{
  "schema": "varexis-public-evidence-record/0.3",
  "generated_at_utc": "2026-10-11T21:27:53.457Z",
  "record_id": "VXI-EXT-TOOL-TRUST-DATADOG-01-v1",
  "record_kind": "external_reference",
  "title": "Datadog MCP: Telemetry access and result completeness",
  "system": "Datadog MCP",
  "evidence_family": "agent_tool_trust_review",
  "index_status": "PUBLIC_SAFE_SOURCE_REVIEW",
  "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY",
  "canonical_question": "Can an agent treat an observability connector's returned trace as complete or assume it cannot change monitoring?",
  "near_questions": [
    "Can an observability tool return an incomplete trace?",
    "Does Datadog MCP include every span of a large trace?",
    "Does the Datadog incident tool include its timeline?",
    "What permissions are required for Datadog MCP writes?",
    "Can an organization hide Datadog MCP write tools?",
    "Does a Datadog MCP role replace resource-level permissions?",
    "Can an AI client send Datadog logs to its model provider?",
    "Is the local Code Security MCP the same as remote Datadog MCP?",
    "How can restricted log visibility affect an investigation?",
    "Should an agent change monitors during evidence collection?",
    "What does a saved Datadog review preserve?",
    "Does this profile measure a live incident's completeness?"
  ],
  "supported_claims": [
    {
      "claim": "Datadog documents role and organization controls for MCP reads and writes, plus resource-specific permissions. Its tool reference warns that a large trace may be truncated without a way to retrieve every span. Incident details also omit timeline data. Treat those limits as coverage boundaries when investigating an outage; an incomplete response is not a complete incident record.",
      "reliance": "DOCUMENTED_CAPABILITY_ONLY"
    }
  ],
  "not_demonstrated_claims": [
    "Verified buyer configuration or effective access rights",
    "Independent tool execution or security testing",
    "Vendor certification, guaranteed safety or no-training assurance"
  ],
  "public_summary": "Datadog documents role and organization controls for MCP reads and writes, plus resource-specific permissions. Its tool reference warns that a large trace may be truncated without a way to retrieve every span. Incident details also omit timeline data. Treat those limits as coverage boundaries when investigating an outage; an incomplete response is not a complete incident record.",
  "related_record_ids": [
    "VXI-EXT-TOOL-TRUST-GRAFANA-01-v1",
    "VXI-EXT-TOOL-TRUST-ELASTIC-01-v1"
  ],
  "source_review": {
    "source_type": "official_external_documentation",
    "source_title": "Datadog MCP data access boundaries",
    "source_url": "https://docs.datadoghq.com/mcp_server/",
    "checked_on": "2026-10-11",
    "candidate_record_id": "VXI-EXT-TOOL-TRUST-DATADOG-01-v1",
    "candidate_record_sha256": "7676b70c527c0f8518f0731a0ae22012b5d3772eb3017ea3016532f71e1af203",
    "method": "Primary documentation reviewed for the published bounded statement.",
    "deployment_tested_by_varexis": false,
    "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research."
  },
  "answer_policy": {
    "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY",
    "bounded_answer": "Datadog documents role and organization controls for MCP reads and writes, plus resource-specific permissions. Its tool reference warns that a large trace may be truncated without a way to retrieve every span. Incident details also omit timeline data. Treat those limits as coverage boundaries when investigating an outage; an incomplete response is not a complete incident record.",
    "required_buyer_context": "Datadog's main remote MCP service; excludes the separate local Code Security MCP server. Regional availability, actual roles, data-access restrictions, toolsets and client retention.",
    "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state."
  },
  "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.",
  "trust_profile": {
    "schema": "varexis-agent-tool-trust/1",
    "identity": {
      "tool": "Datadog MCP",
      "variant": "Datadog's main remote MCP service; excludes the separate local Code Security MCP server."
    },
    "review_status": "documentation_review_only",
    "checked_on": "2026-10-11",
    "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.",
    "plan_scope": "Buyer plan, feature entitlement and effective configuration are not verified.",
    "findings": [
      {
        "field": "operator",
        "label": "Publisher and operator",
        "status": "documented",
        "statement": "Datadog provides the hosted main MCP service.",
        "source_ids": [
          "datadog-main"
        ]
      },
      {
        "field": "purpose",
        "label": "Purpose",
        "status": "documented",
        "statement": "Retrieve observability context and perform permitted monitoring operations.",
        "source_ids": [
          "datadog-main"
        ]
      },
      {
        "field": "reads",
        "label": "Read capability",
        "status": "documented",
        "statement": "Logs, metrics, traces and incidents are exposed by selected tools; large traces can be truncated.",
        "source_ids": [
          "datadog-tools"
        ]
      },
      {
        "field": "writes",
        "label": "Write capability",
        "status": "documented",
        "statement": "Product toolsets include resource changes such as monitor creation; availability depends on write controls.",
        "source_ids": [
          "datadog-setup",
          "datadog-tools"
        ]
      },
      {
        "field": "auth",
        "label": "Authentication",
        "status": "documented",
        "statement": "OAuth is documented; token-based and API/application-key paths are also described for other clients.",
        "source_ids": [
          "datadog-setup"
        ]
      },
      {
        "field": "permissions",
        "label": "Permission surface",
        "status": "documented",
        "statement": "MCP role permissions, underlying resource permissions and organization-wide access switches all apply.",
        "source_ids": [
          "datadog-setup"
        ]
      },
      {
        "field": "egress",
        "label": "Data leaving the environment",
        "status": "review_inference",
        "statement": "The AI client controls onward model disclosure; limiting returned telemetry limits potential exposure.",
        "source_ids": [
          "datadog-main"
        ]
      },
      {
        "field": "failures",
        "label": "Failure modes to consider",
        "status": "review_inference",
        "statement": "Missing spans or incident history treated as complete evidence, excessive log access, or unintended monitor changes.",
        "source_ids": [
          "datadog-tools"
        ]
      },
      {
        "field": "unknown",
        "label": "Unknowns and applicability",
        "status": "unknown",
        "statement": "Regional availability, actual roles, data-access restrictions, toolsets and client retention.",
        "source_ids": []
      },
      {
        "field": "gate",
        "label": "Suggested refusal or clarification condition",
        "status": "varexis_review_policy",
        "statement": "Mark incomplete traces and timelines explicitly; withhold monitoring changes during an evidence-only investigation.",
        "source_ids": []
      }
    ],
    "evidence_sources": [
      {
        "source_id": "datadog-main",
        "url": "https://docs.datadoghq.com/mcp_server/",
        "final_url": "https://docs.datadoghq.com/mcp_server/",
        "title": "Datadog MCP data access boundaries",
        "checked_on": "2026-10-11",
        "sha256": "1a5b57c9e7821fdc08a3f861e867d9c14d29751bef91008e0a96e4a18771e6e7",
        "bytes": 811862
      },
      {
        "source_id": "datadog-setup",
        "url": "https://docs.datadoghq.com/mcp_server/setup/",
        "final_url": "https://docs.datadoghq.com/mcp_server/setup/",
        "title": "Datadog MCP authentication and role controls",
        "checked_on": "2026-10-11",
        "sha256": "7f2b5096fc0ca7d7b0dd893b54970ff5b753dd2c1eb94be7f8e7534e3b5fbd68",
        "bytes": 820802
      },
      {
        "source_id": "datadog-tools",
        "url": "https://docs.datadoghq.com/mcp_server/tools/",
        "final_url": "https://docs.datadoghq.com/mcp_server/tools/",
        "title": "Datadog MCP tools and response limitations",
        "checked_on": "2026-10-11",
        "sha256": "72229d69ad0c94d2852c1f64d24b759ad7e3549f1f4381899315ace60c4b5811",
        "bytes": 1015870
      }
    ],
    "observed_tool_execution": false,
    "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.",
    "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.",
    "paid_value": {
      "decision_context": "Retain access and response-completeness limits alongside an incident-review decision.",
      "free": "Complete profile, practical questions, sources and limitations; may be saved locally.",
      "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.",
      "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.",
      "excluded": [
        "Fresh vendor research",
        "Continuous monitoring or change alerts",
        "Testing the buyer configuration",
        "Private evidence or vendor certification"
      ],
      "integrity": "Hashes identify content versions; they do not prove truth or provide a signature."
    },
    "revalidation": {
      "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.",
      "specific_watch": "Recheck organization switches, toolset permissions and trace/timeline limitations before each new investigation workflow."
    },
    "change_history": [
      {
        "version": 1,
        "date": "2026-10-11",
        "change": "Initial documentation review; no earlier vendor assessment claimed."
      }
    ]
  },
  "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.",
  "service_route": {
    "request_guide": "/varexis-index/request.html",
    "request_workflow": "/varexis-index/request-workflow.json",
    "service_id": "single_request",
    "service_routes_url": "/varexis-index/service-routes.json",
    "payment_required": true,
    "availability_endpoint": "/api/index/capabilities",
    "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED",
    "checkout_url": "/index-access"
  },
  "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.",
  "human_page": "/varexis-index/catalog.html#datadog-mcp-telemetry-completeness-trust",
  "machine_readable_record": "/varexis-index/records/datadog-mcp-telemetry-completeness-trust.json"
}