--- title: Agentic Onboarding for App and API Protection description: >- Instrument your applications with App and API Protection using the Pup CLI or the Datadog MCP Server. breadcrumbs: >- Docs > Datadog Security > App and API Protection > Agentic Onboarding for App and API Protection --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Agentic Onboarding for App and API Protection {% callout %} # Important note for users on the following Datadog sites: us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} ## Overview{% #overview %} Agentic Onboarding is a set of AI-driven tools that automate Datadog instrumentation for your applications and infrastructure: - Pup CLI: Set up Datadog from a terminal with `pup setup`, without a coding assistant. - MCP server: Set up Datadog through a coding assistant (such as Claude Code or Cursor), which handles framework detection and configuration from your IDE. The two paths are complementary and use the same Datadog account. You can install the Datadog MCP Server in your IDE and run the CLI in a terminal. ## Pup CLI{% #pup-cli %} The [Pup CLI](https://docs.datadoghq.com/cli.md) sets up Datadog from your terminal. It doesn't need your own coding assistant or AI model, so setup doesn't use your model tokens. Use the CLI when: - You don't have access to your own coding assistant or AI model. - You don't want to spend your model tokens on setup. - You don't want to install an MCP server. - You need to create a Datadog account, which the MCP setup doesn't support. The Pup CLI can: - Create a Datadog account end-to-end from the terminal - Link an existing Datadog account to your local environment - Instrument local infrastructure as code (Terraform, Helm, Kustomize, Ansible, Pulumi, raw Kubernetes manifests, Docker Compose files) by editing files in place - Instrument local application code by adding SDK initialization and configuration for supported frontends and backends ### Prerequisites{% #prerequisites %} - Node.js 22 or later. `pup setup` runs Datadog's setup package with `npx`, so it needs Node.js even if you installed Pup with Homebrew or a prebuilt binary. ### Supported products{% #supported-products %} The Pup CLI can set up the following products. Pass the value in the `--product` column to the `--product` flag: | Product | `--product` | | -------------------------------------- | ------------------------ | | Agent Observability | `llm-obs` | | Amazon ECS | `ecs` | | App and API Protection | `app_and_api_protection` | | Code Coverage | `ci_code_coverage` | | Docker | `docker` | | Error Tracking | `error-tracking` | | Infrastructure Monitoring (Kubernetes) | `infra-monitoring` | | Linux | `linux` | | OpenTelemetry | `otel` | | Product Analytics | `product-analytics` | | Real User Monitoring (RUM) | `rum` | | Serverless Monitoring | `serverless` | | Studio | `studio` | | Test Optimization | `test-optimization` | #### Product-specific flags{% #product-specific-flags %} Some products accept extra, optional flags alongside `--product`. Each flag takes a value: | `--product` | Flags | | ---------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `ci_code_coverage`, `llm-obs`, `serverless`, `test-optimization` | `--api-key`: Datadog API key. | | `docker` | `--products`: Comma-separated products to enable: `infra`, `apm`, `logs`. Defaults to all three.`--library-versions`: Tracer library versions, such as `java:v1,python:v4`.`--env`: Environment tag. Sets `DD_ENV`. | | `ecs` | `--ecs-launch-type`: `fargate` or `ec2`.`--ecs-deployment-method`: `cli`, `terraform`, `cdk`, or `cloudformation`. | | `error-tracking`, `product-analytics`, `rum`, `studio` | `--rum-application-id` (alias: `--app-id`): RUM application ID. | | `infra-monitoring` | `--enabled-products` (alias: `--k8s-products`): Comma-separated products to enable, such as `infrastructure,logs,apm,otel`.`--k8s-distro`: Kubernetes distribution, such as `gke`, `eks`, `aks`, or `minikube`.`--k8s-cluster-name`: Cluster name.`--k8s-env-name`: Environment tag.`--k8s-library-versions`: Tracer library versions, such as `java:v1,python:v4`.`--k8s-target-namespaces`: Comma-separated namespaces to include.`--k8s-disabled-namespaces`: Comma-separated namespaces to exclude.`--k8s-registry`: Container registry for Datadog images, such as a mirror or private registry. | | `linux` | `--products`: Comma-separated products to enable: `infra`, `apm`, `logs`, `otel`. Defaults to `infra,apm,logs`.`--env`: Environment tag. Sets `DD_ENV`. | | `llm-obs` | `--llm-obs-app`: LLM application name. Sets `DD_LLMOBS_ML_APP`. | | `product-analytics`, `rum` | `--rum-client-token`: RUM client token. | | `rum` | `--rum-framework`: `react`, `vue`, `angular`, `nextjs`, `browser`, `react-native`, or `expo`. | | `serverless` | `--serverless-compute-type`: `aws-lambda`, `gcp-cloud-run`, `gcp-cloud-run-functions`, or `azure-container-apps`.`--serverless-runtime`: `nodejs`, `python`, `java`, `ruby`, `dotnet`, `go`, or `php` (`php` is supported for Cloud Run and Container Apps only).`--development-framework`: `aws-cdk`, `aws-sam`, `serverless-framework`, `terraform`, `ci`, or `other`.`--use-otel true`: Instrument with the OpenTelemetry SDK, sending directly to the Datadog OTLP intake. | For example: ```shell npx @datadog/pup setup --site datadoghq.com --product ecs --ecs-launch-type fargate --ecs-deployment-method terraform ``` ### Run the setup command{% #run-the-setup-command %} Run `pup setup` with `npx`, passing `--site` to target your [Datadog site](https://docs.datadoghq.com/getting_started/site.md) (). You don't need to install Pup first, because `npx` downloads it. If Pup is already [installed](https://docs.datadoghq.com/cli.md), run `pup setup` directly instead of `npx @datadog/pup setup`, using the same flags. If you've logged in with [`pup auth login`](https://docs.datadoghq.com/cli.md#authentication), `pup setup` uses that login. You have two options, depending on whether you already have a Datadog account: {% tab title="Interactive setup" %} 1. Use this option if you don't have a Datadog account, or if you want the CLI to recommend products based on your code analysis. The CLI steps you through account setup, repository analysis, and product recommendations. ```shell npx @datadog/pup setup --site datadoghq.com ``` Replace the value of `--site` with the Datadog site for your account: (). 1. Press `Enter` at the welcome screen and choose whether you have a Datadog account. A browser opens for OAuth (or for account creation if you don't have an account yet). Complete the flow and grant access to your Datadog account. 1. Enter the path to the repository you want to instrument. 1. With your consent, the CLI analyzes the repository in read-only mode to detect your stack. 1. Based on the detected stack, the CLI recommends up to three supported Datadog products. Recommendations are selected by default. Deselect individual recommendations, confirm the selection, or choose **View all setup options** to use the full list of setup options instead. {% /tab %} {% tab title="Direct setup" %} 1. Use this option if you already have a Datadog account and know which product you want to install. Add the `--product` flag to go straight to setup and skip repository analysis and product recommendations. ```shell npx @datadog/pup setup --site datadoghq.com --product ``` - Replace the value of `--site` with the Datadog site for your account: (). - Replace `` with one of the products listed in the Supported products section. - Optionally, add any of the product-specific flags for that product. 1. Press `Enter` at the welcome screen and choose whether you have a Datadog account. A browser opens for OAuth (or for account creation if you don't have an account yet). Complete the flow and grant access to your Datadog account. {% /tab %} #### Configure and verify your setup{% #configure-and-verify-your-setup %} 1. If the CLI can't generate recommendations, or doesn't find a strong match for your repository, it directs you to the full list of setup options. {% image source="https://docs.dd-static.net/images/agentic_onboarding/product-selection.b68d48ebf716242ba857f84d020180f7.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/agentic_onboarding/product-selection.b68d48ebf716242ba857f84d020180f7.png?auto=format&fit=max&w=850&dpr=2 2x" alt="CLI menu 'What would you like to set up?' grouped by Infrastructure and Backend monitoring, Frontend Monitoring, LLM-Based applications, and CI Testing." /%} 1. The CLI detects your project's frameworks, applies the required configuration, and provisions any necessary environment variables. Progress is reported stage by stage. {% image source="https://docs.dd-static.net/images/agentic_onboarding/setup-example.1d35e611b7013018c2c1d773da79ca30.png?auto=format&fit=max&w=850 1x, https://docs.dd-static.net/images/agentic_onboarding/setup-example.1d35e611b7013018c2c1d773da79ca30.png?auto=format&fit=max&w=850&dpr=2 2x" alt="CLI showing 'Instrumenting your app, Stage 1 of 3: Datadog RUM (Real User Monitoring)' with progress steps." /%} 1. When setup completes, the CLI lists the products it instrumented and links to the Datadog UI to verify incoming data. 1. Commit the changes to your repository. You can edit the Datadog environment variables (API keys, application IDs) for your specific environment. After the CLI completes, see the Next steps section to confirm data is flowing. ### Headless mode{% #headless-mode %} Headless mode is designed for unattended setups. An AI coding agent, CI job, or script can run the CLI directly in your repository and complete Datadog instrumentation on its own. No person needs to be present to approve prompts or make interactive choices. Headless mode turns on automatically when a [supported AI coding agent](https://docs.datadoghq.com/cli.md#agent-mode) starts `pup setup`, or when there's no interactive terminal, such as in a CI job. To enable it manually, add `--headless`: ```shell DD_API_KEY= DD_APP_KEY= \ npx @datadog/pup setup \ --headless \ --site datadoghq.com \ --product rum ``` In headless mode: - `--site` is optional. If you leave it out, `pup setup` uses the `DD_SITE` environment variable, then the site from your Pup login or config file, then `datadoghq.com`. - `--product` is optional. If you leave it out, `pup setup` analyzes the repository and sets up the top recommended product. To see the recommendations without changing anything, add `--recommend-only`, which prints them as JSON and exits. Headless mode signs in with the first of these that's available: 1. Your Pup login, or the `DD_ACCESS_TOKEN` environment variable. If either is present, `pup setup` ignores `DD_API_KEY` and `DD_APP_KEY`. 1. The `DD_API_KEY` and `DD_APP_KEY` [environment variables](https://docs.datadoghq.com/account_management/api-app-keys.md). Provide both variables together. 1. Browser OAuth. The setup command opens a browser so you can log in. This is the only step in headless mode that requires user input, and it needs a localhost callback. On remote machines or fully unattended runs, use one of the other options. By running `pup setup` in headless mode, you confirm that source-code upload and automatic command execution are authorized for the target project. This applies whether you add `--headless` or headless mode turns on automatically. ## MCP Server{% #mcp-server %} The Datadog MCP Server exposes the `onboarding` toolset to any MCP-compatible coding assistant. After you install and authenticate the server, you instrument a project by typing a one-line prompt. The agent reads your code, calls MCP tools (with your permission), applies changes, and verifies the result. ### Prerequisites{% #prerequisites-1 %} - An MCP-compatible coding assistant, such as [Claude Code](https://claude.com/product/claude-code) or [Cursor](https://cursor.com/) - A Datadog account ### Supported frameworks{% #supported-frameworks %} | Product | Frameworks | | ------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Error Tracking, RUM, Product Analytics | Android, Angular, iOS, Next.js, React, Svelte, Vanilla JS, Vue | | Kubernetes Observability | Helm, Kustomize, raw manifests, Terraform, Pulumi, Ansible (across GKE, EKS, AKS, minikube, and others such as kind, k3s, and OpenShift) | | Docker Observability | `docker-compose` and sidecar (`docker run`) deployments; Terraform, Ansible, and other IaC (Pulumi, CloudFormation, Puppet, Chef) | | Linux Observability | Terraform, Ansible, other IaC (Pulumi, CloudFormation, Puppet, Chef), and plain-shell install | | Serverless Monitoring (AWS Lambda) | AWS SAM, AWS CDK, Serverless Framework, Terraform, `datadog-ci lambda instrument` | | Serverless Monitoring (GCP Cloud Run and Cloud Run Functions) | Terraform, `gcloud run deploy`, Cloud Run YAML, Dockerfile, Gen 2 `gcloud functions deploy` | | Serverless Monitoring (Azure Container Apps) | Terraform, Bicep, ARM template, `azure.yaml` (azd), `az containerapp` CLI | | Agent Observability | OpenAI, Anthropic, LangChain, Vercel AI SDK (auto-detected from project dependencies) | | OpenTelemetry | Node.js / server-side TS, Browser JS / React / Vite, Python (Django, Flask, FastAPI), Java, Go | | App and API Protection | Python, Node.js, Java, Go, Ruby, .NET, PHP, and proxies (Envoy, HAProxy) for Linux, Windows, Kubernetes, Docker, GCP Cloud Run, and AWS Lambda, AWS Fargate/ECS | | Code Coverage, Test Optimization | Jest, Vitest, Mocha, Playwright, Cypress, pytest, unittest, JUnit, TestNG, RSpec, minitest, xUnit, NUnit, MSTest v2, `go test`, XCTest / Swift Testing | ### Step 1: Install the MCP Server{% #step-1-install-the-mcp-server %} {% tab title="Claude Code" %} In an active Claude Code session, run: ``` claude mcp add --transport http datadog-onboarding- "?toolsets=onboarding" ``` {% /tab %} {% tab title="Cursor" %} **Option 1: Install deeplink (recommended)** Click the install deeplink for your [Datadog site](https://docs.datadoghq.com/getting_started/site.md), then confirm Install for the `datadog-onboarding-` server when Cursor opens. ``` ``` **Option 2: Manual configuration** Add the server to `~/.cursor/mcp.json`: ``` { "mcpServers": { "datadog-onboarding-": { "url": "?toolsets=onboarding" } } } ``` {% /tab %} {% tab title="Other MCP clients" %} Any MCP client that supports HTTP transport can connect to the Datadog MCP Server. Point it at the endpoint for your [Datadog site](https://docs.datadoghq.com/getting_started/site.md): ``` ?toolsets=onboarding ``` {% /tab %} ### Step 2: Authenticate the MCP Server{% #step-2-authenticate-the-mcp-server %} 1. After you install the MCP Server, your coding assistant prompts you to authenticate. Press `Enter` to open the Datadog OAuth screen in your browser. 1. After authentication completes, choose Open to return to your IDE and grant the MCP Server access to your Datadog account. 1. Confirm that MCP tools appear under the `datadog-onboarding-` server. ### Step 3: Instrument your project{% #step-3-instrument-your-project %} Send the prompt that matches the product you want to set up: {% tab title="Error Tracking" %} ```text Add Datadog Error Tracking to my project ``` {% /tab %} {% tab title="Real User Monitoring" %} ```text Add Datadog Real User Monitoring to my project ``` {% /tab %} {% tab title="Product Analytics" %} ```text Add Datadog Product Analytics to my project ``` {% /tab %} {% tab title="Infrastructure Monitoring" %} **Kubernetes** ```text Add Datadog for Kubernetes to my project ``` **Docker** ```text Add Datadog for Docker to my project ``` {% /tab %} {% tab title="App and API Protection" %} ```text Add Datadog App and API Protection to my project ``` {% /tab %} {% tab title="Serverless Monitoring" %} **AWS Lambda** ```text Add Datadog for AWS Lambda to my project ``` ```shell npx @datadog/pup setup --product serverless --serverless-compute-type=aws-lambda ``` **GCP Cloud Run containers** ```text Add Datadog for GCP Cloud Run containers to my project ``` ```shell npx @datadog/pup setup --product serverless --serverless-compute-type=gcp-cloud-run ``` **GCP Cloud Run functions** ```text Add Datadog for GCP Cloud Run functions to my project ``` ```shell npx @datadog/pup setup --product serverless --serverless-compute-type=gcp-cloud-run-functions ``` **Azure Container Apps** ```text Add Datadog for Azure Container Apps to my project ``` ```shell npx @datadog/pup setup --product serverless --serverless-compute-type=azure-container-apps ``` {% /tab %} The agent detects your stack, requests permission before each tool call, applies changes locally (without committing them), and prints verification steps. After the agent completes, commit the changes to your repository and set any new environment variables (API keys, application IDs) in your production environment. Then see the Next steps section to confirm data is flowing. ## Next steps{% #next-steps %} Confirm data is flowing in the Datadog UI for the product you set up: - [Error Tracking](https://app.datadoghq.com/error-tracking) - [App and API Protection](https://app.datadoghq.com/security/appsec) - [RUM > Applications](https://app.datadoghq.com/rum/list) - [Infrastructure > Hosts](https://app.datadoghq.com/infrastructure) - [Serverless > Functions](https://app.datadoghq.com/functions) - [Logs > Live Tail](https://app.datadoghq.com/logs/livetail) ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Instrument serverless apps with agentic onboarding](https://www.datadoghq.com/blog/serverless-agentic-onboarding/)