Auth and security - official Datadog server
Datadog Code Security MCP server
A local stdio MCP server that wraps Datadog security binaries to run SAST, secrets detection, SCA, IaC scanning and SBOM generation on source code from an AI coding assistant. It runs locally from datadog-labs/pack/datadog-code-security-mcp (homebrew) with API key auth.
Last verified 7 tools3 sources
Install
Claude Code
About Claude Codeclaude mcp add datadog-code-security \
-e DD_API_KEY=<DATADOG_API_KEY> \
-e DD_APP_KEY=<DATADOG_APP_KEY> \
-e DD_SITE=<YOUR_DATADOG_SITE> \
-- datadog-code-security-mcp startCodex
About Codex[mcp_servers.datadog-code-security]
command = "datadog-code-security-mcp"
args = ["start"]
[mcp_servers.datadog-code-security.env]
DD_API_KEY = "<DATADOG_API_KEY>"
DD_APP_KEY = "<DATADOG_APP_KEY>"
DD_SITE = "<YOUR_DATADOG_SITE>"Cursor
About Cursor{
"mcpServers": {
"datadog-code-security": {
"command": "datadog-code-security-mcp",
"args": ["start"],
"env": {
"DD_API_KEY": "<DATADOG_API_KEY>",
"DD_APP_KEY": "<DATADOG_APP_KEY>",
"DD_SITE": "<YOUR_DATADOG_SITE>"
}
}
}
}VS Code
{
"mcp": {
"servers": {
"datadog-code-security": {
"command": "datadog-code-security-mcp",
"args": ["start"],
"env": {
"DD_API_KEY": "<DATADOG_API_KEY>",
"DD_APP_KEY": "<DATADOG_APP_KEY>",
"DD_SITE": "<YOUR_DATADOG_SITE>"
}
}
}
}
}Generic
brew update
brew install datadog-labs/pack/datadog-code-security-mcpTools
datadog_code_security_scan- SAST, secrets, SCA, and IaC in parallel.
datadog_sast_scan- Static Application Security Testing.
datadog_secrets_scan- Hardcoded secrets detection.
datadog_sca_scan- Dependency vulnerability scanning (CVEs).
datadog_iac_scan- Infrastructure-as-Code security scanning.
datadog_generate_sbom- Software Bill of Materials generation (no auth required).
datadog_library_vulnerability_scan- Library vulnerability lookup by package URL.
As documented on October 17, 2026. A running server reports its current list through tools/list.
Notes and caveats
- In Preview.
- Separate from the remote Datadog MCP Server; local-only.
- Requires a Datadog API key and application key (DD_API_KEY, DD_APP_KEY, optional DD_SITE) for every scan except SBOM generation.
- Needs the Datadog scanner binaries installed separately (datadog-static-analyzer, datadog-sbom-generator, datadog-security-cli, datadog-iac-scanner).
- Runs on macOS and Linux (amd64, arm64) and Windows (amd64); SCA is not supported on Windows and the IaC scanner is not available on macOS amd64.
- Not supported on GovCloud sites.
- The generic field holds the documented Homebrew install command; the server starts with 'datadog-code-security-mcp start'.
More MCP servers for auth and security
- DatadogStatus: GA
Datadog MCP server
Datadog's remote MCP server that gives AI agents access to logs, metrics, traces, monitors, dashboards, incidents, notebooks and other Datadog products, with optional product toolsets.
Transport: Streamable HTTPAuth: OAuth or API key - 1Password
1Password Device Trust MCP server
Self-hosted Python MCP server that exposes the 1Password Device Trust (formerly Kolide) API so agents can query devices, people, checks, issues and live query campaigns, with auto-pagination and aggregation helpers. It runs locally over Streamable HTTP or stdio.
Transport: Streamable HTTP, stdioAuth: API key - 1PasswordStatus: Beta
1Password Environments MCP server
Local stdio MCP server built into the 1Password desktop app that lets agents create, list and rename 1Password Environments, list variable names, add variables and create locally mounted .env files. It never returns secret values to the client.
Transport: stdioAuth: Other - 1Password
MCP server for 1Password SaaS Manager
MCP server exposing the 1Password SaaS Manager (formerly Trelica) API, covering audit logs, applications, workflows, people and teams, contracts and assets. Available as a hosted read-only remote server or a local sm-mcp binary that can optionally enable writes.
Transport: Streamable HTTP, stdioAuth: OAuth - Auth0Status: Beta
Auth0 MCP server
Local MCP server that connects AI clients to an Auth0 tenant through the Management API to create and update applications, APIs, client grants, Actions and Forms, read logs, and onboard a project with an Auth0 SDK quickstart.
Transport: stdioAuth: OAuth - Clerk
Clerk MCP server
Remote MCP server that lets AI agents work with a Clerk account, including creating and configuring applications, managing users, checking domains and setting up production instances, and returns Clerk SDK snippets.
Transport: Streamable HTTPAuth: OAuth
Related reading
- What's New in Mastra (Late 2026): Harness, AgentController GA, Eval Gates and MCP 2.xMastra in late 2026: goals, schedules, signals, AgentController GA, eval gates and MCP 2.x, with type-checked TypeScript examples and honest tradeoffs.
- MCP vs A2A vs Function Calling: Which Layer Does What in 2026MCP vs A2A vs function calling compared on the 2026-07-28 MCP spec and A2A 1.0: what each protocol does, where they overlap, and how to stack them.
- Pydantic AI V2 in Late 2026: Capabilities, Graphs, Evals and MCPPydantic AI V2 explained through v2.57.0: capabilities, typed output, Conversation storage, caching, graphs, evals, MCP Apps and Logfire, with checked code.
- Reverse Engineer Anything (REA): What the MCP Server Does and Where the Line IsREA (Reverse Engineer Anything) is an MIT-licensed MCP server that lets Claude Code, Codex or Cursor inspect binaries, Electron apps and APKs. How to try it.
- Claude Opus 5.5 Built a Browser 3D World: The Higgsfield MCP WorkflowClaude Opus 5.5 and Higgsfield MCP built an interactive 3D Library of Alexandria in the browser. The verified connector setup and where the workflow holds up.
- Pi 1.0 Release Guide: MCP, Codemode and Pi DurablePi 1.0 adds built-in MCP through Codemode, a fullscreen TUI by default and Pi Durable. What changed, how to install it, and what breaks on upgrade.
FAQ
What does the Datadog Code Security MCP server do?
A local stdio MCP server that wraps Datadog security binaries to run SAST, secrets detection, SCA, IaC scanning and SBOM generation on source code from an AI coding assistant. The vendor documents 7 tools, including datadog_code_security_scan, datadog_sast_scan, datadog_secrets_scan and datadog_sca_scan.
How do I add the Datadog Code Security MCP server to Claude Code?
Datadog documents a Claude Code config; copy it from the Claude Code section of this page. Snippets for Codex, Cursor, VS Code and Generic are there too.
Does the Datadog Code Security MCP server need authentication?
Yes, API key. Transport: stdio. Status: Preview, last checked October 17, 2026.
Sources
Last verified against 3 Datadog pages, then re-checked independently.
- docs.datadoghq.comhttps://docs.datadoghq.com/security/code_security/dev_tool_int/mcp_server.md
- docs.datadoghq.comhttps://docs.datadoghq.com/mcp_server.md
- raw.githubusercontent.comhttps://raw.githubusercontent.com/datadog-labs/datadog-code-security-mcp/main/LICENSE
Newsletter
New MCP servers, the week they ship
One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.