MCP compliance catalog

Runs agent-authored TypeScript inside a Datadog-managed sandbox with a live Datadog client, so a single call can read or move any data the connection's scope permits.

Runs read-only shell commands such as cat and ls on a targeted host, exposing on-host files, configuration, and potentially secrets to the caller.

Scans code for hardcoded secrets and surfaces detected AWS keys, API keys, and passwords, concentrating credential locations in one result set.

Adds an agent trigger to a workflow and publishes it, turning a static workflow into one an agent can invoke autonomously in production.

Replaces an existing detection rule in full, which can broaden, narrow, or silence the conditions under which security signals fire.

Removes one or more custom detection rules, eliminating the signals they would have raised and leaving the covered threats unmonitored.

Adds a suppression rule that stops a detection rule from generating signals for matching activity, potentially masking real attacks.

Mutes security findings so they no longer surface in alerts or dashboards, hiding them from responders until unmuted.

Blocks an IP, user, or user agent at the WAF with an expiration, immediately denying the target access to protected applications.

Unblocks a previously denylisted entity by expiring its block, restoring access for an IP, user, or user agent that was being denied.

Creates or updates a WAF exclusion filter that suppresses rules on a matched target, reducing protection coverage on that surface.

Runs an arbitrary DDSQL query across infrastructure, logs, RUM, and span datasets, exposing broad observability data in a single request.