agent-dd

Triage-shaped, not admin-shaped — the commands an investigation needs, not 200+ Datadog API endpoints

NDJSON everywhere by default — one object per line for lists, one line per id for gets; --format json|yaml overrides

Compact and null-pruned by default — monitors come back as id, name, status, type until you ask for --full

Errors classify themselves — fixable_by: agent means fix your parameters, human means stop and ask, retry means wait

Item-level misses do not lose the batch — an unresolvable id becomes an @unresolved line on stdout with exit 0

Monitor updates are surgical — it reads the monitor, layers your changes on and writes the whole definition back, so restricted_roles, composite sub-monitors and unmodelled options survive untouched

Every update reports its own diff — a changes map of exactly which fields moved, and from what to what

--dry-run validates against Datadog without creating anything

--body escape hatch — pass a whole monitor definition as inline JSON, @file or @- for options with no dedicated flag

Secrets stay off argv — --form uses a native OS dialog, or pipe both keys on stdin, one per line

Multi-org — several Datadog organizations and sites side by side, selected with --org

Flexible time — relative (now-15m), RFC3339 or unix epoch, on every --from and --to

Runs as an MCP server over stdio or HTTP, and ships a mock Datadog API for testing without an account