Este producto no es compatible con el
sitio Datadog seleccionado. (
).
Preview
Datadog Code Security MCP Server is in Preview.
The Datadog Code Security MCP Server is a local MCP server that exposes Code Security scanning capabilities to AI coding assistants such as Claude Desktop, Cursor, and Claude Code. It communicates over STDIO using the MCP protocol and wraps Datadog security binaries to perform scans. It can also be used as a CLI tool.
This MCP server is separate from the
Datadog MCP Server, which provides cloud-based access to Datadog features and data. The Code Security MCP Server runs locally and focuses on code-level security scanning.
The MCP server exposes the following tools that AI coding assistants can call to run security scans on your codebase:
For detailed parameters, required binaries, and output formats for each tool, see the Tools Reference.
Setup
Prerequisites
The MCP server supports Static Application Security Testing (SAST), secrets detection, Software Composition Analysis (SCA), and Infrastructure-as-Code (IaC) scanning, all of which require a Datadog API key and application key. For instructions on creating them, see API and Application Keys.
Install the MCP server
The MCP server is available on the following platforms:
| Platform | Architectures |
|---|
| macOS | amd64, arm64 |
| Linux | amd64, arm64 |
| Windows | amd64 |
Homebrew (recommended)
brew update
brew install --cask datadog-labs/pack/datadog-code-security-mcp
GitHub releases
curl -L "https://github.com/datadog-labs/datadog-code-security-mcp/releases/latest/download/datadog-code-security-mcp-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m).tar.gz" | tar xz
sudo install -m 755 datadog-code-security-mcp /usr/local/bin/
Run the following command to verify the installation:
datadog-code-security-mcp version
Install security binaries
The MCP server calls the following Datadog security binaries to perform scans. Install the ones you need for the scan types you want to use:
| Binary | Used For | Install Method |
|---|
datadog-static-analyzer | SAST, Secrets | brew install datadog-static-analyzer |
datadog-sbom-generator | SBOM, SCA | GitHub releases |
datadog-security-cli | SCA | brew install --cask datadog/tap/datadog-security-cli |
datadog-iac-scanner | IaC | GitHub releases |
datadog-sbom-generator and datadog-security-cli are not available on Windows. datadog-iac-scanner is not available on macOS amd64.
Each client configuration requires the following environment variables:
*Required for SAST, Secrets, SCA, and IaC scanning. SBOM generation works without authentication.
Use the Claude CLI to add the MCP server:
claude mcp add datadog-code-security \
-e DD_API_KEY=<your-api-key> \
-e DD_APP_KEY=<your-app-key> \
-e DD_SITE=datadoghq.com \
-- datadog-code-security-mcp start
Verify the configuration:
claude mcp list | grep datadog-code-security
Add the following to your Claude Desktop configuration file:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"datadog-code-security": {
"command": "datadog-code-security-mcp",
"args": ["start"],
"env": {
"DD_API_KEY": "<your-api-key>",
"DD_APP_KEY": "<your-app-key>",
"DD_SITE": "datadoghq.com"
}
}
}
}
Add the following to your Cursor MCP settings (~/.cursor/mcp.json):
{
"mcpServers": {
"datadog-code-security": {
"command": "datadog-code-security-mcp",
"args": ["start"],
"env": {
"DD_API_KEY": "<your-api-key>",
"DD_APP_KEY": "<your-app-key>",
"DD_SITE": "datadoghq.com"
}
}
}
}
Add the following to your VS Code settings (.vscode/settings.json or user settings):
{
"mcp": {
"servers": {
"datadog-code-security": {
"command": "datadog-code-security-mcp",
"args": ["start"],
"env": {
"DD_API_KEY": "<your-api-key>",
"DD_APP_KEY": "<your-app-key>",
"DD_SITE": "datadoghq.com"
}
}
}
}
}
For any other MCP-compatible client, use the following configuration pattern:
- Command:
datadog-code-security-mcp - Arguments:
["start"] - Transport: STDIO
- Environment variables:
DD_API_KEY, DD_APP_KEY, DD_SITE
Usage examples
AI assistant prompts
After configuration, ask your AI assistant to perform scans using natural language:
| Scan Type | Example Prompt |
|---|
| Comprehensive | “Run a full security scan on this project” |
| SAST | “Scan src/ for security vulnerabilities” |
| Secrets detection | “Check if there are any hardcoded secrets in config/” |
| SCA | “Check if the project’s dependencies have any known CVEs” |
| IaC | “Check the Terraform files for misconfigurations” |
| SBOM generation | “Generate an SBOM for this project” |
CLI commands
The MCP server can also be used directly as a CLI tool.
Run a comprehensive scan across all scan types:
datadog-code-security-mcp scan all ./src
Run individual scan types:
datadog-code-security-mcp scan sast ./src
datadog-code-security-mcp scan secrets ./config
datadog-code-security-mcp scan sca ./
datadog-code-security-mcp scan iac ./terraform
Generate an SBOM:
datadog-code-security-mcp generate-sbom .
Add --json to any command for JSON output:
datadog-code-security-mcp scan all ./src --json
datadog-code-security-mcp generate-sbom . --json
Further Reading
Más enlaces, artículos y documentación útiles:
