Datadog Pup CLI and Agent Skills: Security and Evaluation

This older record retains its original scope. Current buying qualifications above take precedence where terms have changed.

Kingy verdict: Datadog Pup is a serious operational interface for terminal-native agents, not a harmless read-only helper. Its dynamic schema, structured output and OAuth/RBAC model are useful foundations, but the same CLI can reach configuration and destructive commands across a wide Datadog surface.

What Pup adds

Pup is a Rust CLI covering more than 200 commands across more than 33 Datadog product domains. It returns JSON or YAML by default and exposes its command tree through pup agent schema, allowing an agent to load the commands it needs instead of keeping a large static tool catalog in context. The launch guide distinguishes this shell-native workflow from Datadog’s conversational MCP Server. Pup also offers a local ACP server for compatible clients.

The public Agent Skills repository packages workflows for monitors, logs, APM, documentation, agent observability, browser telemetry, audit investigations, software delivery and security ownership. Pup is Apache-2.0 licensed; the separate skills repository is MIT licensed. Open-source clients do not make the Datadog data or underlying services free.

Authentication and control boundaries

The preferred login uses OAuth 2.0 with PKCE, revocable tokens and existing Datadog role-based access control. The repository notes that Dynamic Client Registration must be enabled for this path; otherwise Pup can fall back to API and application keys. OAuth credentials use the platform’s secure store by default, while headless and WASM environments require bearer tokens or keys and do not support browser login.

Inherited RBAC is necessary but not sufficient for agent safety. The documented command examples include deletion, monitor changes, incident access and broad API-backed administration. A human’s role may be wider than the minimum an automated workflow needs. Teams should create a purpose-scoped identity, separate read investigations from mutations, require confirmation for destructive actions, and verify that audit trails distinguish the agent, user and command source.

Pricing and operational cost

Pup and the Agent Skills repositories are public, but Datadog product usage follows the account’s contracts and product-specific meters. A command that queries logs, traces, incidents or cloud-cost data can consume or expose services with different retention and billing models. Public pricing does not define one universal “Pup plan,” so estimate cost from the exact products, data volume and automation frequency in the trial.

How Kingy would evaluate it

Begin with a read-only role and three tasks: retrieve one monitor, search a narrow log window and correlate an incident with a trace. Measure command-schema discovery, output stability, token use, permission failures and audit attribution. Then test one reversible write behind explicit approval. Include expired OAuth, revoked roles, multi-organization selection, a missing DCR configuration and fallback-key leakage. Do not grant broad production access until the workflow fails safely.

Kingy reviewed the launch guide, repositories, API documentation and pricing surface. We did not authenticate to Datadog or execute Pup, and we did not validate the provider’s command-count or product-domain claims independently.

A production pilot should also define a command allowlist, maximum query windows, output-retention rules and an emergency revocation path. Those controls matter because a technically valid command can still be operationally excessive, expensive or inappropriate for the incident at hand.

Primary sources

• Datadog Pup launch guide
• Pup source repository and authentication documentation
• Datadog Agent Skills repository
• Datadog API documentation
• Datadog pricing