dd-pup
Datadog CLI (Rust). OAuth2 auth with token refresh.
Security Assessment
Detected risks:
About dd-pup
pup is a Rust-based command-line interface for Datadog API operations, supporting both OAuth2 with automatic token refresh and API-key authentication. It exposes a broad command surface for day-to-day observability and incident work, organised into a quick-reference table and per-area command groups. Authentication is handled through pup auth login for the OAuth2 browser flow, with auth status to check token validity and time remaining, auth refresh to renew an expired token without a browser, and auth logout to clear credentials. Because tokens expire after roughly an hour, a command that fails mid-session with 401 or 403 should trigger a refresh first and a full re-login only if that fails. For headless or CI environments, credentials are supplied via the DD_API_KEY, DD_APP_KEY, and DD_SITE environment variables, with DD_SITE selecting the Datadog region such as datadoghq.com or datadoghq.eu. Command coverage spans logs (search and aggregate), metrics query and list, APM services and trace search, monitors (list, get, search, create, update, delete) and downtime scheduling in place of mute/unmute, incidents (list, get, import), dashboards, SLOs and SLO status, synthetics tests and locations, on-call teams and memberships, hosts and infrastructure, events, users and teams, security signal triage, and audit logs searched with Lucene syntax. It also reaches newer surfaces including service catalog, notebooks, workflows (get, run, instances), observability pipelines (with validate), and LLM Observability projects, experiments, and datasets. JSON output can be piped to jq for further processing. A required input-resolution procedure keeps commands safe: values such as env, service name, team ID, or resource IDs are taken from conversation context first, discovered via a list or search command if missing, and confirmed with the user if still ambiguous, so commands are never run with unresolved placeholders. Users are also reminded to confirm the environment tag before assuming production. Installation follows the repository's setup instructions.
FAQ
What authentication methods does pup support?
OAuth2 via a browser login (pup auth login) with automatic token refresh, and API-key authentication using the DD_API_KEY, DD_APP_KEY, and DD_SITE environment variables for headless or CI use.
A command started failing with a 401 mid-session, what should I do?
Tokens expire after about an hour. Run pup auth refresh first, and only fall back to a full pup auth login if the refresh fails.
How do I mute a monitor?
There are no monitors mute/unmute commands; scheduling downtime via a payload is used instead, for example pup downtime create --file downtime.json.
How does pup avoid running commands with missing values?
It resolves required scope values in order, checking context, then running a discovery list or search, then asking the user, and never runs commands containing unresolved placeholders like <env> or <monitor-id>.
What syntax do audit-log searches use?
Lucene syntax, the same as the Datadog Log Explorer, for example pup audit-logs search --query "@action:deleted" --from 24h; results can be sent to jq with -o json.
Install dd-pup
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
datadog-labs/agent-skills