--- title: Tools Reference description: >- Detailed reference for all tools available in the Datadog Code Security MCP Server, including parameters, required binaries, and output formats. breadcrumbs: >- Docs > Datadog Security > Code Security > Developer Tool Integrations > Code Security MCP Server > Tools Reference --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Tools Reference {% callout %} # Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com {% alert level="danger" %} This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}). {% /alert %} {% /callout %} The [Datadog Code Security MCP Server](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md) exposes the following tools for AI coding assistants and CLI usage. Scan tools wrap one or more Datadog security binaries and accept file paths or directories to scan. `datadog_library_vulnerability_scan` queries Datadog by package URL and does not scan a local tree. {% alert level="info" %} This MCP server is separate from the [Datadog MCP Server](https://docs.datadoghq.com/mcp_server.md), which provides cloud-based access to Datadog features and data. The Code Security MCP Server runs locally and focuses on code-level security scanning. To query findings already stored in Datadog, see [Query findings already in Datadog](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md#query-findings-already-in-datadog). {% /alert %} ## `datadog_code_security_scan`{% #datadog_code_security_scan %} Run SAST, secrets detection, SCA, and IaC scanning in parallel. `min_sast_severity` applies only to the SAST portion of the scan. It defaults to `LOW`. In-source suppressed findings are excluded. When some scanners are not installed, the tool returns results from the scanners that succeeded and an error for each scanner that failed. ### Parameters{% #parameters %} | Parameter | Type | Required | Description | | ------------------- | --------------- | -------- | --------------------------------------------------------------------------------------------------- | | `file_paths` | `array[string]` | Yes | File paths or directories to scan | | `working_dir` | `string` | No | Base directory for resolving relative paths (defaults to the current directory) | | `min_sast_severity` | `string` | No | Minimum SAST severity to return: `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL`. Default: `LOW`. SAST only. | ### Required binaries{% #required-binaries %} `datadog-static-analyzer`, `datadog-sbom-generator`, `datadog-security-cli`, `datadog-iac-scanner` ## `datadog_sast_scan`{% #datadog_sast_scan %} Run Static Application Security Testing (SAST) to detect security vulnerabilities in first-party code. `min_sast_severity` defaults to `LOW`. In-source suppressed findings are excluded. ### Parameters{% #parameters-1 %} | Parameter | Type | Required | Description | | ------------------- | --------------- | -------- | ---------------------------------------------------------------------------------------- | | `file_paths` | `array[string]` | Yes | File paths or directories to scan | | `working_dir` | `string` | No | Base directory for resolving relative paths | | `min_sast_severity` | `string` | No | Minimum SAST severity to return: `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL`. Default: `LOW`. | ### Required binary{% #required-binary %} `datadog-static-analyzer` ## `datadog_secrets_scan`{% #datadog_secrets_scan %} Detect hardcoded credentials, API keys, passwords, and tokens in source code and configuration files. ### Parameters{% #parameters-2 %} | Parameter | Type | Required | Description | | ------------- | --------------- | -------- | ------------------------------------------- | | `file_paths` | `array[string]` | Yes | File paths or directories to scan | | `working_dir` | `string` | No | Base directory for resolving relative paths | ### Required binary{% #required-binary-1 %} `datadog-static-analyzer` ## `datadog_sca_scan`{% #datadog_sca_scan %} Run SCA to detect known vulnerabilities (CVEs) in your project's dependencies. This tool performs a two-step process: 1. Generates a Software Bill of Materials (SBOM) from the specified directories. 1. Scans the SBOM for known vulnerabilities using Datadog's vulnerability database. ### Parameters{% #parameters-3 %} | Parameter | Type | Required | Description | | ------------- | --------------- | -------- | ------------------------------------------- | | `file_paths` | `array[string]` | Yes | Directories to scan for dependencies | | `working_dir` | `string` | No | Base directory for resolving relative paths | ### Output{% #output %} Vulnerabilities with CVE ID, severity, affected component, version, and description. ### Required binaries{% #required-binaries-1 %} `datadog-sbom-generator`, `datadog-security-cli` ## `datadog_iac_scan`{% #datadog_iac_scan %} Detect misconfigurations, compliance issues, and security vulnerabilities in IaC files. ### Parameters{% #parameters-4 %} | Parameter | Type | Required | Description | | ------------- | --------------- | -------- | ------------------------------------------- | | `file_paths` | `array[string]` | Yes | Directories containing IaC files to scan | | `working_dir` | `string` | No | Base directory for resolving relative paths | ### Output{% #output-1 %} Security findings with severity, rule, file location, and remediation guidance. ### Required binary{% #required-binary-2 %} `datadog-iac-scanner` ### Supported IaC formats{% #supported-iac-formats %} - Terraform - CloudFormation - Kubernetes manifests - Dockerfiles - GitHub Actions ## `datadog_generate_sbom`{% #datadog_generate_sbom %} Generate a comprehensive SBOM listing all software components, dependencies, versions, and licenses in a repository. ### Parameters{% #parameters-5 %} | Parameter | Type | Required | Description | | ------------- | -------- | -------- | -------------------------------------------------------------------------- | | `path` | `string` | No | Path to repository or directory to analyze (defaults to current directory) | | `working_dir` | `string` | No | Base directory for the scan (defaults to current directory) | ### Output{% #output-2 %} JSON containing a summary (total components, breakdown by language/package manager, license statistics) and a detailed component list (name, version, type, license, package URL). ### Supported package managers{% #supported-package-managers %} | Language | Package managers | | ---------- | ----------------------------------------- | | .NET | NuGet | | C++ | Conan | | Go | Go modules | | Java | Gradle, Maven | | JavaScript | npm, pnpm, Yarn | | PHP | Composer | | Python | pdm, pipenv, poetry, requirements.txt, uv | | Ruby | Bundler | | Rust | Cargo | {% alert level="info" %} If the repository uses a package manager not listed above, or if the tool returns zero components, the AI assistant can generate an SBOM by reading lock files (`package.json`, `requirements.txt`, `go.mod`, `pom.xml`, `Gemfile.lock`, `Cargo.lock`, `composer.lock`, and similar files) and extracting dependencies directly. {% /alert %} ## `datadog_library_vulnerability_scan`{% #datadog_library_vulnerability_scan %} Look up known vulnerabilities for specific libraries by package URL (PURL). This tool calls the Datadog API and does not scan a local codebase. Use `datadog_sca_scan` when you want to scan a project tree. Requires `DD_API_KEY` and `DD_APP_KEY`. ### Parameters{% #parameters-6 %} | Parameter | Type | Required | Description | | ------------- | --------------- | -------- | ------------------------------------------------------------------------------- | | `libraries` | `array[object]` | Yes | Libraries to scan. Each object uses the fields in the table below. | | `working_dir` | `string` | No | Working directory for Git context detection (defaults to the current directory) | Each entry in `libraries`: | Field | Type | Required | Description | | ----------------- | --------- | -------- | ------------------------------------------------------------------- | | `purl` | `string` | Yes | Package URL, for example `pkg:maven/com.cronutils/cron-utils@9.1.2` | | `is_direct` | `boolean` | No | Whether this is a direct dependency | | `is_dev` | `boolean` | No | Whether this is a development-only dependency | | `package_manager` | `string` | No | Package manager, for example `MAVEN`, `NPM`, or `GOLANG` | ### Output{% #output-3 %} Vulnerabilities with CVE ID, GHSA ID, severity, CVSS score, affected library, remediation, fix versions, and exploit availability. ## `datadog_ephemeral_sast_scan`{% #datadog_ephemeral_sast_scan %} Run one local, unpublished SAST rule against a repository. The caller supplies the rule JavaScript and the tree-sitter query. The tool does not require `DD_API_KEY` or `DD_APP_KEY`. The scan runs only the supplied rule but still follows the repository's [Static Code Analysis configuration](https://docs.datadoghq.com/security/code_security/static_analysis/configuration.md): `ignore-paths`, `only-paths`, `max-file-size-kb`, and `use-gitignore`. ### Parameters{% #parameters-7 %} | Parameter | Type | Required | Description | | ------------------- | --------------- | -------- | --------------------------------------------------------------------------------------- | | `rule_code` | `string` | Yes | Rule JavaScript source, not base64-encoded | | `tree_sitter_query` | `string` | Yes | Tree-sitter query source, not base64-encoded | | `language` | `string` | Yes | Language of the rule, for example `TYPESCRIPT`, `JAVASCRIPT`, `PYTHON`, `GO`, or `JAVA` | | `directory` | `string` | No | Repository directory to scan (defaults to the current directory) | | `rule_name` | `string` | No | Rule name inside the temporary ruleset | | `paths` | `array[string]` | No | Files or subdirectories inside `directory` to scan. Omit to scan the whole directory. | ### Output{% #output-4 %} Violations reported by the rule, grouped by file. If the rule throws an exception, fails to compile, or times out on any file, the tool returns an error that lists those files instead. ### Required binary{% #required-binary-3 %} `datadog-static-analyzer` version 0.9.10 or later. If you have an earlier version, see [Scanner upgrade required](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server/troubleshooting.md#scanner-upgrade-required). ## `datadog_promote_sast_rule`{% #datadog_promote_sast_rule %} Save an approved SAST rule as a [custom rule](https://docs.datadoghq.com/security/code_security/static_analysis/custom_rules.md) in Datadog. The tool uploads the rule exactly as it receives it, and only after the user approves it. Before saving, the tool runs the rule on the two `tests` examples and saves nothing if either example's finding count differs from its `annotation_count` or if the rule fails. If a rule with the same name exists, the tool does not replace it unless `overwrite` is `true`. Scans use the saved rule only after the repository configuration lists its ruleset (`security-variants` by default). Add it under `sast.use-rulesets` in `code-security.datadog.yaml`. When the only configuration file is `static-analysis.datadog.yml` or `static-analysis.datadog.yaml`, add the ruleset to its `rulesets` list. If both files exist, `code-security.datadog.yaml` takes precedence over the legacy file. See [Static Code Analysis configuration](https://docs.datadoghq.com/security/code_security/static_analysis/configuration.md). Requires `DD_API_KEY` and `DD_APP_KEY`. ### Parameters{% #parameters-8 %} | Parameter | Type | Required | Description | | ------------------- | --------------- | -------- | ----------------------------------------------------------------------------------------------------------------- | | `user_confirmed` | `boolean` | Yes | Must be `true`. Set it only after the user approves the rule. | | `rule_code` | `string` | Yes | Rule JavaScript source, not base64-encoded | | `tree_sitter_query` | `string` | Yes | Tree-sitter query source, not base64-encoded | | `language` | `string` | Yes | Language of the rule, for example `TYPESCRIPT` | | `rule_name` | `string` | Yes | Lowercase rule name, 5-32 characters | | `ruleset_name` | `string` | No | Lowercase ruleset name, 5-32 characters. Default: `security-variants`. | | `overwrite` | `boolean` | No | Replace a rule that already exists. Default: `false`. | | `short_description` | `string` | No | One-line summary, at most 60 characters | | `description` | `string` | No | Description stored on the rule | | `tests` | `array[object]` | Yes | Exactly two examples: the fixed code and the code before the fix. Each object uses the fields in the table below. | Rule and ruleset names can contain lowercase letters, digits, and single hyphens. They cannot start or end with a hyphen. Each entry in `tests`: | Field | Type | Required | Description | | ------------------ | --------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | | `filename` | `string` | Yes | Filename without directories. Its extension must match the rule's `language`, for example `.ts` for `TYPESCRIPT`. | | `code` | `string` | Yes | Example source, not base64-encoded | | `annotation_count` | `integer` | Yes | Number of findings the rule must report on this example: `0` for the fixed code, and a positive number (usually `1`) for the code before the fix | ### Output{% #output-5 %} The ruleset name, rule name, and revision ID of the saved rule. ### Required binary{% #required-binary-4 %} `datadog-static-analyzer` version 0.9.10 or later, to run the rule on the examples before saving. ## Further reading{% #further-reading %} Additional helpful documentation, links, and articles: - [Code Security MCP Server overview and setup](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md) - [Troubleshooting the Code Security MCP Server](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server/troubleshooting.md)