and one major (15). No rate limit numbers were found in the API or MCP docs (0). The Usage API documents a 429 with the instruction to wait before retrying, with no Retry-After, no backoff guidance and no idempotency keys. `Upsert catalog records` is documented as not creating duplicates when repeated (5 of 15). No SLA. The terms supply the service as is, and the enterprise page lists SLA reporting as a feature (0). The MCP server was announced on 15 September 2025 and carries no beta label (10). 20 + 15 + 0 + 5 + 0 + 10 = 50.); Datadog MCP Server 33 (Scored as a hosted MCP server. status.datadoghq.com now answers robots.txt with an S3 AccessDenied 403, which this run reads as a refusal, so the 1 October reading of its front page (components with no MCP component, three late-September incidents in other products) is struck. Datadog's Acceptable Use Policy also bars robots from its sites, so nothing more was requested. With no component reading left, the status-page line is 0, and the 90-day incident history is unread (5). The changelog publishes a burst limit of 50 calls per 10 seconds and a monthly quota of 100,000 tool calls per organisation, doubled from 50,000 on 28 August (15). Read-only software-delivery calls are retried on transient failures and `get_datadog_k8s_manifest` explains what to do when rate limited, but no Retry-After or backoff guidance for MCP clients was found. The 5 is kept from 1 October as a partly met line (5). No SLA found (0). GA since 9 March 2026 on the stable /v1 URL since 20 July, with some toolsets still experimental, kept at 8 as partly met (8). 0+5+15+5+0+8 = 33.)
- Security & auth, Datadog MCP Server +16: Better Stack 60 (OAuth sign-in with a Full access level chosen at consent, or API tokens that are global or scoped to one team with Read & write or read access, minted and deleted in Settings. No scopes finer than read and write, no expiry and no PKCE or dynamic registration documented (24 of 30). Read-level tokens and consent, the two header allowlists, and the rule that comments can only be changed by their author or a token. No confirmation step before Remove monitor, Remove dashboard, Resolve incident or Remove team member (12 of 20). Logs, spans, errors and replays are untrusted text returned to the model, and no injection guidance was found in the MCP docs (2 of 15). Audit logs record every API token request with actor_type api_token and the token's name, never its value, and can be streamed to a Telemetry source or any URL, though the pricing page lists audit logs as a $250 a month add-on (12 of 15). SOC 2 Type 2 with the report on request, third-party penetration tests, security@betterstack.com for disclosures. No security.txt (404), no bug bounty and no disclosure policy page (10 of 20). 24 + 12 + 2 + 12 + 10 = 60.); Datadog MCP Server 76 (OAuth 2.0 with an optional read-only grant, personal or service access tokens, or `DD-API-KEY` and `DD-APPLICATION-KEY` headers, none in the URL (27). `mcp_read` and `mcp_write` user permissions per the 30 September check, an organisation-level MCP write protection setting, per-call RBAC on writes, and OAuth read-only sessions that hide write tools. The write protection didn't cover `ddsql_upsert_saved_query` until 22 September 2026 (18). Logs, traces and events carry untrusted text, and we found no injection guidance in what we could read (2). Datadog Audit Trail records user and system activity, and an `audit-trail` toolset reads it (12). SOC 2 Type 2, ISO 27001, 27017, 27018, 27701 and 42001, FedRAMP High and HIPAA on the SafeBase trust centre, a 2026 NCC Group pen test, and a private HackerOne bounty. No security.txt, which returns 404 (17). The trust centre, security page and docs weren't re-read on 4 November (Datadog's Acceptable Use Policy bars robots), so the 1 October readings stand as not re-read.)
- Schema & documentation, Datadog MCP Server +14: Better Stack 46 (The server is closed and tools/list needs sign-in, so the tool schemas were not read, and no OpenAPI file was found for the REST APIs in the docs, the GitHub organisation or a search. Partial credit for a typed contract that exists but isn't public (10 of 25). No llms.txt on betterstack.com or its docs, and no Markdown twins (0). The MCP docs page gives one line per tool and says when some apply, such as Reopen incident within 24 hours and the instruction tools to call before Execute query. The REST reference pages describe each endpoint in a sentence (12 of 20). Inputs are typed only in the REST docs, with parameter tables, monitor types and status values listed in prose, and no schema to validate against (7 of 15). Every REST page carries a curl example and a 200 body; Create monitor documents a 422 with errors keyed by field, the Usage API a 401 and a 429, and no error code list exists (9 of 15). The APIs are versioned v2 in the path. The changelog is a product feed of 19 entries since March 2025 with the MCP server among them, with no API changelog and no deprecation notes (8 of 15). 10 + 0 + 12 + 7 + 9 + 8 = 46.); Datadog MCP Server 60 (Tool schemas are only visible through tools/list with an account. The changelog shows typed parameters, for example `limit` 1 to 1,000 and percentile enums, so we gave partial credit for a contract we couldn't read (15). We couldn't check docs.datadoghq.com/llms.txt because our fetch proxy refused it, and the listing doesn't record one (0). Changelog entries show descriptions being corrected, such as `search_pr_insights` now explaining that `expected` means pending (10). Ranges, cursors, enums and attribute selectors per the changelog (11). Errors are being made actionable, with reversed time windows rejected up front and an explicit `result_too_large` failure (9). A dated public changelog with 113 entries from 9 March to 16 October 2026 and a versioned /v1 URL (15). The docs host is paused under Datadog's Acceptable Use Policy, so the 1 October readings are kept, not re-read on 4 November.)