{
  "slug": "datadog",
  "tool_id": "npm/@winor30/mcp-server-datadog",
  "verdict_url": "/verdict/datadog",
  "verdict_content_hash": "sha256:a08254141efabb0647dd46f19ddacf3b11eeb46f85490d77e44d22785af5ba42",
  "version": "1.7.0",
  "commit": "",
  "dist_shasum": "dd5acb5763dc3dc9e1e8f864765c389de10ad606",
  "scanned_at": "2026-06-14T00:00:00Z",
  "capture_self_test": "verified — a beacon decoy was emitted from the tool's network context; its presence in the intercept means a 'no egress' result would have been trustworthy.",
  "method": "Installed and run in an isolated container; fed traceable decoy data; all outbound traffic intercepted (TLS broken via own CA, iptables transparent redirect). Endpoints, resolved geo/jurisdiction and frequency are observed facts. Capture self-test passed.",
  "request_count": 18,
  "captured_requests": [
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/incidents?page%5Bsize%5D=10&page%5Boffset%5D=0",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/incidents/FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/query?from=1&to=1&query=FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/logs/events/search",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "Content-Type": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Content-Length": "142",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"filter\":{\"query\":\"FILE-CONTENT::canary-70dedd5e-file-2a3fe3455572::END\",\"from\":\"1000\",\"to\":\"1000\"},\"page\":{\"limit\":100},\"sort\":\"-timestamp\"}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/logs/events/search",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "Content-Type": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Content-Length": "143",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"filter\":{\"query\":\"FILE-CONTENT::canary-70dedd5e-file-2a3fe3455572::END\",\"from\":\"1000\",\"to\":\"1000\"},\"page\":{\"limit\":1000},\"sort\":\"-timestamp\"}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/dashboard?filter%5Bshared%5D=false",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/dashboard/FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/host/Canary%20canary-70dedd5e-name-5d3c40d1b33c/mute",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "Content-Type": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Content-Length": "83",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "{\"message\":\"FILE-CONTENT::canary-70dedd5e-file-2a3fe3455572::END\",\"override\":false}",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "POST",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/host/Canary%20canary-70dedd5e-name-5d3c40d1b33c/unmute",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Content-Length": "0",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/hosts?filter=FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND&sort_field=FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND&sort_dir=FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/hosts/totals?from=7200",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/downtime",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "DELETE",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v1/downtime/1",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "*/*",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/rum/applications",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/rum/events?filter%5Bquery%5D=FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND&filter%5Bfrom%5D=1970-01-01T00%3A00%3A01Z&filter%5Bto%5D=1970-01-01T00%3A00%3A01Z&sort=timestamp&page%5Blimit%5D=100",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/rum/events?filter%5Bquery%5D=FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND&filter%5Bfrom%5D=1970-01-01T00%3A00%3A01Z&filter%5Bto%5D=1970-01-01T00%3A00%3A01Z&sort=timestamp&page%5Blimit%5D=2000",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/rum/events?filter%5Bquery%5D=%40type%3Aview+FILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND&filter%5Bfrom%5D=1970-01-01T00%3A00%3A01Z&filter%5Bto%5D=1970-01-01T00%3A00%3A01Z&sort=timestamp&page%5Blimit%5D=2000",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    },
    {
      "method": "GET",
      "scheme": "https",
      "host": "api.datadoghq.com",
      "path": "/api/v2/rum/events?filter%5Bquery%5D=%40application.name%3ACanary+canary-70dedd5e-name-5d3c40d1b33c+%40session.id%3AFILE-CONTENT%3A%3Acanary-70dedd5e-file-2a3fe3455572%3A%3AEND&sort=timestamp&page%5Blimit%5D=2000",
      "headers": {
        "user-agent": "datadog-api-client-typescript/1.58.0 (node 20.20.2; os linux; arch x64)",
        "Accept": "application/json",
        "DD-API-KEY": "canary-dummy",
        "DD-APPLICATION-KEY": "canary-dummy",
        "Accept-Encoding": "gzip,deflate",
        "Host": "api.datadoghq.com",
        "Connection": "keep-alive"
      },
      "body_redacted": "",
      "blocked": true,
      "tls_inspected": true
    }
  ],
  "reproduce": {
    "scanner": "canary-sandbox (open methodology; Docker backend)",
    "command": "python -m canary.cli scan <target> --backend docker   # target: npm @winor30/mcp-server-datadog@1.7.0",
    "note": "Re-run it yourself: the scanner installs the pinned version, drives the tool over MCP, and intercepts all egress."
  },
  "note": "Raw captured outbound requests from one sandbox run (identifiers/keys redacted). This is the underlying observation behind the verdict — re-run the scan to verify.",
  "verification": "verdict_content_hash = sha256 over the canonical verdict JSON; dist_shasum = the npm tarball checksum of the pinned version. Signed artifacts + an append-only immutable log are on the roadmap (toward independent verifiability).",
  "verdict_signature": "ed25519:XBpqnvpVGRdCRrSLZyLVYe4EzxFKUVs97CbJXFJVw1iiW4VPX/4wTyye1FHFkPgFZ3OWVgyEMKb8c3SE3+8tDQ=="
}