Datadog's MCP Server Now Runs Code — and Cuts AI Agent Investigation Costs 73% in the Process

The Datadog MCP Server launched with a specific architecture: AI agents call tools one at a time, with each result passing back through the model before the next action. For a focused lookup, that works. For a multisignal incident investigation — correlating logs, metrics, traces, and error tracking simultaneously — it’s expensive and slow. Code Execution changes the architecture.

What Happened

Code Execution adds a capability to the Datadog MCP Server that lets AI agents execute sandboxed JavaScript to query multiple Datadog APIs in parallel, join results on shared fields, filter or aggregate large responses before returning evidence, and branch on intermediate results — all without sequential model round-trips. The code runs in “an isolated sandbox without access to the caller’s credentials,” with the MCP service enforcing permissions server-side and returning only sanitized responses.

Datadog benchmarked 25 observability tasks across four models (GPT-5.6 Terra/Sol, Claude Sonnet 5, Claude Opus 4.8):

• Input tokens: 73.2% reduction
• Tool calls: 39.6% fewer
• Answer correctness: 74.1% → 89.6%

The benchmark framing is important: this is Datadog measuring its own product. Independent validation across different workloads will matter. But the directional signal — that consolidating multi-step investigation logic into code reduces both cost and hallucination rate — is architecturally intuitive and consistent with how sequential tool-calling creates error accumulation.

Why It Matters

The accuracy improvement deserves the most attention. Going from 74.1% to 89.6% correct answers on observability tasks isn’t just a cost story — it’s a reliability story for teams building AI agents that participate in incident response. An agent that gets the right answer 89.6% of the time is meaningfully closer to production-usable than one at 74.1%. The mechanism is significant: reducing intermediate context exchanges means less opportunity for model drift between tool calls, and fewer total calls means less surface area for tool-call errors to compound.

For teams using the Datadog MCP Server today, Code Execution doesn’t replace the existing tool-calling approach — it adds a mode. Focused lookups still use direct tool calls; multi-signal investigations use Code Execution. The architecture choice becomes part of agent prompt design.

What This Means for Builders

Two immediate considerations. First, if you’re running AI agents for on-call support, incident triage, or log analysis and you’re using the Datadog MCP Server, Code Execution should go on the evaluation list. The 73.2% token reduction directly translates to cost at scale; the accuracy improvement reduces the false-positive rate on agent-suggested root causes. Second, the sandboxed JavaScript execution model sets an expectation: the agent writes code, the MCP service runs it, the permissions model prevents credential exposure. That’s a different mental model than tool-calling, and the prompting patterns that work for one don’t automatically work for the other.

Source: Datadog Blog

Content created with AI assistance and reviewed for accuracy.