Phase 5 of kr2s-was-i-exploited, run 2026-07-31 against Datadog.
The first attempt at this pulled raw log lines and paginated. That was the wrong approach: the MCP search tool caps each response at roughly 136–222 records, so 6,000 lines would have taken about 44 calls and still produced samples rather than answers.