Datadog Code Security MCP

Datadog Code Security MCP provides all Code Security scan tools to AI coding assistants like Claude Desktop, Cursor, etc - Can also be used as a CLI tool.

Note: The Datadog Code Security MCP server is currently in Preview

Available MCP Tools

1. datadog_code_security_scan - SAST + Secrets + SCA + IAC in parallel
2. datadog_sast_scan - Static Application Security Testing only
3. datadog_secrets_scan - Secrets detection only
4. datadog_sca_scan - Software Composition Analysis (dependency vulnerabilities)
5. datadog_iac_scan - Infrastructure as code scanning
6. datadog_generate_sbom - Generate Software Bill of Materials (SBOM)

Quick Start

Installation

Homebrew (Recommended):

brew tap datadog-labs/pack
brew update
brew install datadog-labs/pack/datadog-code-security-mcp

Alternative: Download from GitHub Releases

# macOS / Linux (auto-detects platform)
curl -L "https://github.com/datadog-labs/datadog-code-security-mcp/releases/latest/download/datadog-code-security-mcp-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m).tar.gz" | tar xz
sudo install -m 755 datadog-code-security-mcp /usr/local/bin/

Verify installation:

datadog-code-security-mcp version

⚠️ Requirements:

The MCP server requires external Datadog security binaries to perform scans.

Note: If a required binary is missing, the MCP server will detect this and provide platform-specific installation instructions.

Integrations

The MCP Server requires Datadog API key and application key as DD_API_KEY and DD_APP_KEY

Claude Configuration

# Configure with API keys
claude mcp add datadog-code-security \
  -e DD_API_KEY=<your-api-key> \
  -e DD_APP_KEY=<your-app-key> \
  -e DD_SITE=datadoghq.com \
  -- datadog-code-security-mcp start

# Verify it's running
claude mcp list | grep datadog-code-security

Manual Configuration (~/.claude/config.json)

{
  "mcpServers": {
    "datadog-code-security": {
      "command": "datadog-code-security-mcp",
      "args": ["start"],
      "env": {
        "DD_API_KEY": "<your-api-key>",
        "DD_APP_KEY": "<your-app-key>",
        "DD_SITE": "datadoghq.com"
      }
    }
  }
}

Cursor Configuration

Cursor supports MCP servers through its settings. Add the following to your Cursor MCP configuration:

{
  "mcpServers": {
    "datadog-code-security": {
      "command": "datadog-code-security-mcp",
      "args": ["start"],
      "env": {
        "DD_API_KEY": "<your-api-key>",
        "DD_APP_KEY": "<your-app-key>",
        "DD_SITE": "datadoghq.com"
      }
    }
  }
}

Usage

Once configured, ask your AI assistant to scan your code:

Security Scans:

• "Scan this directory for security vulnerabilities"
• "Check if there are any hardcoded secrets in config/"
• "Run a full security scan (SAST + Secrets + SCA)"
• "Find all security issues in this project"

Dependency Analysis:

• "Scan for vulnerable dependencies"
• "Check if my dependencies have any known CVEs"
• "Generate an SBOM for this project"
• "What dependencies does this project have?"

Direct Scanning with CLI

# Comprehensive scan (SAST + Secrets + SCA in parallel)
datadog-code-security-mcp scan all ./src

# Individual scan types
datadog-code-security-mcp scan sast ./app      # SAST only
datadog-code-security-mcp scan secrets ./config # Secrets only
datadog-code-security-mcp scan sca ./           # SCA only (requires datadog-security-cli)

# SBOM generation
datadog-code-security-mcp generate-sbom .           # Generate SBOM

# JSON output for programmatic use
datadog-code-security-mcp scan all ./src --json
datadog-code-security-mcp scan sast ./app --json
datadog-code-security-mcp generate-sbom . --json

Manual Installation Instructions for Requirements (Optional)

datadog-static-analyzer (SAST + Secrets)

# macOS (Homebrew — tap is already added if you installed the MCP server via brew)
brew install datadog-static-analyzer

datadog-sbom-generator (SBOM)

# macOS / Linux (download from GitHub releases)
curl -L "https://github.com/DataDog/datadog-sbom-generator/releases/latest/download/datadog-sbom-generator_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m).zip" -o /tmp/sbom.zip
unzip -o /tmp/sbom.zip -d /tmp/ && mkdir -p ~/.local/bin && mv /tmp/datadog-sbom-generator ~/.local/bin/ && chmod +x ~/.local/bin/datadog-sbom-generator

datadog-security-cli (SCA)

# macOS (Homebrew)
brew install --cask datadog-security-cli

Telemetry Data Collection

Datadog Code Security MCP collects usage telemetry (tool and scanner versions, OS/arch, run duration, success/failure, aggregate counts, coarse authentication/workspace metadata, categorized error kinds, a fixed team ownership tag, and a random install ID stored on your machine) to help improve the tool. It does not collect source code, paths, scan finding contents, secrets, repository names, usernames, or raw error messages. Each error carries a short curated, path-free description (for Error Tracking) — never the raw error text.

Scanner versions are collected once per process and are not persisted. Telemetry events sent to Datadog are retained for 30 days.

To disable collection of any of this usage telemetry, use any of the following:

# Per-invocation flag
datadog-code-security-mcp --no-telemetry scan sast ./src

# Environment variable (add to your shell profile to make it permanent)
export DD_CODE_SECURITY_TELEMETRY_DISABLED=1

# DO_NOT_TRACK standard (https://consoledonottrack.com/)
export DO_NOT_TRACK=1

Full details on what is collected, the install ID, and how to turn off data collection: docs/TELEMETRY.md.

Please see the Datadog Privacy Policy for more information.

For Developers

Quick References:

• CLAUDE.md - Developer guide for Claude Code
• AGENTS.md - Quick reference for AI coding assistants
• docs/RELEASE.md - Release process

Key Commands:

make build          # Build binary
make test           # Run tests with race detector
make lint           # Run linters
go run ./cmd/datadog-code-security-mcp version

License

Apache 2.0