---
title: Tools Reference
description: >-
  Detailed reference for all tools available in the Datadog Code Security MCP
  Server, including parameters, required binaries, and output formats.
breadcrumbs: >-
  Docs > Datadog Security > Code Security > Developer Tool Integrations > Code
  Security MCP Server > Tools Reference
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Tools Reference

{% callout %}
# Important note for users on the following Datadog sites: app.ddog-gov.com, us2.ddog-gov.com

{% alert level="danger" %}
This product is not supported for your selected [Datadog site](https://docs.datadoghq.com/getting_started/site.md). ({% placeholder "user-datadog-site-name" /%}).
{% /alert %}

{% /callout %}

The [Datadog Code Security MCP Server](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md) exposes the following tools for AI coding assistants and CLI usage. Scan tools wrap one or more Datadog security binaries and accept file paths or directories to scan. `datadog_library_vulnerability_scan` queries Datadog by package URL and does not scan a local tree.

{% alert level="info" %}
This MCP server is separate from the [Datadog MCP Server](https://docs.datadoghq.com/mcp_server.md), which provides cloud-based access to Datadog features and data. The Code Security MCP Server runs locally and focuses on code-level security scanning. To query findings already stored in Datadog, see [Query findings already in Datadog](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md#query-findings-already-in-datadog).
{% /alert %}

## `datadog_code_security_scan`{% #datadog_code_security_scan %}

Run SAST, secrets detection, SCA, and IaC scanning in parallel.

`min_sast_severity` applies only to the SAST portion of the scan. It defaults to `LOW`. In-source suppressed findings are excluded. When some scanners are not installed, the tool returns results from the scanners that succeeded and an error for each scanner that failed.

### Parameters{% #parameters %}

| Parameter           | Type            | Required | Description                                                                                         |
| ------------------- | --------------- | -------- | --------------------------------------------------------------------------------------------------- |
| `file_paths`        | `array[string]` | Yes      | File paths or directories to scan                                                                   |
| `working_dir`       | `string`        | No       | Base directory for resolving relative paths (defaults to the current directory)                     |
| `min_sast_severity` | `string`        | No       | Minimum SAST severity to return: `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL`. Default: `LOW`. SAST only. |

### Required binaries{% #required-binaries %}

`datadog-static-analyzer`, `datadog-sbom-generator`, `datadog-security-cli`, `datadog-iac-scanner`

## `datadog_sast_scan`{% #datadog_sast_scan %}

Run Static Application Security Testing (SAST) to detect security vulnerabilities in first-party code.

`min_sast_severity` defaults to `LOW`. In-source suppressed findings are excluded.

### Parameters{% #parameters-1 %}

| Parameter           | Type            | Required | Description                                                                              |
| ------------------- | --------------- | -------- | ---------------------------------------------------------------------------------------- |
| `file_paths`        | `array[string]` | Yes      | File paths or directories to scan                                                        |
| `working_dir`       | `string`        | No       | Base directory for resolving relative paths                                              |
| `min_sast_severity` | `string`        | No       | Minimum SAST severity to return: `LOW`, `MEDIUM`, `HIGH`, or `CRITICAL`. Default: `LOW`. |

### Required binary{% #required-binary %}

`datadog-static-analyzer`

## `datadog_secrets_scan`{% #datadog_secrets_scan %}

Detect hardcoded credentials, API keys, passwords, and tokens in source code and configuration files.

### Parameters{% #parameters-2 %}

| Parameter     | Type            | Required | Description                                 |
| ------------- | --------------- | -------- | ------------------------------------------- |
| `file_paths`  | `array[string]` | Yes      | File paths or directories to scan           |
| `working_dir` | `string`        | No       | Base directory for resolving relative paths |

### Required binary{% #required-binary-1 %}

`datadog-static-analyzer`

## `datadog_sca_scan`{% #datadog_sca_scan %}

Run SCA to detect known vulnerabilities (CVEs) in your project's dependencies. This tool performs a two-step process:

1. Generates a Software Bill of Materials (SBOM) from the specified directories.
1. Scans the SBOM for known vulnerabilities using Datadog's vulnerability database.

### Parameters{% #parameters-3 %}

| Parameter     | Type            | Required | Description                                 |
| ------------- | --------------- | -------- | ------------------------------------------- |
| `file_paths`  | `array[string]` | Yes      | Directories to scan for dependencies        |
| `working_dir` | `string`        | No       | Base directory for resolving relative paths |

### Output{% #output %}

Vulnerabilities with CVE ID, severity, affected component, version, and description.

### Required binaries{% #required-binaries-1 %}

`datadog-sbom-generator`, `datadog-security-cli`

## `datadog_iac_scan`{% #datadog_iac_scan %}

Detect misconfigurations, compliance issues, and security vulnerabilities in IaC files.

### Parameters{% #parameters-4 %}

| Parameter     | Type            | Required | Description                                 |
| ------------- | --------------- | -------- | ------------------------------------------- |
| `file_paths`  | `array[string]` | Yes      | Directories containing IaC files to scan    |
| `working_dir` | `string`        | No       | Base directory for resolving relative paths |

### Output{% #output-1 %}

Security findings with severity, rule, file location, and remediation guidance.

### Required binary{% #required-binary-2 %}

`datadog-iac-scanner`

### Supported IaC formats{% #supported-iac-formats %}

- Terraform
- CloudFormation
- Kubernetes manifests
- Dockerfiles
- GitHub Actions

## `datadog_generate_sbom`{% #datadog_generate_sbom %}

Generate a comprehensive SBOM listing all software components, dependencies, versions, and licenses in a repository.

### Parameters{% #parameters-5 %}

| Parameter     | Type     | Required | Description                                                                |
| ------------- | -------- | -------- | -------------------------------------------------------------------------- |
| `path`        | `string` | No       | Path to repository or directory to analyze (defaults to current directory) |
| `working_dir` | `string` | No       | Base directory for the scan (defaults to current directory)                |

### Output{% #output-2 %}

JSON containing a summary (total components, breakdown by language/package manager, license statistics) and a detailed component list (name, version, type, license, package URL).

### Supported package managers{% #supported-package-managers %}

| Language   | Package managers                          |
| ---------- | ----------------------------------------- |
| .NET       | NuGet                                     |
| C++        | Conan                                     |
| Go         | Go modules                                |
| Java       | Gradle, Maven                             |
| JavaScript | npm, pnpm, Yarn                           |
| PHP        | Composer                                  |
| Python     | pdm, pipenv, poetry, requirements.txt, uv |
| Ruby       | Bundler                                   |
| Rust       | Cargo                                     |

{% alert level="info" %}
If the repository uses a package manager not listed above, or if the tool returns zero components, the AI assistant can generate an SBOM by reading lock files (`package.json`, `requirements.txt`, `go.mod`, `pom.xml`, `Gemfile.lock`, `Cargo.lock`, `composer.lock`, and similar files) and extracting dependencies directly.
{% /alert %}

## `datadog_library_vulnerability_scan`{% #datadog_library_vulnerability_scan %}

Look up known vulnerabilities for specific libraries by package URL (PURL). This tool calls the Datadog API and does not scan a local codebase. Use `datadog_sca_scan` when you want to scan a project tree.

Requires `DD_API_KEY` and `DD_APP_KEY`.

### Parameters{% #parameters-6 %}

| Parameter     | Type            | Required | Description                                                                     |
| ------------- | --------------- | -------- | ------------------------------------------------------------------------------- |
| `libraries`   | `array[object]` | Yes      | Libraries to scan. Each object uses the fields in the table below.              |
| `working_dir` | `string`        | No       | Working directory for Git context detection (defaults to the current directory) |

Each entry in `libraries`:

| Field             | Type      | Required | Description                                                         |
| ----------------- | --------- | -------- | ------------------------------------------------------------------- |
| `purl`            | `string`  | Yes      | Package URL, for example `pkg:maven/com.cronutils/cron-utils@9.1.2` |
| `is_direct`       | `boolean` | No       | Whether this is a direct dependency                                 |
| `is_dev`          | `boolean` | No       | Whether this is a development-only dependency                       |
| `package_manager` | `string`  | No       | Package manager, for example `MAVEN`, `NPM`, or `GOLANG`            |

### Output{% #output-3 %}

Vulnerabilities with CVE ID, GHSA ID, severity, CVSS score, affected library, remediation, fix versions, and exploit availability.

## Further reading{% #further-reading %}

Additional helpful documentation, links, and articles:

- [Code Security MCP Server overview and setup](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md)
- [Troubleshooting the Code Security MCP Server](https://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server/troubleshooting.md)